ReverseKit
zer0condition/reversekitInjected x64 runtime analysis toolkit that hooks syscalls/APIs, monitors threads, heaps, imports and URLs, and bypasses common debugger checks.
binary-analysisdynamic-code-analysismalware-analysis+1
775
zer0condition/reversekitInjected x64 runtime analysis toolkit that hooks syscalls/APIs, monitors threads, heaps, imports and URLs, and bypasses common debugger checks.
tca-iscas/cooper-ndss-2022A tool for effective testing the binding layer of scripting languages
frkngksl/exporthiderC++ DLL template generator that hides exported functions from the filesystem export directory while reconstructing it at runtime to enable dynamic…
google/path-auditorRuntime libc function auditor that detects file access race conditions and symlink vulnerabilities by hooking filesystem syscalls via LD_PRELOAD,…
smackers/smackModular software verification toolchain that translates LLVM IR into Boogie intermediate verification language for bounded and experimental unbounded…
ghostvectoracademy/dllhijackhunterAutomated DLL Hijacking Discovery, Validation, and Confirmation. Turning local misconfigurations into weaponized, confirmed attack paths.
void-stack/vmunprotect.dumperDynamically unpacks VMProtect-protected .NET assemblies, removes tamper protection, and restores executable code for reverse engineering.
redteamsocietegenerale/dllirantAutomates DLL hijacking and DLL proxying research on Windows binaries by analyzing PE imports, generating proxy DLLs, and producing proof-of-concept…
nccgroup/cartographerCode Coverage Exploration Plugin for Ghidra
r00tkitsmm/pishiStatic binary rewriter that instruments XNU kernel and kexts, enabling targeted function/file-level coverage and feedback-aware fuzzing for macOS…
worksbutnottested/lightkeeperMaps execution-coverage data onto Ghidra disassembly to highlight visited code paths and accelerate reverse-engineering workflows.
nccgroup/winstrumentModular instrumentation framework using Frida for Windows software reverse engineering and attack surface analysis.
robertdfrench/ifuncd-upGNU IFUNC is the real culprit behind CVE-2024-3094
binsec/xyntiaBlack-box deobfuscator synthesizing semantics of obfuscated binary code via program synthesis, execution sampling, grammar search, and inference…
zxgio/ghidra_stack_stringsA script to detect stack-strings by using emulation (leveraging Unicorn)
hasherezade/pesieve-goGo bindings for a memory-scanning library to detect and dump in-memory PE injections, shellcode, and process anomalies for malware analysis and…
1rhino2/fnprintmatch functions in binaries by what they do, not what their bytes look like. behavioral function fingerprinting via microexecution.
trailofbits/polytrackerAn LLVM-based instrumentation tool for universal taint tracking, dataflow analysis, and tracing.