Example Usage

HKLM\Software\Policies\Microsoft\Windows\SrpV2     (XML policy storage, persistent)
HKLM\SYSTEM\CurrentControlSet\Control\Srp\Gp\Exe  (SDDL binary format, active enforcement)
HKLM\SYSTEM\CurrentControlSet\Control\AppID\CertStore (Certificate cache)

See also

Volatility Workbench

Free

Free GUI front-end for Volatility 3 memory forensics framework on Windows. Simplifies memory analysi…

soSaver

Open Source

A Frida-based utility for dynamically extracting native (.so) libraries from Android applications.…

speakeasy

Open Source

Windows kernel and user mode emulation.…

Binwalk

Open Source Kali

Firmware analysis tool for searching, extracting, and analyzing binary images. Identifies embedded f…

AMSI Bypass Techniques

Open Source

Collection of PowerShell AMSI (Antimalware Scan Interface) bypass techniques. Patches AMSI in-memory…

fastfinder

Free

Incident Response - Fast suspicious file finder…