
pefile
pefile is a Python module to read and work with PE (Portable Executable) files

pefile is a Python module to read and work with PE (Portable Executable) files

A PowerShell Module Dedicated to Reverse Engineering

Callstack scanner that identifies IOCs of unpacked or injected C2 agents by analyzing thread idle behavior, unbacked memory, module stomping, APCs,…

Ghidra plugin that automates UEFI firmware analysis by identifying known GUIDs, protocols, SMI handlers, and interrupt functions, with headless…

Ghidra module for disassembling, decompiling, and analyzing Ethereum smart contract bytecode. Detects insecure instructions, extracts hidden methods,…

An IDAPython module for enhancing c++ support on top of ida_kernelcache

Research and proof-of-concept for module stomping, a technique to hide malicious code in legitimate Windows modules, with documentation and…

Automated scanner for discovering DLL search order hijacking candidates in Windows executables, featuring import table parsing, runtime module…

Adaptix C2 agent using Crystal Palace PIC linker and PICO module system

In-memory stealth detection tool that identifies process hollowing, module stomping, unbacked executable regions, and anomalous CONTEXT structures…

machofile is a module to parse Mach-O binary files

PowerShell module for automatic detection of P/Invoke, Dynamic P/Invoke, and D/Invoke in .NET assemblies. Reveals unmanaged API calls, MDTokens, and…

nanoMIPS module for Ghidra

WinDbg plugin to trace module transitions from a debugged driver.

Magisk module that auto-packages renef_server (dynamic instrumentation for Android)

"In-depth reverse engineering analysis of an advanced multi-phase loader targeting Shellhost.exe, amsi.dll, mstscax.dll, and clbcatq.dll using module…

Ghidra processor description module for NEC/Renesas v810 and v830 families

Tutorial and source code for building a custom YARA module in C to extract malware configurations, with a practical Danabot example and reusable…