{"id":28416822,"url":"https://github.com/withsecurelabs/garbageman","last_synced_at":"2025-06-25T04:31:04.783Z","repository":{"id":58273762,"uuid":"523661887","full_name":"WithSecureLabs/GarbageMan","owner":"WithSecureLabs","description":"GarbageMan is a set of tools for analyzing .NET binaries through heap analysis.","archived":false,"fork":false,"pushed_at":"2023-04-08T05:50:40.000Z","size":209,"stargazers_count":114,"open_issues_count":0,"forks_count":14,"subscribers_count":4,"default_branch":"master","last_synced_at":"2025-06-04T07:28:01.331Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"C++","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/WithSecureLabs.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2022-08-11T09:28:49.000Z","updated_at":"2025-03-24T02:41:23.000Z","dependencies_parsed_at":"2023-01-30T17:15:39.900Z","dependency_job_id":null,"html_url":"https://github.com/WithSecureLabs/GarbageMan","commit_stats":null,"previous_names":[],"tags_count":2,"template":false,"template_full_name":null,"purl":"pkg:github/WithSecureLabs/GarbageMan","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/WithSecureLabs%2FGarbageMan","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/WithSecureLabs%2FGarbageMan/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/WithSecureLabs%2FGarbageMan/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/WithSecureLabs%2FGarbageMan/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/WithSecureLabs","download_url":"https://codeload.github.com/WithSecureLabs/GarbageMan/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/WithSecureLabs%2FGarbageMan/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":261805040,"owners_count":23212289,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-06-04T00:43:59.146Z","updated_at":"2025-06-25T04:31:04.752Z","avatar_url":"https://github.com/WithSecureLabs.png","language":"C++","readme":"# GarbageMan\n\n## What is GarbageMan?\n\n`GarbageMan` is a set of tools designed for .NET heap analysis. These tools offer the following benefits for malware researchers: \n\n- Ability to extract clear-text payload (PE Images etc.) from .NET heaps quickly. \n- Easy analysis of encrypted network protocols, signs of data exfiltration, and similar. \n- Ability to overcome malware anti-dumping techniques (`psnotify`)\n\n\nMore detailed description, background information and usage instructions can be found in WithSecure Labs tools: https://labs.withsecure.com/tools/garbageman/\n\nMore details about the `psnotify` can be found here: [psnotify/README.md](psnotify).\n\n\n## How to get it?\n\nDownload the latest release from the \"Releases\". You will probably need `psnotify` in addition to GarbageMan release.\n\nFor running GarbageMan, you need to install .NET 5.0 desktop runtime for amd64 and x86 (yes, both). On the first run, Windows probably offers download link automatically. Just make sure to install `desktop` runtimes.\n\nNote that GarbageMan and psnotify were developed and tested only in x64 Windows 10. It won't probably run on any other Windows version.\n\n\n## How to use it?\n\nCrash course:\n\n- Extract the release archive, run GarbageMan.exe\n- You can attach to running process, or execute a new process, or open minidump from File menu\n- You can also open existing GarbageMan database\n\nIf you need to use `psnotify` for dumping, you need to extract it to `C:\\psnotify` (yes, that's fixed for now). Just run `psnotify.exe` and stop it with `Ctrl+C` when done. It will create minidumps in `C:\\dumps`. You can later then analyze those dumps with GarbageMan.\n\n**Note**: If you'd like to specify a working directory for the program to execute from, make sure psnotify isn't running as it will conflict with GarbageMan.\n\n\n## How to compile the GUI tool\n\nFor compiling a release, you need to install:\n\n- MS Visual Studio 2019 or 2022 (pick up .NET desktop dev workload)\n- .NET 5.0 Runtime (as a part of VS, with VS2022 you need pick it up from \"Individual components\")\n\nAfter installing the VS, run \"Developer PowerShell for VS\" and then run `build.bat`.\n\nPlease do note that `build.bat` refers to `compress.ps1` which is probably not going to run properly until your policy allows running powershell scripts. \n\nIf everything goes well, this should produce `GarbageMan-X.X.X.zip` where X.X.X is the version of your build, as defined in the GarbageMan project assembly properties. If the PS script fails, the GarbageMan release build should still be available in directory `rel`.\n\n\n\n","funding_links":[],"categories":[],"sub_categories":[],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fwithsecurelabs%2Fgarbageman","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fwithsecurelabs%2Fgarbageman","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fwithsecurelabs%2Fgarbageman/lists"}