This roundup focuses on memory tools that help with forensics. Only free and open source software is eligible for inclusion here.
Read more
Category: Security
PCILeech – physical memory acquisition and security research tool
PCILeech uses DMA hardware and software memory sources to acquire, inspect and analyse physical memory for forensic and security research.
Read more
LeechCore – physical memory acquisition library
LeechCore provides C, Python and C# APIs for acquiring physical memory from dump files, virtual machines and supported DMA devices.
Read more
emd – eBPF-based Linux memory acquisition tool
emd captures physical memory on Linux using eBPF, providing forensic investigators with a command-line acquisition tool.
Read more
LEMON – eBPF-based memory acquisition utility
LEMON uses eBPF to acquire physical memory on Linux and Android, producing LiME images for forensic analysis without kernel modules.
Read more
mquire – query Linux memory dumps using SQL
mquire examines Linux memory snapshots using SQL queries, reconstructing processes, kernel structures and cached files from embedded data.
Read more
Sealed Secrets – one-way encrypted secrets
Sealed Secrets is a Kubernetes security tool that lets you encrypt Secret manifests into SealedSecret resources.
Read more
Commix – Python-based penetration testing tool
Commix investigates OS command injection flaws in web applications, using several detection techniques and configurable HTTP test requests.
Read more
Dalfox – command-line security tool
Dalfox tests web applications for cross-site scripting, with parameter discovery, XSS verification, WAF detection and scan reports.
Read more
Wfuzz – web application fuzzer and Python library for security assessments
Wfuzz tests web applications by injecting payloads into requests, combining wordlists and filtering responses during security assessments.
Read more
Picocrypt NG – lightweight file encryption tool
Picocrypt NG encrypts files with XChaCha20 and Argon2id. Explore its GUI, password-based volumes, error correction and recovery features.
Read more
SiriKali – graphical frontend for encrypted filesystems
SiriKali manages encrypted folders and remote mounts with multiple backends. Explore its GUI, favourites, password storage and automation.
Read more
ThreatDeck – monitor threat intelligence feeds
ThreatDeck is a Rust-based terminal application for monitoring threat intelligence feeds and generating alerts from matched content.
Read more
fscrypt – Go tool for managing Linux filesystem encryption
fscrypt is a high-level command-line utility for managing Linux native filesystem encryption on supported filesystems.
Read more
LIEF – work with executable and binary formats
LIEF is a cross-platform library for working with executable and binary formats.
Read more
RetDec – retargetable machine-code decompiler
RetDec is a retargetable machine-code decompiler based on LLVM.
Read more
Rizin – UNIX-like reverse engineering framework
Rizin is a UNIX-like reverse engineering framework and command-line toolset for examining binaries, disassembling code, debugging programs.
Read more
Cutter – graphical reverse engineering platform
Cutter is a graphical reverse engineering platform designed for analysing compiled binaries without needing a command line.
Read more
unblob – extraction suite for working with unknown binary blobs
unblob is an extraction suite for working with unknown binary blobs.
Read more
FLOSS – malware analysis utility
FLOSS is a malware analysis utility that automatically extracts and deobfuscates strings from executable binaries.
Read more