dimareverse/nuitka-static-unpackerStatic-first research tool for unpacking Nuitka-compiled binaries: extracts constants, modules, recovers .pyc files, and generates analysis reports.
seekbytes/ipaGUI analyzer for deep-diving into PDF files. Detect malicious payloads, understand object relationships, and extract key information for threat…
karib0u/kernagentHeadless AI agent for deterministic reverse engineering.
hasherezade/pe-sieveScans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).
mahlet-inc/hobbitsA multi-platform GUI for bit-based analysis, processing, and visualization
rhacknarok/hacksguardA blazingly fast, multi-threaded TUI malware analysis tool built in Rust. Features deep PE parsing, YARA scanning, and heuristic risk scoring.
hiddenillusion/nomorexorTool to help guess a files 256 byte XOR key by using frequency analysis
erocarrera/pefilepefile is a Python module to read and work with PE (Portable Executable) files
m10ust/machscopemacOS IPC, launchd, Mach-O, and trust relationship explorer — zero-dependency terminal-native forensic tool
sandflysecurity/sandfly-entropyscanEntropy scanner for Linux to detect packed or encrypted binaries related to malware. Finds malicious files and Linux processes and gives output with…
forentfraps/pe-signgenUniversal signature generation for any system function from all Windows Builds using Winbindex
fox-it/dissect.cobaltstrikePython library for dissecting and parsing Cobalt Strike related data such as Beacon payloads and Malleable C2 Profiles
iocx-dev/iocxAn extensible, deterministic static‑analysis engine that extracts high‑signal IOCs from PE binaries and text, built for SOC automation and modern…
baerwolf/cve-2021-33909This module fixes an issue in the kernels filesystem layer (CVE-2021-33909) by kprobe-replacing vulnerable functions during runtime
pandaadir05/ghostDetects process injection and memory manipulation used by malware. Finds RWX regions, shellcode patterns, API hooks, thread hijacking, and process…
dwexi/entropystripAlgorithmic PE de-obfuscator, Shannon entropy radar, and incident triage engine
tjnel/certgraveyard_yaraAutomated YARA rule generation from the Cert Central compromised certificate database.
netspooky/inhaleA malware analysis and classification tool.
