{
  "added_at": "2026-11-09",
  "category": "native-analysis",
  "description_en": "ROPMEMU analyzes code-reuse attacks from a physical memory dump and reconstructs equivalent code for ordinary reverse-engineering tools. Memory forensics uses Volatility plugins. Emulation and multi-path execution use Unicorn. It then recovers a control-flow graph and applies compiler transformations. The project paper appeared at AsiaCCS 2016. Documentation is on the project wiki.",
  "description_zh": "ROPMEMU 从物理内存转储分析代码重用攻击，并重建出普通逆向工具可以分析的等价代码。内存取证使用 Volatility 插件。模拟和多路径执行使用 Unicorn。然后它恢复控制流图并做编译器变换。项目论文发表于 AsiaCCS 2016。文档在项目 wiki。",
  "entry_url": "https://awesomerea.org/resources/ropmemu/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/ropmemu/",
  "evidence_url": "https://github.com/Cisco-Talos/ROPMEMU/blob/d73422878525d68a937c55ab6e288bbf1c534fb0/README.md",
  "group": "tools",
  "id": "ropmemu",
  "json_url": "https://awesomerea.org/resources/ropmemu/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/ropmemu/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/ropmemu/index.md",
  "name": "ROPMEMU",
  "name_zh": "ROPMEMU",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "A physical memory dump. Follow the project wiki.",
    "The README names no license."
  ],
  "requirements_zh": [
    "需要一份物理内存转储。按项目 wiki 操作。",
    "README 未列出许可证。"
  ],
  "targets": [
    "binary"
  ],
  "url": "https://github.com/Cisco-Talos/ROPMEMU",
  "verification": "source-reviewed",
  "verified_at": "2026-11-07"
}