Tool

ROPMEMU

ROPMEMU analyzes code-reuse attacks from a physical memory dump and reconstructs equivalent code for ordinary reverse-engineering tools. Memory forensics uses Volatility plugins. Emulation and multi-path execution use Unicorn. It then recovers a control-flow graph and applies compiler transformations. The project paper appeared at AsiaCCS 2016. Documentation is on the project wiki.

Targets: Binary
Category: Native analysis tools
Relationship: Foundation tool
Sources reviewed: 2026-11-07

Stars: 285
Last commit: 2016-05-24
Language: Python
License (GitHub): LGPL-2.1

GitHub data as of 2026-11-09

Copy as Markdown View JSON Cite

Requirements & limits

A physical memory dump. Follow the project wiki.
The README names no license.

Cite

BibTeX

@misc{ropmemu,
  title = {{ROPMEMU}},
  howpublished = {\url{https://github.com/Cisco-Talos/ROPMEMU}},
  url = {https://github.com/Cisco-Talos/ROPMEMU},
  urldate = {2026-11-07},
  note = {Awesome REA entry: \url{https://awesomerea.org/resources/ropmemu/}}
}

Plain text

ROPMEMU. https://github.com/Cisco-Talos/ROPMEMU (accessed 2026-11-07). Awesome REA entry: https://awesomerea.org/resources/ropmemu/

Useful? Star Awesome REA on GitHub2.4k

About this entry

The description was reviewed against primary sources.

Report an outdated entry Suggest a translation fix

Primary sources

README.md GitHub · Cisco-Talos/ROPMEMU · Revision d734228