
Driver-HideKernelThread-IoCancelIrp
Windows kernel driver technique that hides kernel threads by abusing IoCancelIrp and IRP cancel routines, with detection methods for identifying…

Windows kernel driver technique that hides kernel threads by abusing IoCancelIrp and IRP cancel routines, with detection methods for identifying…

In-memory Mach-O dylib loader for stock macOS Python; decrypts, maps, and runs payloads without dlopen or writing to disk, with optional encrypted…

Dynamic unpacker and import fixer for Themida/WinLicense 2.x and 3.x.

Repository for the code snippets from the AllThingsIDA video channel

Collection of different ways to execute code outside of the expected entry points

A BOF designed to inspect processes memory and addresses

Helper plugin for analyzing UEFI firmware

x64 binary obfuscator for PE files with control flow flattening, anti-disassembly, import obfuscation, and instruction mutation to hinder reverse…