Cr4sh / smram_parse
Licence: GPL-3.0 license
System Management RAM analysis tool
Stars: ✭ 50
Programming Languages
python
139335 projects - #7 most used programming language
Projects that are alternatives of or similar to smram parse
WELA
WELA (Windows Event Log Analyzer): The Swiss Army knife for Windows Event Logs! ゑ羅（ウェラ）
Stars: ✭ 442 (+784%)
Mutual labels: analysis, forensics, dfir
Timesketch
Collaborative forensic timeline analysis
Stars: ✭ 1,795 (+3490%)
Mutual labels: analysis, forensics, dfir
INDXRipper
Carve file metadata from NTFS index ($I30) attributes
Stars: ✭ 32 (-36%)
Mutual labels: forensics, dfir
uac
UAC is a Live Response collection script for Incident Response that makes use of native binaries and tools to automate the collection of AIX, Android, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris systems artifacts.
Stars: ✭ 260 (+420%)
Mutual labels: forensics, dfir
MEAT
This toolkit aims to help forensicators perform different kinds of acquisitions on iOS devices
Stars: ✭ 101 (+102%)
Mutual labels: forensics, dfir
hayabusa
Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.
Stars: ✭ 908 (+1716%)
Mutual labels: forensics, dfir
CDIR
CDIR (Cyber Defense Institute Incident Response) Collector - live collection tool based on oss tool/library
Stars: ✭ 122 (+144%)
Mutual labels: forensics, dfir
ad-privileged-audit
Provides various Windows Server Active Directory (AD) security-focused reports.
Stars: ✭ 42 (-16%)
Mutual labels: forensics, dfir
DFIR-O365RC
PowerShell module for Office 365 and Azure log collection
Stars: ✭ 158 (+216%)
Mutual labels: forensics, dfir
GetConsoleHistoryAndOutput
An Incident Response tool to extract console command history and screen output buffer
Stars: ✭ 41 (-18%)
Mutual labels: forensics, dfir
RdpCacheStitcher
RdpCacheStitcher is a tool that supports forensic analysts in reconstructing useful images out of RDP cache bitmaps.
Stars: ✭ 176 (+252%)
Mutual labels: forensics, dfir
SmmExploit
The report and the exploit of CVE-2021-26943, the kernel-to-SMM local privilege escalation vulnerability in ASUS UX360CA BIOS version 303.
Stars: ✭ 98 (+96%)
Mutual labels: uefi, smm
MindMaps
#ThreatHunting #DFIR #Malware #Detection Mind Maps
Stars: ✭ 224 (+348%)
Mutual labels: forensics, dfir
Qiling
Qiling Advanced Binary Emulation Framework
Stars: ✭ 2,816 (+5532%)
Mutual labels: analysis, uefi
CCXDigger
The CyberCX Digger project is designed to help Australian organisations determine if they have been impacted by certain high profile cyber security incidents. Digger provides threat hunting functionality packaged in a simple-to-use tool, allowing users to detect certain attacker activities; all for free.
Stars: ✭ 45 (-10%)
Mutual labels: forensics, dfir
iTunes Backup Reader
Python 3 Script to parse out iTunes backups
Stars: ✭ 108 (+116%)
Mutual labels: forensics, dfir
System Management RAM analysis tool. ************************************************************************** For more information about this project please read the following article: http://blog.cr4.sh/2016/10/exploiting-ami-aptio-firmware.html To use full capabilities of this tool you need to install UEFIDump (https://github.com/LongSoft/UEFITool/releases/tag/A32), ida-efiutils (https://github.com/snare/ida-efiutils) and edit corresponding variables in smram_parse.py code. This tool was tested only with 6 generation Intel NUC firmware based on AMI Aptio V code base. FEATURES: * SMRAM and SMST address information * Loaded SMM drivers list * SMM protocols list * SMI entry address for each CPU * SW SMI handlers list * Root SmiHandlerRegister() handlers list * Child SmiHandlerRegister() handlers list USAGE: $ smram_parse.py <SMRAM_dump> [flash_image_dump] Output example: https://raw.githubusercontent.com/Cr4sh/smram_parse/master/EXAMPLE.TXT Written by: Dmytro Oleksiuk (aka Cr4sh) [email protected] http://blog.cr4.sh
Note that the project description data, including the texts, logos, images, and/or trademarks,
for each open source project belongs to its rightful owner.
If you wish to add or remove any projects, please contact us at [email protected].