SnowFastULP

SnowFastULP cleans big ULP .txt dumps and logs fast, without filling your RAM.

Three commands:

• sfu: clean and deduplicate ULP/LPU .txt files.
• sfs: search plain text or .zst archives.
• sfl: pull ULP lines out of stealer log folders and archives, including the password-protected ones.

Try it

Linux amd64 / macOS arm64:

curl -fsSL https://raw.githubusercontent.com/snowx-dev/SnowFastULP/main/scripts/install.sh | bash
sfu ./dump.txt -o ./cleaned/

Windows amd64 (PowerShell):

irm https://raw.githubusercontent.com/snowx-dev/SnowFastULP/main/scripts/install.ps1 | iex
sfu .\dump.txt -o .\cleaned\

After installing, open a new terminal so PATH is updated. Point sfu at a file or folder, keep the result somewhere useful. That is the whole first run.

sfu ./path-to-ulp-dumps/ -od ./library/          # clean + dedup into a searchable library
sfs ./library "facebook.com:"       # search .zst archives without decompressing
sfl ./path-to-logs/ -od ./library/  # extract ULP from folders and archives

Curious for more? Check out the online page and docs, take it to the next level.

Why use it

• Build an antipublic. sfu -od ./library/ turns repeat log and ulp dumps into one compressed, deduped, searchable ulp archive. Later runs skip lines already in the library.
• Search compressed archives. sfs ./library "facebook.com:" queries .zst without decompressing first.
• Stealer logs in, ULP out. sfl walks extracted folders and passworded zip/rar/7z archives, recurses nested archives, and merges into your library.
• Secret scanning built in. Flag tokens and keys during extraction.
• Low RAM, big inputs. Two-pass disk bucketing keeps memory flat on huge dumps.
• UNIX philosophy. Focused, efficient tools that excel at one job each. No bloated all-in-one programs, just clean work.

Flags, config, build, FAQ, and the full sfu / sfs / sfl references live in the docs.

Shoutouts

• vulnerose // Parser inspo
• Prequel // Search inspo
• lateralmovement // Cleaner inspo + data golbin
• Duckyhax // Beta testing
• Logstester com // Excellent peers & feedbacks

License

SnowFastULP is licensed under the GNU Affero General Public License v3.0 (AGPL-3.0). Copyright (C) 2026 Snow Dev. Use it only with data you are allowed to process. No warranty.

---