copy-as-yara
ald3ns/copy-as-yaraThis is a little plugin to copy disassembly in a way that is usable in YARA rules!
binary-analysismalware-analysisreverse-engineering+1
48
ald3ns/copy-as-yaraThis is a little plugin to copy disassembly in a way that is usable in YARA rules!
0x11dfe/file-unpumperTool that can be used to trim useless things from a PE file such as the things a file pumper would add.
talha-nazeef-ahmed/rpc-triageA zero-symbol static analysis engine that extracts and mathematically ranks the Windows RPC attack surface using an AHP-based risk model.
mein-0/kaspermeowProof-of-concept that exploits a Kaspersky driver vulnerability to leak kernel pointers and bypass KASLR on Windows, enabling kernel exploit chain…
nccgroup/libtalloclibtalloc is a python script for use with GDB that can be used to analyse the "trivial allocator" (talloc)
ejfkdev/daeConfig-driven Dart AOT snapshot analyzer that exports blutter-compatible symbols and structs for IDA, radare2 and Frida, and decompiles functions…
gmh5225/eac-kernel-packet-fuckerReverse-engineered Easy Anti-Cheat kernel driver bypass that intercepts memory allocation to suppress violation packets, with report decryption…
gmh5225/frida-il2cpp-datacollectorFrida-based tool that ports Cheat Engine's MonoDataCollector to Android and iOS, enabling runtime Mono/IL2CPP data collection and memory inspection…
farukalpay/neurocoreNeuroCore is a native macOS application that visualizes the internal structure of binary files using a Hilbert Curve mapping and Shannon Entropy…
gmh5225/letmeggWindows kernel proof-of-concept demonstrating an anti-debugging technique that prevents WinDbg from breaking by manipulating the kernel exception…
0x574r/darkcloakLinux process identity cloaking tool that spoofs comm, argv, cmdline, environ, exe path, and VMAs via an 11-phase prctl pipeline to impersonate…
ea/xfg_analyzerA Binary Ninja plugin that uses bruteforced XFG hashes to recover precise function prototypes
kaandemir993/formbook-payload-extraction-xor-decryption-net-assembly-analysisReverse engineering analysis of Formbook, an info-stealer that uses .NET assembly manipulation and XOR decryption. Full payload extracted via x32dbg,…
backdoorskid/win-def-clickfixA scanner that estimates whether Microsoft Defender is likely to flag a command as ClickFix.
myrtus0x0/smoke_conf_extractStatic config extractor for SmokeLoader samples that deobfuscates, unpacks, and emulates protected routines to recover final-stage C2 settings.
xf1les/fsop-finderBinary Ninja plugin that scans glibc libio for FSOP code paths capable of hijacking control flow and stack pointer, aiding heap exploitation research.
dump-guy/sc2elfSimple dotnet Native AOT app that uses LibObjectFile to convert shellcode to ELF
gmh5225/driver-hidekernelthread-iocancelirpWindows kernel driver technique that hides kernel threads by abusing IoCancelIrp and IRP cancel routines, with detection methods for identifying…