
IDA2Obj
Static binary instrumentation tool that dumps COFF object files from executables, enabling code/data insertion at any location for black-box fuzzing…

Static binary instrumentation tool that dumps COFF object files from executables, enabling code/data insertion at any location for black-box fuzzing…

Randomly changes Win32/64 PE Files for 'safer' uploading to malware and sandbox sites.

Python tool and library to help analyze files during malware triage and analysis.

Fuzzy comparison tool for deobfuscating Android APKs by identifying renamed functions across versions, generating mapping files and interactive HTML…

PulseAPK Core: Cross-Platform tool for working with APK files: Decompilation, Analysis, Building


Extract labels from IDA, Ghidra, Binary Ninja, and Relyze files and export x64dbg database. Including radare2 main address.

Tool to help guess a files 256 byte XOR key by using frequency analysis

JADX plugin that extracts method names, class references, and source file paths from string constants found in DEX files and decompiled Android code.


goLoL is a Windows host scanner with dual support for LOLBAS binaries and LOLDrivers. It lists LOLBAS techniques runnable at your current privilege…

Small visualizator for PE files

machofile is a module to parse Mach-O binary files

Universal Windows extraction tool that detects unknown files and routes them to the right bundled extractor.

Slides and files for the Reversing Rust Binaries: One step beyond strings workshop at REcon 2024, presented on June 28, 2024.

A small tool I made to dump the export table of PE files. The primary use case was intended for use within DLL proxying.

Scan files for potential threats while leveraging AMSI (Antimalware Scan Interface) and Windows Defender. By isolating malicious content.

A C# PE loader for x64 and x86 PE files.