#2Tools for observing malware behavior in isolated environments to understand its actions and impact.
Kitploit recommended
bw3ll/sharemSHAREM is a shellcode analysis framework, capable of emulating more than 45,000 WinAPIs and virutally all Windows syscalls. It also contains its own…
trailofbits/maatDynamic symbolic execution and binary analysis framework with taint analysis, constraint solving, multi-arch emulation via Ghidra's Sleigh, and…
foundryzero/binder-traceBinder Trace is a tool for intercepting and parsing Android Binder messages. Think of it as "Wireshark for Binder".
spamscanner/spamscannerSpam Scanner is a Node.js anti-spam, email filtering, and phishing prevention tool and service. Built for @ladjs, @forwardemail, @cabinjs, @breejs,…
dissectmalware/xlmmacrodeobfuscatorExtract and Deobfuscate XLM macros (a.k.a Excel 4.0 Macros)
manuelschipper/naha guard that blocks catastrophic agent actions
soulghost/iblessingiblessing is an iOS security exploiting toolkit, it mainly includes application information gathering, static analysis and dynamic analysis. It can…
theqmaks/phantom-fridaBuild anti-detection Frida server from source. ~90 patches covering 16 detection vectors, weekly auto-builds with random names.
gamozolabs/applepieA hypervisor for fuzzing built with WHVP and Bochs
conscioushacker/wfhFrida-based dynamic analysis tool that automatically identifies DLL sideloading and COM hijacking vulnerabilities in Windows executables through…
fuzzysecurity/fermionFermion, an electron wrapper for Frida & Monaco.
pranshuchittora/simvynUniversal mobile devtool for Agents & Humans - control iOS Simulators, Android Emulators, and real devices from a single dashboard and CLI
orbitcurve/firmware-reverse-engineeringAgent skills for firmware extraction, static analysis, Ghidra reverse engineering, emulation, and security reporting, packaged for Claude Code and…
canyonroad/agentshExecution-Layer Security (ELS) for AI agents — policy-enforced shell with audit.
afshinm/zeroboxLightweight, cross-platform process sandboxing powered by OpenAI Codex's runtime. Sandbox any command with file, network, and credential controls.
thalium/iceboxVirtual Machine Introspection, Tracing & Debugging
rex-rs/rexRex is a safe and usable kernel extension framework that allows loading and executing Rust kernel extension programs in the place of eBPF.
d4rksystem/vmwarecloakA PowerShell script that attempts to help malware analysts hide their VMware Windows VM's from malware that may be trying to evade analysis.
