
yarasafe
SAFE embeddings to match functions in yara

SAFE embeddings to match functions in yara

Advanced Portable Executable File Analyzer And Disassembler 32 & 64 Bit

Visually inspect and force decode YARA and regex matches found in both binary and text data with colors. Lots of colors.

Research and proof-of-concept for module stomping, a technique to hide malicious code in legitimate Windows modules, with documentation and…

Some Rust program I wrote while learning Malware Development

Automates repair of malformed UPX headers in ELF binaries, restoring magic, filesize, blocksize, and overlay fields so standard unpackers can process…

Usermode detector that catches indirect syscalls. Traps Hell's Hall, Tartarus' Gate, RecycledGate, and VEH syscalls & Many more.

A Feature Rich Modular Malware Configuration Extraction Utility for MalDuck

Tool to help guess a files 256 byte XOR key by using frequency analysis

IDA plugin for automated detection of obfuscated code and control-flow flattening in binaries using heuristic analysis and dominator tree…


Scripts for automating malware analysis and reverse engineering workflows in IDA Pro, covering binary inspection, static analysis, and code…

Crystal Palace PICO loader for Sliver C2 dual-layer AMSI bypass, ETW silencing, AES-256-CBC encrypted payloads, 6 delivery variants

A stealthy stager designed for shellcode payloads staged with http/https like Sliver, or on github raw.

Create Anti-Copy DRM Malware

Headless AI agent for deterministic reverse engineering.

Small visualizator for PE files

machofile is a module to parse Mach-O binary files