# ROPMEMU

> ROPMEMU analyzes code-reuse attacks from a physical memory dump and reconstructs equivalent code for ordinary reverse-engineering tools. Memory forensics uses Volatility plugins. Emulation and multi-path execution use Unicorn. It then recovers a control-flow graph and applies compiler transformations. The project paper appeared at AsiaCCS 2016. Documentation is on the project wiki.

- Type: Tool
- Targets: Binary
- Category: Native analysis tools
- Relationship: Foundation tool
- Sources reviewed: 2026-11-07
- Added to the catalog: 2026-11-09
- Original resource: <https://github.com/Cisco-Talos/ROPMEMU>
- Primary source: <https://github.com/Cisco-Talos/ROPMEMU/blob/d73422878525d68a937c55ab6e288bbf1c534fb0/README.md>
- Catalog page: <https://awesomerea.org/resources/ropmemu/>
- Record JSON: <https://awesomerea.org/resources/ropmemu/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/resources/ropmemu/index.md)

## Requirements & limits

- A physical memory dump. Follow the project wiki.
- The README names no license.

## Primary sources

1. <https://github.com/Cisco-Talos/ROPMEMU/blob/d73422878525d68a937c55ab6e288bbf1c534fb0/README.md>

## More in Native binaries

- [abi-decompiler](https://awesomerea.org/resources/abi-decompiler/index.md) · Tool
- [fREedom](https://awesomerea.org/resources/freedom-binnavi/index.md) · Tool
- [EmuDbg](https://awesomerea.org/resources/emudbg/index.md) · Tool
- [DolRecomp](https://awesomerea.org/resources/dolrecomp/index.md) · Tool
- [Py2ExeDecompiler](https://awesomerea.org/resources/py2exe-decompiler/index.md) · Tool
- [dcc](https://awesomerea.org/resources/dcc-decompiler/index.md) · Tool

## About this entry

The description was reviewed against primary sources.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.