memory-forensics 开源项目推荐（350 个）

hasherezade /pe-sieve

Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).

hasherezade /hollows_hunter

扫描所有正在运行的进程。识别并丢弃各种潜在的恶意植入物（替换/植入的PE、外壳代码、挂钩、内存补丁）。

stuxnet999 /MemLabs

面向对记忆取证感兴趣的个人的教育性CTF风格实验室

microsoft /avml

AVML - Acquire Volatile Memory for Linux

JLospinoso /gargoyle

Historical Windows temporal memory-state research artifact for studying time-bound memory observations, validation limits, and defensive visibility.

hasherezade /mal_unpack

Dynamic unpacker based on PE-sieve

LETHAL-FORENSICS /MemProcFS-Analyzer

MemProcFS-Analyzer - 针对DFIR的Windows内存转储自动取证分析

swwwolf /wdbgark

WinDBG Anti-RootKit Extension

teamdfir /sift

SIFT

patois /IDACyber

Data Visualization Plugin for IDA Pro

LETHAL-FORENSICS /Collect-MemoryDump

Collect-MemoryDump - Automated Creation of Windows Memory Snapshots for DFIR

cado-security /varc

Volatile Artifact Collector collects a snapshot of volatile data from a system. It tells you what is happening on a system, and is of particular use when investigating a security incident.

gleeda /memtriage

Allows you to quickly query a Windows machine for RAM artifacts

msuiche /LiveCloudKd

Hyper-V Research is trendy now

asiamina /A-Course-on-Digital-Forensics

A course on "Digital Forensics" designed and offered in the Computer Science Department at Texas Tech University

kh4sh3i /Malware-Analysis

A curated list of awesome malware analysis tools and resources

ridgelinecyberdefence /vanguard

跨平台事件响应工具包。28个预建用例，单一二进制，零安装。支持内存、磁盘、网络和云收集，并自动生成时间线。

vibheksoni /dma-spoofer

首个用Rust编写的基于DMA的开源HWID伪装器。通过直接内存访问伪造硬件ID。

cado-security /rip_raw

Rip Raw is a small tool to analyse the memory of compromised Linux systems.

AtlasFO /Atlas-Community

Autonomous DFIR agent: point it at disk images, memory dumps or log exports and get back an investigation that shows its work. Volatility 3, Plaso, YARA and any OpenAI-compatible LLM.