Popular repositories Loading

1. editbox editbox Public

   EditBox is a plugin for the Volatility Framework. It extracts the text from Windows Edit controls, that is, textboxes as generated by Windows Common Controls.

   Python 23 4

2. ndispktscan ndispktscan Public

   NDISPktScan is a plugin for the Volatility Framework. It parses the Ethernet packets stored by ndis.sys in Windows kernel space memory.

   Python 11 4

3. regsize regsize Public

   Parses Windows Registry hive files listing the biggest key values by the size of their associated data.

   Python 7 1

4. regentropy regentropy Public

   Parses Windows Registry hive files listing the key values with a high entropy.

   Python 6 1

5. mbrmd5 mbrmd5 Public

   Calculates the MD5 of the first 440 bytes of physical drives and dumps to disk.

   C 3

6. linux_xwindows linux_xwindows Public

   linux_xwindows is a plugin for the Volatility Framework. It extracts various metadata from the window objects registered to X.

   Python 3 2