
x64dbg
An open-source user mode debugger for Windows. Optimized for reverse engineering and malware analysis.

An open-source user mode debugger for Windows. Optimized for reverse engineering and malware analysis.

Program for determining types of files for Windows, Linux and MacOS.

Emulation-based unpacker and import resolver for Windows x86/x64 VMProtect 3.x binaries, using Unicorn to emulate syscalls and rebuild the IAT…

Seagate Toolkit for Windows (Installer <2.35.0.6) is vulnerable to insecure DLL loading. The installer loads DLLs from the working directory without…

Disassembler, decompiler and x64dbg-style debugger for PE/ELF binaries with IDA-style listing, function graphs, Lua plugins, CLI, and a built-in MCP…

Proof-of-concept exploit for CVE-2017-3078, a memory corruption vulnerability in Adobe Flash Player ATF module enabling arbitrary code execution on…

CVE-2019-0708 (BlueKeep)

CVE-2022-25943

Proof-of-concept exploit for CVE-2021-31955, a Windows kernel information disclosure vulnerability. Demonstrates exploitation on 64-bit systems to…

Reverse-engineering toolkit: disassembler, SSA decompiler, C++ class recovery and live-process analysis for PE and ELF. Scriptable CLI, every answer…

Windows kernel-mode driver with user-mode client exposing IOCTL-based physical and virtual memory read/write, page table walking, pattern scanning,…

CVE-2020-0796-POC

Windows KASLR bypass using prefetch side-channel

Proof-of-concept for CVE-2026-29923, a local privilege escalation in pstrip64.sys kernel driver. Demonstrates physical memory read/write primitive…

Demonstration exploit for CVE-2022-32223: DLL hijacking in Node.js on Windows via malicious providers.dll, targeting OpenSSL installations.

Windows kernel-level debugger with OllyDbg/IDA-style UI, software and hardware breakpoints, PDB symbols, decompiler, and 17 plugins for reverse…

Rust crate for ghost-frame call-stack spoofing, runtime indirect syscalls, and APC injection on Windows x64. Provides SSN resolution, JIT stub…

Master's Thesis research on CVE-2024-51324 (BYOVD). Advanced exploit with 4 operational modes (SCANNER, LOADER, KILLER, CLEANUP), SHA-256 driver…