apiscope
kaisonox/apiscopeAn API hooking framework for intercepting and monitoring Windows applications
api-security-testingbinary-analysisdebuggers+4
19
kaisonox/apiscopeAn API hooking framework for intercepting and monitoring Windows applications
onhexgroup/tabpeA monthly Windows PE baseline dataset for Cyber security researchers
nccgroup/winstrumentWinstrument is a framework of modular scripts to aid in instrumenting Windows software using Frida for reverse engineering and attack surface…
splintersfury/autopiffSemantic analysis engine for detecting vulnerability fixes in Windows kernel driver patches — 58 YAML rules, Ghidra decompilation, reachability…
forentfraps/pe-signgenUniversal signature generation for any system function from all Windows Builds using Winbindex
mojtabatajik/robberRobber is open source tool for finding executables prone to DLL hijacking
waleedassar/cve-2021-1656Proof-of-concept exploit for CVE-2021-1656, an information disclosure vulnerability in the Windows TPM driver (tpm.sys). Demonstrates kernel memory…
blacksnufkin/checkplzScan files for potential threats while leveraging AMSI (Antimalware Scan Interface) and Windows Defender. By isolating malicious content.
dynamorio/dynamorioRuntime instrumentation framework for building dynamic analysis tools: tracing, profiling, code coverage, memory debugging, fuzzing, and disassembly…
0xsp-srd/aetherWindows memory-forensics and threat hunting tool that scans live process memory for malicious patterns, injection techniques, and reflectively loaded…
yo-yo-yo-jbo/msf_shellcode_analysisStatic analysis walkthrough of a Metasploit Windows shellcode: PowerShell payload decoding, XOR obfuscation, PEB walking, and Export Address Table…
intelxed/xedLow-level library for encoding and decoding IA32/Intel64 x86 instructions, exposing APIs for instruction length, operands, categories, control-flow…
werwolv/imhex🔍 A Hex Editor for Reverse Engineers, Programmers and people who value their retinas when working at 3 AM.
ergrelet/windiffTool that allows comparing symbol, type and syscall information of Microsoft Windows binaries across different versions of the OS, using a Web UI…
skylined/bugidDetect, analyze and uniquely identify crashes in Windows applications
nodiuus/nocturneA bin2bin code virtualizer for x86-64 PE's
advdebug/brovanUser-mode x86_64 binary emulator for malware analysis and reverse engineering. Supports PE, ELF, memory dumps, and raw binaries with syscall tracing,…
warpedatom/offsetinspectPowerShell toolkit for AMSI/Defender detection-boundary analysis and static malware triage maps byte offsets to detection triggers, plus YARA,…