LiME is a Linux kernel module (LKM) for volatile memory acquisition from Linux and Android systems, widely used in digital forensics and incident response. It dumps physical memory ranges marked as "System RAM" by walking the kernel's iomem resource tree, writing output to a local file or streaming over a TCP connection. The module supports three output formats (raw, padded, and lime with metadata headers), optional zlib compression, optional cryptographic digest sidecar files (leveraging the kernel's crypto API), and direct I/O. It minimizes interaction with user space during capture to produce more forensically sound images. The architecture is a classic kernel module with clearly separated concerns: main.c drives the iomem traversal and orchestrates output via vtable-like structures; tcp.c and disk.c provide network and file-system transport; hash.c wraps three generations of kernel crypto APIs (ahash, hash, tfm) for portable digest support; and deflate.c wraps zlib with balanced memory settings. The codebase is aggressively version-aware, supporting kernels from 2.6.11 through 6.19 with conditionally compiled code paths for API breakpoints (e.g., set_fs removal, kmap_local_page, sock_set_reuseaddr). The project ships an exceptionally thorough CI/CD pipeline (GitHub Actions) that compiles against eight pinned kernel series and a canary latest-kernel build, runs sparse static analysis and custom grep-based source checks, and boots real kernels in QEMU to perform runtime smoke tests of all output formats, digest, and compression. A self-contained local testing harness (Docker) enables developers to reproduce the full CI matrix offline. Configuration management, kernel tree caching, and version pinning are handled by well-documented scripts that are themselves reusable for other kernel module projects.
libfsrefs is a C library for reading and parsing the Microsoft Resilient File System (ReFS). It provides a forensic-oriented API to access volume headers, checkpoints, metadata blocks, file entries, and directory structures. The library is read-only and currently supports ReFS version 1 (experimental). It includes a command-line tool `fsrefsinfo` that outputs volume details and can generate bodyfile-format timelines for digital forensics. The architecture follows the libyal ecosystem pattern: layered parsing with abstractions for file I/O (libbfio), error handling (libcerror), and string encoding (libuna). The codebase is well-structured with extensive unit tests, OSS-Fuzz integration, and cross-platform build support via autotools and MSVC. While the library is not intended as a standalone application, it is a robust foundation for forensic tools that need to analyze ReFS volumes.
This repository is a curated list of tools and resources for security incident response and digital forensics (DFIR). It is organized into categories such as adversary emulation, evidence collection, log analysis tools, memory analysis tools, and more. Each entry includes a link and a brief description. The project includes GitHub Actions workflows to automatically check for broken URLs in the documentation and to lint the README for spelling errors, ensuring the list remains accurate and well-maintained. The primary value of this repository lies in its comprehensive collection of DFIR resources, which serves as a reference for security analysts and teams. The maintenance workflows demonstrate a commitment to data quality by proactively validating links and checking for spelling errors, which is essential for a resource list that relies on external URLs. While the repository does not contain complex data pipelines or analytical code, it effectively fulfills its purpose as a reference list through structured markdown and automated upkeep.
This repository, branded as "The Malware Bible," is a curated educational knowledge base for cybersecurity, malware analysis, reverse engineering, and exploit development. It is not a conventional software application or an operational data pipeline; under the available classifications it is closest to data/research because its core assets are reference documentation, course-style Markdown modules, and research-oriented binaries rather than runnable application code. The content is organized into four learning paths: The Beginning (C, Python, x86 assembly, shellcode, reverse engineering basics), The Journey (PE/ELF structures, Android/iOS package formats), The Rituals (obfuscation, evasion, and writing malware), and The Scriptures (tool cheatsheets for radare2, IDA Pro, WinDbg, YARA, WinAPI, and evasion tactics). In practice, the repository serves as a self-study curriculum and analyst reference, not as a deployable system. It includes a large Windows DLL export catalog in Markdown, example ELF binaries demonstrating heap overflow, use-after-free, ROP chains and format string bugs, and numerous screenshots/diagrams. There is no CI/CD, dependency management, or automated testing; several files are marked "Coming soon" or "WORK IN PROGRESS," and external links or sponsor images may rot over time. The Windows API and DLL reference content is broad but may drift as Windows evolves. The last commit is recent, indicating active maintenance, and the repository benefits from a structured table of contents and consistent formatting across chapters.