
vmprotect-research
Generalized VMProtect devirtualizer supporting versions 1.x–3.x. Standalone CLI tool and Ghidra plugin for automated bytecode decoding, handler…

Generalized VMProtect devirtualizer supporting versions 1.x–3.x. Standalone CLI tool and Ghidra plugin for automated bytecode decoding, handler…

Playing with the VMProtect software protection. Automatic deobfuscation of pure functions using symbolic execution and LLVM.

IDAPython tool for creating automatic C++ virtual tables in IDA Pro


ret-sync is a set of plugins that helps to synchronize a debugging session (WinDbg/GDB/LLDB/OllyDbg2/x64dbg) with IDA/Ghidra/Binary Ninja…

PowerShell module for automatic detection of P/Invoke, Dynamic P/Invoke, and D/Invoke in .NET assemblies. Reveals unmanaged API calls, MDTokens, and…

An automatic unpacker and logger for DotNet Framework targeting files

Automatic analysis of SWF files based on some heuristics. Extensible via plugins.