#2Tools for observing malware behavior in isolated environments to understand its actions and impact.
Kitploit recommended
gmh5225/frida-meditCross-platform CUI process memory scanner built on Frida for finding, filtering, patching, and dumping live process memory during reverse engineering…
gmh5225/frida-il2cpp-datacollectorFrida-based tool that ports Cheat Engine's MonoDataCollector to Android and iOS, enabling runtime Mono/IL2CPP data collection and memory inspection…
gmh5225/fracture-🐈⬛ WIP Suite for reverse engineering JVM applications
saina15/cve-2020-14343-labControlled vulnerability research and reproduction lab for CVE-2020-14343 in PyYAML
aftermathlabs/discord-crasherSome bugs found via binary instrumentation and fuzzing
veridiff/veridiffDynamic branch-divergence finder for native code -- traces two Frida executions and finds the exact instruction where they diverge.
danieldev23/frida-ssl-bypassFrida toolkit that bypasses SSL/TLS certificate pinning on Android apps, hooking Java TrustManager, OkHttp, Conscrypt, and native OpenSSL/BoringSSL…
rin449/bhpaiMulti-format malware analysis platform combining a stealth Ring-3 Windows sandbox, static PE/PDF analyzers, ransomware key recovery, and an AI…
google/artemisNatural-language Android automation agent that drives real devices via ADB, captures Logcat and screenshots, and exposes an MCP server for AI IDEs…
shivammittal2403/cve-2026-59827-metabase-cyber-rangeEducational cyber range for CVE-2026-59827 (Metabase H2 unsafe deserialization / CWE-502). Isolated Docker lab — training only, not for attacking…
capesandbox/capesoloStandalone Windows VM malware sandbox running capemon, with GUI triage viewer, YARA signatures, IOC extraction, network analysis, and…
shivammittal2403/cve-2026-80428-ctfContainerized educational CTF lab emulating CVE-2026-80428 (CWE-502 deserialization) for safe, isolated student and researcher practice.
snyk/leaky-vessels-dynamic-detectoreBPF-based runtime detector for container breakout vulnerabilities in runc and Docker, monitoring syscalls and Docker daemon calls to detect…
hzqst/unicorn_peEmulates Windows PE execution using Unicorn engine for malware analysis, unpacking packed binaries, and decrypting VMProtect strings and imports.
dnspy/dnspy.NET debugger and assembly editor
cuckoosandbox/cuckooCuckoo Sandbox is an automated dynamic malware analysis system
hluwa/frida-dexdumpA frida tool to dump dex in memory to support security engineers analyzing malware.
