RME-DisCo Research Group
Official repository of RME, a part of the DisCo research group from University of Zaragoza focused on software and systems security
Zaragoza, Spain
Pinned Repositories
instant-messaging-artifact-finder
Tool to find memory artifacts present in instant messaging applications.
modex
Volatility 3 plugins to extract a module as complete as possible
MOSTO-Modbus-simulator
MOSTO is a SCADA network device simulator based on ModbusTCP communications. Based on Python3
pinVMShield
A pintool for protecting a sandbox application of common anti-virtualmachine and anti-sandbox detection techniques
processfuzzyhash
Volatility plugin to calculate and compare Windows processes fuzzy hashes
rop3
A tool to search for gadgets, operations, and ROP chains using a backtracking algorithm in a tree-like structure
sigcheck
Volatility plugin to validate Authenticode-signed processes, either with embedded signature or catalog-signed
winapi-categories
Windows API (WinAPI) functions and system calls with categories in JSON format, including arguments (SAL notation) and more.
windows-memory-extractor
Tool to extract contents from the memory of Windows systems.
winesap
Volatility plugin to search for all Autostart Extensibility Points (AESPs)
RME-DisCo Research Group's Repositories
reverseame/sigcheck
Volatility plugin to validate Authenticode-signed processes, either with embedded signature or catalog-signed
reverseame/rop3
A tool to search for gadgets, operations, and ROP chains using a backtracking algorithm in a tree-like structure
reverseame/windows-memory-extractor
Tool to extract contents from the memory of Windows systems.
reverseame/modex
Volatility 3 plugins to extract a module as complete as possible
reverseame/winapi-categories
Windows API (WinAPI) functions and system calls with categories in JSON format, including arguments (SAL notation) and more.
reverseame/instant-messaging-artifact-finder
Tool to find memory artifacts present in instant messaging applications.
reverseame/pinVMShield
A pintool for protecting a sandbox application of common anti-virtualmachine and anti-sandbox detection techniques
reverseame/winesap
Volatility plugin to search for all Autostart Extensibility Points (AESPs)
reverseame/processfuzzyhash
Volatility plugin to calculate and compare Windows processes fuzzy hashes
reverseame/APOTHEOSIS
A specialized implementation of the Hierarchical Navigable Small World (HNSW) data structure adapted for efficient nearest neighbor lookup of approximate matching hashes
reverseame/MOSTO-Modbus-simulator
MOSTO is a SCADA network device simulator based on ModbusTCP communications. Based on Python3
reverseame/malscan
Volatility plugin to detect malicious code thanks to ClamAV
reverseame/residentmem
Volatility plugin to obtain the number of the resident memory pages per module (exe or dll) and per driver from a Windows memory dump.
reverseame/similarity-unrelocated-module
Volatility plugin to yield and compare similarity digest of modules on execution.
reverseame/asistencia-aula-EINA-telegram-bot
Bot de Telegram para facilitar la entrada de datos de asistencia presencial en aulas de la EINA
reverseame/cape-hook-generator
CAPEv2 (capemon) hook skeleton generator (hookdefs) for your malware analysis needs.
reverseame/capemon
capemon: CAPE's monitor
reverseame/chiton
Chiton is a Python library to exfiltrate data encapsulating the data into IoT protocol’s packets
reverseame/dumd-mixer
Dump Module Mixer (dumd-mixer) is a Python script to generate a module from the same module extracted from a collection of memory dumps.
reverseame/MALVADA
MALVADA: Malware Execution Traces Dataset generation.
reverseame/MANTILLA
...
reverseame/Secure_Socket
C++ Sockets implementing hybrid encryption
reverseame/EvalMe
EvalMe: an evaluation and benchmarking tool
reverseame/openssl
TLS/SSL and crypto library
reverseame/RAMPAGE
RAMPAGE is a framework aimed at training and comparing machine learning models for the detection of Algorithmically Generated Domains.
reverseame/sum-plugin
Volatility 2.6 plugin to undo modifications done by relocation process on modules