
DrSemu
DrSemu - Sandboxed Malware Detection and Classification Tool Based on Dynamic Behavior

DrSemu - Sandboxed Malware Detection and Classification Tool Based on Dynamic Behavior

All reasonably stable tools

Dumping processes using the power of kernel space !

Drltrace is a library calls tracer for Windows and Linux applications.

Ghidra plugin that automates UEFI firmware analysis by identifying known GUIDs, protocols, SMI handlers, and interrupt functions, with headless…

Linux process identity cloaking tool that spoofs comm, argv, cmdline, environ, exe path, and VMAs via an 11-phase prctl pipeline to impersonate…

In-depth reverse engineering analysis of Lumma Stealer, an info-stealer using process hollowing, Native API calls, and C2 communication. Includes…

Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).

Shellcode emulator written with Unicorn Framework With Process Dump Emulation Environment

A small utility to deal with malware embedded hashes.

Kernel-mode Windows driver for real-time detection of process injection techniques, including shellcode, DLL, and reflective injection, with syscall…

A pure-Python library, app and MCP that lets you inspect, modify and search the memory of any running process in a few lines of Python :snake: .

Find zero-days while you sleep. DeepZero is an automated vulnerability research framework that parses, decompiles, and analyzes thousands of Windows…

A revival of the classic and legendary KsDumper

A dynamic VMP dumper and import fixer, powered by VTIL.

Penetration testing utility and antivirus assessment tool.

Frida-based in-process fuzzing suite with AFL++ proxy, standalone active/passive modes, and shared memory communication for high-performance…

Reverse engineering Vidar Stealer: From obfuscated memory strings to Chrome process injection, malicious JS execution, and active session hijacking…