Core Analyzer is a production-grade memory debugging tool that integrates with GDB (as a plugin) and WinDbg (as an extension) to provide deep heap introspection, object reference tracking, and memory corruption detection for core dumps and live processes. It supports multiple heap allocators (glibc ptmalloc, tcmalloc, jemalloc, mimalloc, Windows CRT, Darwin malloc) by parsing their internal metadata structures directly from target memory. The tool offers commands to walk heap blocks, search for pointer references across registers/stack/globals/heap, detect C++ objects via vtables, find shared objects across threads (race condition candidates), and annotate disassembly with object context. The architecture is a plugin system where each allocator registers a `CoreAnalyzerHeapInterface` struct, and the core engine provides segment management, binary-search-accelerated block lookup, and bit-vector-optimized memory scanning. The codebase is heavily coupled to debugger internals (GDB C API, WinDbg COM) and maintains separate source copies for multiple GDB versions (9.2, 12.1, 16.3, 17.1), which increases maintenance burden but ensures compatibility. The project includes a comprehensive test suite using Docker containers across Linux distributions and allocator versions.
This repository is a collection of Proof of Concept (PoC) implementations for various Windows process manipulation and evasion techniques, including process hollowing, DLL injection, spoofing, and memory analysis. Each technique is implemented as a standalone console application with a consistent structure separating command-line handling, core logic, and Windows API interop. The code demonstrates a clear understanding of Windows internals but suffers from significant code duplication (e.g., identical CommandLineParser and HexDump utilities across multiple projects) and relies on undocumented APIs that are prone to breaking with Windows updates. Many techniques are noted in the README as ineffective against modern Windows defenses due to security mitigations. The repository appears to be stale, with no recent updates to address evolving defenses, and exhibits high technical drift due to outdated dependencies and techniques.