#1Tools for decompiling, disassembling, and understanding malware internals and complex binaries.
Kitploit recommended
ericpardee/fire-hd-ownershipOwning a tablet Amazon kept shutting down — CVE-2022-38181 write-up, four AI models, and a blog
mouseos/aquos-r6-ghostlockTemporary root exploit for Sharp AQUOS R6 A101SH S0029 using GhostLock CVE-2026-43499
ramenfast/zenfone9-rootTemporary root (uid 0) on a bootloader-locked ASUS Zenfone 9 via CVE-2025-21479 + a perf-based physical-address leak. GPLv3.
kaandemir993/dropper-gcleaner-c2-infrastructure-kernel-driver-powershell-conhost-payload-analysisReverse engineering analysis of Dropper GCleaner, a malware that uses a resilient C2 infrastructure, kernel driver loading, PowerShell/Conhost…
20enderdude20/ghidra_v810_v830Ghidra processor description module for NEC/Renesas v810 and v830 families
jwalker/frida-ios-dump-modernAn updated Frida iOS dump tool supporting the latest Frida 17.5.2 APIs
sensepost/dotnethookertoolkitFrida-based .NET Framework injector and managed method hooking toolkit for runtime tracing, native entrypoint resolution, and dynamic analysis of…
ic3-512/linux-root-kitEnd-to-end simulation of a Python dependency confusion attack, sudo privilege escalation (CVE-2025-32463), and rootkit-based persistence - with full…
finngineering/ch55x_firmware_extractorFirmware extractor for CH55x microprocessors
cplusplus17/deco-filepush-disclosureDisclosure and PoC for a root file read/write flaw in the TP-Link Deco XE75 Pro V3 debug channel (tmpsvr opcodes 0xC456/0xF0), with CVSS analysis and…
jason5545/ghostlock-myron-twGhostLock (CVE-2026-43499) kernel exploit port for REDMI K90 Pro Max Taiwan firmware (myron, WPMTWXM) — offsets, build guide, prebuilt binary
knight0x07/bibi-windows-wiper-analysisTechnical Analysis of Bibi-Windows Wiper Targeting Israeli Organizations
rin449/bhpaiMulti-format malware analysis platform combining a stealth Ring-3 Windows sandbox, static PE/PDF analyzers, ransomware key recovery, and an AI…
hycqaq/logitech-g-cloud-ghostlock-cve-2026-43499罗技云掌机 · GhostLock CVE-2026-43499 root 尝试
kaandemir993/python-shellcode-anydesk-apc-injection-remote-ip-address-analysisReverse engineering write-up of Python shellcode that APC-injects into AnyDesk, exfiltrates to a C2 over HTTPS with AES/RSA, and persists via…
diyiqiuye/cve-2025-21479-fx5pTemporary root for OPPO Find X5 Pro (PFEM00) via CVE-2025-21479 + KernelSU LKM late-load (cloud-buildable)
malwareman007/cve-2022-21971POC Of CVE-2022-21971
