
0xCr0ssCrush
Windows BYOVD research on DCRCVDrv.sys and Alinubx.sys, reverse engineering their kernel primitives, IOCTL surfaces, and detection opportunities.

Windows BYOVD research on DCRCVDrv.sys and Alinubx.sys, reverse engineering their kernel primitives, IOCTL surfaces, and detection opportunities.

Tool for solving BPF filters and crafting packets based on these.

Native Python3 bindings for @horsicq's Detect-It-Easy

takes shellcode bad-bytes and banishes them, returning cleaned shellcode with preserved functionalities

ELF binary section docking toolkit for stageless payload delivery, enabling in-field payload attachment, signature evasion, and static/dynamic…

Signature finder (from PE-bear)

PowerShell module for automatic detection of P/Invoke, Dynamic P/Invoke, and D/Invoke in .NET assemblies. Reveals unmanaged API calls, MDTokens, and…

Semantic analysis engine for detecting vulnerability fixes in Windows kernel driver patches — 58 YAML rules, Ghidra decompilation, reachability…

WslinkVMAnalyzer is a tool to facilitate analysis of code protected by a virtual machine featured in Wslink malware

Extracts and analyzes PE file security characteristics (ASLR, DEP, CFG, NO_SEH) from DLLs and EXEs across directories, storing results in a SQLite…

Collection of radare2 scripts for malware analysis: carve binaries from memory dumps, patch PE headers, and decode hashed function imports in…

Pure-Go Java Decompiler and Serialization Operator


Extended kernel lazy importer for Windows drivers that resolves APIs at runtime with encrypted, cached import names to hide kernel function usage…

A tool to extract RTTI information from Delphi executables, written in pure Python

Script to extract malicious payload and decoy document from CVE-2015-1641 exploit documents

AST-based Python code transformation & deobfuscation framework

This is a little plugin to copy disassembly in a way that is usable in YARA rules!