


ret-sync is a set of plugins that helps to synchronize a debugging session (WinDbg/GDB/LLDB/OllyDbg2/x64dbg) with IDA/Ghidra/Binary Ninja…

Generalized VMProtect devirtualizer supporting versions 1.x–3.x. Standalone CLI tool and Ghidra plugin for automated bytecode decoding, handler…

Automatic analysis of SWF files based on some heuristics. Extensible via plugins.

IDAPython tool for creating automatic C++ virtual tables in IDA Pro

An automatic unpacker and logger for DotNet Framework targeting files

Playing with the VMProtect software protection. Automatic deobfuscation of pure functions using symbolic execution and LLVM.

PowerShell module for automatic detection of P/Invoke, Dynamic P/Invoke, and D/Invoke in .NET assemblies. Reveals unmanaged API calls, MDTokens, and…