#2Tools for observing malware behavior in isolated environments to understand its actions and impact.
Kitploit recommended
recurse-labs/recurseAgentic reverse engineering IDE with a pure-Rust multi-architecture disassembler, native decompiler, debugger, and LLM agent for binary analysis and…
navikt/cpltSandbox for AI coding agents. Runs Copilot CLI, Claude Code, OpenCode, Gemini CLI, Antigravity, Pi, goose or a plain shell inside a kernel-level…
top-celestial-company-ltd/dros-vep-liteOpen-source, 100% reproducible AI Agent Runtime Security Benchmark & Sandbox Environment (RFC-010 Draft Protocol).
notrequiem/antidbgA stealthy, fully syscalled C/C++ userland anti-debugging library for Windows, designed to protect software from reverse engineering
kaandemir993/purerat-msbuild.exe--c2-extraction--net-evasion-analysisReverse engineering analysis of PureRAT RAT abusing msbuild.exe, extracting C2 infrastructure, .NET evasion APIs, file system manipulation, and…
gmh5225/fracture-🐈⬛ WIP Suite for reverse engineering JVM applications
gmh5225/frida-il2cpp-datacollectorFrida-based tool that ports Cheat Engine's MonoDataCollector to Android and iOS, enabling runtime Mono/IL2CPP data collection and memory inspection…
gmh5225/frida-meditCross-platform CUI process memory scanner built on Frida for finding, filtering, patching, and dumping live process memory during reverse engineering…
gmh5225/frida-stalker-ntstracefrida-stalker based system call tracer on windows(x64).
gmh5225/frida-vmprotect-bypassFrida script that bypasses VMProtect runtime protections on mobile platforms, enabling dynamic instrumentation and analysis of protected binaries.
saina15/cve-2020-14343-labControlled vulnerability research and reproduction lab for CVE-2020-14343 in PyYAML
aftermathlabs/discord-crasherSome bugs found via binary instrumentation and fuzzing
danieldev23/frida-ssl-bypassFrida toolkit that bypasses SSL/TLS certificate pinning on Android apps, hooking Java TrustManager, OkHttp, Conscrypt, and native OpenSSL/BoringSSL…
veridiff/veridiffDynamic branch-divergence finder for native code -- traces two Frida executions and finds the exact instruction where they diverge.
rin449/bhpaiMulti-format malware analysis platform combining a stealth Ring-3 Windows sandbox, static PE/PDF analyzers, ransomware key recovery, and an AI…
google/artemisNatural-language Android automation agent that drives real devices via ADB, captures Logcat and screenshots, and exposes an MCP server for AI IDEs…
capesandbox/capesoloStandalone Windows VM malware sandbox running capemon, with GUI triage viewer, YARA signatures, IOC extraction, network analysis, and…
shivammittal2403/cve-2026-59827-metabase-cyber-rangeEducational cyber range for CVE-2026-59827 (Metabase H2 unsafe deserialization / CWE-502). Isolated Docker lab — training only, not for attacking…
