#1Tools for decompiling, disassembling, and understanding malware internals and complex binaries.
Kitploit recommended
yuatemycat/superghidraHigh-Performance Ghidra Architecture & GPU Acceleration Suite: LZ4/Zstd B-Tree Codec, Persistent Lock-Free Daemon, WGPU ARM64 Scanner, Z3 SMT Prover,…
eset/malware-researchCode written as part of our various malware investigations
gmh5225/no-access-protection-x86It encrypts the text section and set the protection to NO_ACCESS.
gmh5225/ntstracefrida-stalker based system call tracer on windows(x64).
giveen/decomp.anythingdecomp.wtf fork: Windows PE matching, MinGW/clang-cl toolchains, and an optional REA MCP bridge
r3n3r0/cve-2026-0006-step-2Research package demonstrating a leak-assisted ROP chain in Android media.swcodec via the CVE-2026-0006 APV decoder heap overflow, with payload…
maoabc/nmmpdex-vm used to protect the android classes.dex file
mandiant/goresymParses Go binaries to recover symbols, function metadata, types, file paths, and embedded strings, including stripped or UPX-packed samples, with IDA…
neurosaki987/tvm-recoverDevirtualizes Tencent VM .tvm0 sections: lifts VM handlers to guest-level listings and LLVM IR, recovers CFG and dispatch, and patches recovered code…
didierstevens/didierstevenssuiteCollection of Python scripts for malware analysis, file format parsing, hashing, and forensic triage, including PDF, OLE, and XOR analysis utilities.
silentisvox/syscallrevenantClean Indirect Syscalls with Syscall Tampering.
yasindce1998/barzakhRing -4 to Ring 0: offense-defense firmware research platform. We build the bootkits, then we catch them. Closed-loop. Zero trust in silicon.
cplusplus17/deco-filepush-disclosureDisclosure and PoC for a root file read/write flaw in the TP-Link Deco XE75 Pro V3 debug channel (tmpsvr opcodes 0xC456/0xF0), with CVSS analysis and…
c8dhjp4tyv-bit/jbl-wave-buds2-firmware-researchReverse-engineering notes and Python tooling for JBL Wave Buds 2 (BES1306) firmware: OTA container format, flash layout, BLE/GATT protocol, and…
happytotoro116/ghidra-llm-pipelineDeterministic PyGhidra extraction, triage, and local LLM compiler-backend pipeline for C reimplementation.
kaandemir993/amadey-loader-multi-stage-malware-with-keylogging-clipboard-hijack-privilege-escalation-analysisReverse engineering Amadey Loader with x64dbg: dynamic API resolution, token privilege escalation, keylogger hooks, clipboard capture, and…
abraxas/vbox-lsilogic-sas-configVirtualBox 7.2.20 - Critical - Local - Type confusion / arb R/W - SAS1068 CONFIG SCSI-SPI overlay
jaime64net/debuggerj-Debugger de aplicaciones x86 y x64 con intgracion de AI
