fnprint
1rhino2/fnprintmatch functions in binaries by what they do, not what their bytes look like. behavioral function fingerprinting via microexecution.
binary-analysisdynamic-code-analysisfirmware-analysis+3
20
1rhino2/fnprintmatch functions in binaries by what they do, not what their bytes look like. behavioral function fingerprinting via microexecution.
r00tkitsmm/pishiStatic binary rewriter that instruments XNU kernel and kexts, enabling targeted function/file-level coverage and feedback-aware fuzzing for macOS…
smackers/smackModular software verification toolchain that translates LLVM IR into Boogie intermediate verification language for bounded and experimental unbounded…
chichou/vscode-fridaVSCode extension for Frida-based mobile reverse engineering: runtime class/module inspection, Java/ObjC/native hook generation, autocomplete, and…
ghostvectoracademy/dllhijackhunterAutomated DLL Hijacking Discovery, Validation, and Confirmation. Turning local misconfigurations into weaponized, confirmed attack paths.
worksbutnottested/lightkeeperMaps execution-coverage data onto Ghidra disassembly to highlight visited code paths and accelerate reverse-engineering workflows.
trailofbits/polytrackerAn LLVM-based instrumentation tool for universal taint tracking, dataflow analysis, and tracing.
robertdfrench/ifuncd-upGNU IFUNC is the real culprit behind CVE-2024-3094
frkngksl/exporthiderC++ DLL template generator that hides exported functions from the filesystem export directory while reconstructing it at runtime to enable dynamic…
binsec/xyntiaBlack-box deobfuscator synthesizing semantics of obfuscated binary code via program synthesis, execution sampling, grammar search, and inference…
zxgio/ghidra_stack_stringsA script to detect stack-strings by using emulation (leveraging Unicorn)
aftermathlabs/vmp2Unpack and deobfuscate VMProtect 2 protected binaries with an emulation-based VM explorer, handler profiler, and experimental LLVM recompiler for…
sentinel-one/peafl64Static Binary Instrumentation tool for Windows x64 executables
nccgroup/cartographerCode Coverage Exploration Plugin for Ghidra
hasherezade/pesieve-goGo bindings for a memory-scanning library to detect and dump in-memory PE injections, shellcode, and process anomalies for malware analysis and…
zer0condition/reversekitInjected x64 runtime analysis toolkit that hooks syscalls/APIs, monitors threads, heaps, imports and URLs, and bypasses common debugger checks.
redteamsocietegenerale/dllirantAutomates DLL hijacking and DLL proxying research on Windows binaries by analyzing PE imports, generating proxy DLLs, and producing proof-of-concept…
void-stack/vmunprotect.dumperDynamically unpacks VMProtect-protected .NET assemblies, removes tamper protection, and restores executable code for reverse engineering.