#1Tools for dissecting, understanding, and reverse engineering malicious software behavior.
Kitploit recommended
invictus1306/functraceA function tracer
utkonos/lst2x64dbgExtract labels from IDA, Ghidra, Binary Ninja, and Relyze files and export x64dbg database. Including radare2 main address.
memoryforensics1/vol3xpVolatility Explorer Suit (volatility 3)
payatu/cve-2018-14442PoC for Foxit Reader CVE-2018-14442
rew-sploit/rew-sploitEmulate and Dissect MSF and *other* attacks
jhuapl/codecutA Ghidra plugin for locating object file boundaries.
1d8/spybrowseCode developed to steal certain browser config files (history, preferences, etc)
malwaretech/fsthookA library for intercepting native functions by hooking KiFastSystemCall
67-6f-64/antioreans-codedevirtualizerIDA 6.8 plugin that devirtualizes Themida's FISH virtual machine (2.2.5.0-2.2.7.0), restoring native code from protected binaries for reverse…
nccgroup/ccsRegex-based scanner for detecting hard-coded credentials in codebases, designed for CI/CD integration with suppression comment support and low…
r00tkitsmm/pishiPishi is a code coverage tool like kcov for macOS.
david942j/heapinfoAn interactive memory info for pwning / exploiting
0xkirisame/spicaeBPF-based Linux rootkit detector using multi-channel cross-view analysis (sched_switch, NMI, /proc) to detect DKOM, tracepoint tampering, and…
zypherion-technologies/hallwatchUsermode detector that catches indirect syscalls. Traps Hell's Hall, Tartarus' Gate, RecycledGate, and VEH syscalls & Many more.
nccgroup/cachegraba tool designed to help perform and visualize trace-driven cache attacks against software in the secure world of TrustZone-enabled ARMv8 cores
calebstewart/peachSimple vulnerability scanning framework
smolfiddle/sentinelnavSentinelNav: zero-dependency, pure Python binary visualization and forensics tool.
watchfulip/tp-link-decryptDecrypt TP-Link Firmware
