
firstexecution
Collection of different ways to execute code outside of the expected entry points

Collection of different ways to execute code outside of the expected entry points

x64 binary obfuscator for PE files with control flow flattening, anti-disassembly, import obfuscation, and instruction mutation to hinder reverse…

Dynamic unpacker and import fixer for Themida/WinLicense 2.x and 3.x.

Repository for the code snippets from the AllThingsIDA video channel

Helper plugin for analyzing UEFI firmware

A BOF designed to inspect processes memory and addresses

Windows kernel driver technique that hides kernel threads by abusing IoCancelIrp and IRP cancel routines, with detection methods for identifying…

In-memory Mach-O dylib loader for stock macOS Python; decrypts, maps, and runs payloads without dlopen or writing to disk, with optional encrypted…