Volatility

MalConfScanJPCERTCC/MalConfScan

A Volatility plugin that extracts configuration data and decoded strings from known malware families in memory images.

ROPMEMUCisco-Talos/ROPMEMU

A framework to analyze, dissect, and decompile complex code-reuse attacks like ROP chains from memory dumps.

VolDiffaim4r/VolDiff

A Python script that uses Volatility to analyze malware memory footprints by comparing Windows memory images before and after infection.

Muninnytisf/muninn

A memory forensics helper that automates initial data extraction from Windows memory images using Volatility.

TotalRecallsketchymoose/TotalRecall

A Volatility-based script for memory forensics that runs plugins, creates timelines, and scans for malware using YARA, ClamAV, and VirusTotal.