aether
0xsp-srd/aetherWindows memory-forensics and threat hunting tool that scans live process memory for malicious patterns, injection techniques, and reflectively loaded…
binary-analysiscommand-and-controldigital-forensics+7
0xsp-srd/aetherWindows memory-forensics and threat hunting tool that scans live process memory for malicious patterns, injection techniques, and reflectively loaded…
visma-prodsec/columboML-assisted forensic analysis tool that automates memory, disk, and live system triage on Windows using Volatility 3, autorunsc, and sigcheck to…
diversenok/diasymbolviewPDB file inspection tool
carmaa/interrogateInterrogate is a proof-of-concept tool for identification of cryptographic keys in binary material (regardless of target operating system), first and…
momenbasel/malware-checkStatic and dynamic analysis tool for detecting malicious code, suspicious binaries, and privacy violations
baiduxlab/sgxrayAutomated reasoning tool based on the SMACK verifier that detects SGX enclave bugs from trusted boundary violations, including invalid pointer…
cloudflare/filterforgeTool for solving BPF filters and crafting packets based on these.
pr0me/xtrideN-gram-based type recovery tool for binaries, recovering structures and function signatures from decompiled code with high throughput and actionable…
oldboy21/shgenobPython based tool for generating Shellcode from PIC C
matheuzsecurity/nullsectionELF anti-reversing tool that overwrites section headers with nullbytes to prevent static analysis by disassemblers and debuggers, rendering functions…
xchwarze/magic-extractorUniversal Windows extraction tool that detects unknown files and routes them to the right bundled extractor.
iilegacyyii/exportdumperA small tool I made to dump the export table of PE files. The primary use case was intended for use within DLL proxying.
eset/wslink-vm-analyzerWslinkVMAnalyzer is a tool to facilitate analysis of code protected by a virtual machine featured in Wslink malware
bicurico/vaxdLightweight Windows disassembler, PE inspection and patch-assistance tool for native EXE/DLL files.
nccgroup/pythiaA tool to extract RTTI information from Delphi executables, written in pure Python
shellkraft/anvilAnvil is a runtime-first attack surface assessment tool for Windows thick client applications, built for penetration testers and security researchers…
0x11dfe/file-unpumperTool that can be used to trim useless things from a PE file such as the things a file pumper would add.
jatinkapilaq1/intel-me-researchTalk to your Intel Management Engine directly — zero-dependency Python tool. Finds memory leaks, partition manifest, live MKHI probing. First public…