
msidump
MSI Dump - a tool that analyzes malicious MSI installation packages, extracts files, streams, binary data and incorporates YARA scanner.

MSI Dump - a tool that analyzes malicious MSI installation packages, extracts files, streams, binary data and incorporates YARA scanner.

C++ library to load DLLs directly from memory without touching disk, with exception handling support, enabling stealthy code execution and evasion of…

Open-source malware analysis platform with static PE analysis, YARA pattern matching, VirusTotal integration, REST API, and Docker deployment for…

Ghidra plugin that enhances reverse engineering by fixing missed disassembly, detecting functions, labeling crypto constants, and renaming functions…

Ghidra Extension to integrate BinDiff for function matching

A Reverse Engineering Tool for py2exe applications.

Simplification of General Mixed Boolean-Arithmetic Expressions: GAMBA

Static deobfuscator for Themida, WinLicense and Code Virtualizer 3.x's mutation-based obfuscation.

IDA python plugin to scan binary with Yara rules

The FLARE team's open-source library to disassemble Common Intermediate Language (CIL) instructions.

A blazingly fast, multi-threaded TUI malware analysis tool built in Rust. Features deep PE parsing, YARA scanning, and heuristic risk scoring.

Armadito antivirus main repository

Binary Ninja plugin to analyze and simplify obfuscated code

TDL4 style rootkit to spoof read/write requests to master boot record

Extract AutoIt scripts embedded in PE binaries

Entropy scanner for Linux to detect packed or encrypted binaries related to malware. Finds malicious files and Linux processes and gives output with…

A .NET malware loader, using API-Hashing to evade static analysis

Static-first research tool for unpacking Nuitka-compiled binaries: extracts constants, modules, recovers .pyc files, and generates analysis reports.