
lightkeeper
Maps execution-coverage data onto Ghidra disassembly to highlight visited code paths and accelerate reverse-engineering workflows.

Maps execution-coverage data onto Ghidra disassembly to highlight visited code paths and accelerate reverse-engineering workflows.

match functions in binaries by what they do, not what their bytes look like. behavioral function fingerprinting via microexecution.

Winstrument is a framework of modular scripts to aid in instrumenting Windows software using Frida for reverse engineering and attack surface…

GNU IFUNC is the real culprit behind CVE-2024-3094

ExportHider: Generating Export Table during Runtime to Hide the Exported Functions from the DLL File.

A script to detect stack-strings by using emulation (leveraging Unicorn)

Golang bindings for PE-sieve

.NET deobfuscator and unpacker.

Unpack and deobfuscate VMProtect 2 protected binaries with an emulation-based VM explorer, handler profiler, and experimental LLVM recompiler for…

Static Binary Instrumentation tool for Windows x64 executables

Runtime libc function auditor that detects file access race conditions and symlink vulnerabilities by hooking filesystem syscalls via LD_PRELOAD,…

Open-source mobile security testing suite for iOS and Android. Previously Passionfruit

Security profiling for blackbox iOS

A tool to be used in post exploitation phase for blue and red teams to bypass APPLICATIONCONTROL policies

Firmware Analysis and Comparison Tool

Fermion, an electron wrapper for Frida & Monaco.

A OWASP Based Checklist With 80+ Test Cases

Detect, analyze and uniquely identify crashes in Windows applications