#1Tools for dissecting, understanding, and reverse engineering malicious software behavior.
Kitploit recommended
deathshotxd/0xkern3lcrushAdvanced PoC & Research for CVE-2026-0828 (Safetica) and CVE-2025-7771 (ThrottleStop). Analysis of BYOVD (Bring Your Own Vulnerable Driver) TTPs for…
libtero/idaguidesindent guides plugin for hex-rays decompiler
dump-guy/get-pdinvokeimportsPowerShell module for automatic detection of P/Invoke, Dynamic P/Invoke, and D/Invoke in .NET assemblies. Reveals unmanaged API calls, MDTokens, and…
vollragm/ghostdebugDebugger utilizing stealth hooks to hide from debugger detection
hackinglz/svg_phishing_toolsSVG Analysis and generation tools for commonly seen SVG attachment phishing
libriscv/libloongThe fastest LoongArch sandbox
euva-project/euvaA lightweight hex editor and decompiler to solve your binary file analysis problems.
runreveal/sigmaliteGo library for parsing and executing Sigma detection rules against log entries, supporting field modifiers, CIDR matching, and custom field resolvers…
kcreyts/plugxdecoderDecodes PlugX traffic and encrypted/compressed artifacts
splintersfury/autopiffSemantic analysis engine for detecting vulnerability fixes in Windows kernel driver patches — 58 YAML rules, Ghidra decompilation, reachability…
cellebrite-labs/pplorerIDA plugin that resolves PPL calls to the actual underlying PPL function.
darkarnium/log4j-cve-detectDetections for CVE-2021-44228 inside of nested binaries
theshinigami/mafridaA Magisk module that simplifies running the Frida server on Android, with easy management commands to download specific versions, enable or disable…
nccgroup/icpinAn Integrity-Check Monitoring Pintool
withsecurelabs/dotnet-gargoyleA spiritual .NET equivalent to the Gargoyle memory scanning evasion technique
mindcrypt/stegowiperA powerful and flexible tool to apply active attacks for disrupting stegomalware
nccgroup/ghidra-nanomipsnanoMIPS module for Ghidra
