
xnuspy
an iOS kernel function hooking framework for checkra1n'able devices

an iOS kernel function hooking framework for checkra1n'able devices

Ghidra plugin that automates UEFI firmware analysis by identifying known GUIDs, protocols, SMI handlers, and interrupt functions, with headless…

pefile is a Python module to read and work with PE (Portable Executable) files

Ghidra module for disassembling, decompiling, and analyzing Ethereum smart contract bytecode. Detects insecure instructions, extracts hidden methods,…

Simple Anti-cheat library for applications that use C++ on windows. #PastedProtection

This module fixes an issue in the kernels filesystem layer (CVE-2021-33909) by kprobe-replacing vulnerable functions during runtime

GhostLock One-Tap Execution App (CVE-2026-43499)

Python module for viewing Portable Executable (PE) files in a tree-view using pefile and PyQt5. Can also be used with IDA Pro and Rekall to dump…

A PowerShell Module Dedicated to Reverse Engineering

Security Analysis tool for WebAssembly module (wasm) and Blockchain Smart Contracts (BTC/ETH/NEO/EOS)

An IDAPython module for enhancing c++ support on top of ida_kernelcache

Automated scanner for discovering DLL search order hijacking candidates in Windows executables, featuring import table parsing, runtime module…

PoC code of Shade BIOS (stripped) presented at Black Hat USA 2025

"In-depth reverse engineering analysis of an advanced multi-phase loader targeting Shellhost.exe, amsi.dll, mstscax.dll, and clbcatq.dll using module…

In-depth technical analysis of Linux kernel CVE-2026-31431 (Copy Fail), a local privilege escalation via AF_ALG in-place scatterlist bug, including…

Research on CVE-2025-3052, an Insyde firmware vulnerability that exposes an arbitrary write primitive capable of modifying security-critical pointers.

Parse BIOS/Intel ME/UEFI firmware related structures: Volumes, FileSystems, Files, etc

Callstack scanner that identifies IOCs of unpacked or injected C2 agents by analyzing thread idle behavior, unbacked memory, module stomping, APCs,…