Popular repositories Loading

1. editbox editbox Public

   EditBox is a plugin for the Volatility Framework. It extracts the text from Windows Edit controls, that is, textboxes as generated by Windows Common Controls.

   Python 24 4

2. ndispktscan ndispktscan Public

   NDISPktScan is a plugin for the Volatility Framework. It parses the Ethernet packets stored by ndis.sys in Windows kernel space memory.

   Python 12 4

3. regsize regsize Public

   Parses Windows Registry hive files listing the biggest key values by the size of their associated data.

   Python 7 1

4. regentropy regentropy Public

   Parses Windows Registry hive files listing the key values with a high entropy.

   Python 6 1

5. mbrmd5 mbrmd5 Public

   Calculates the MD5 of the first 440 bytes of physical drives and dumps to disk.

   C 3

6. batchsigcheck batchsigcheck Public

   Automates running sigcheck against a text file of file paths.

   Python 3