Minoru Kobayashi

macosac. Forensic Artifact Collection Tool for macOS

fjta. FJTA (Forensic Journal Timeline Analyzer) is a tool that analyzes Linux filesystem (ext4, XFS) journals (not systemd-journald logs), generates timelines, and detects suspicious activities.

vss_carver. Carves and recreates VSS catalog and store from Windows disk image.

ma2tl. macOS forensic timeline generator using the analysis result DBs of mac_apt

norimaci. Norimaci is a simple and lightweight malware analysis sandbox for macOS

bgiparser. A parsing tool for backgrounditems.btm

DSStoreParser. macOS .DS_Store Parser

linimagemounter. LinImageMounter is a Python tool designed to simplify the process of mounting disk images on Linux systems.

libvmdk-Shift_JIS. Library and tools to access the VMware Virtual Disk (VMDK) format

mac_apt. macOS (& ios) Artifact Parsing Tool

cidre-vm. Software installation scripts for macOS systems that allows you to setup a Virtual Machine (VM) for reverse engineering macOS malware

libvshadow-vss_carver. Library and tools to access the Volume Shadow Snapshot (VSS) format

precompiled_libyal_libs. Pre-compiled libyal libraries

FSEventsParser. Parser for OSX/iOS FSEvents Logs

Mac_ISF. Volatility3 ISF for Mac Os memory forensic.

CrackMapExec. A swiss army knife for pentesting networks

lldbinit. A gdbinit clone for LLDB

objective-see_Malware. macOS Malware Collection

afro. File recovery for APFS

sqlite-dissect. DC3 SQLite Dissect

llios. Random stuff about lower level iOS

Hibr2Bin. Comae Hibernation File Decompressor

uac. UAC is a Live Response collection script for Incident Response that makes use of native binaries and tools to automate the collection of AIX, Android, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris systems artifacts.

LinuxMalwareSourceCode. This is a repository of the source code of various malware targeting the *nix (mostly Linux) operating systems.

Mirai-Source-Code. Leaked Mirai Source Code for Research/IoC Development Purposes

APT06202001. Applied Purple Teaming - Infrastructure, Threat Optics, and Continious Improvement - June 6, 2020

volatility-plugins. Plugins I've written for Volatility

LinuxForensics. Everything related to Linux Forensics

macOS_FE. Tools for macOS Forensic Bootable media

WindowsMalwareSourceCode. Collection of Source Code of Various Malware Targeting the Windows Platform

KnockKnock. Enumerate persistently installed software

macos_execute_from_memory. PoC of macho loading from memory

flare-ida. IDA Pro utilities from FLARE team

Malware-Analysis-Training. Retired beginner/intermediate malware analysis training materials from @pedramamini and @erocarrera.

trochilus. A Fast & free Windows remote administration tool.