
reverse-SynthID
reverse engineering Gemini's SynthID detection

reverse engineering Gemini's SynthID detection

Abuses macOS debugger entitlements and DYLD_INSERT_LIBRARIES to dump or search a running process's memory while shifting EDR attribution to a signed…

Sorry ransomware (.sorry) IOCs, YARA rules and forensic analysis - CVE-2026-41940 cPanel campaign

Code written as part of our various malware investigations

Linux Distro for Mobile Security, Malware Analysis, and Forensics

Analysis and cleanup guide for BadBox malware on Allwinner H713 Android projectors: ADB access, infection proof, firmware backup, dropper removal,…

Containerized network traffic analysis suite ingesting PCAP, Zeek logs, and Suricata alerts for automated normalization, enrichment, and correlation…

Filesystem monitor tool for Linux/Android iOS/macOS

ELEGANTBOUNCER is a detection tool for file-based mobile exploits.

Portable forensic acquisition tool for Android devices that collects relevant data via USB debugging to identify potential spyware or compromise…

Framework for hashing declared permissions in Chromium extensions and APKs, enabling clustering, hunting, and pivoting across potentially malicious…

Collection of materials relating to FORCEDENTRY

Breakdown of a c2-network of chinese beamers - SilentSDK-Analysis

Know what changed inside your Electron release: diff two builds for IPC, preload, windows, fuses and hosts, with file:line. CLI, CI gate, MCP server.

Gallery Vault dump recovery tool with automated discovery, key derivation and automatic media restoration.

Security Onion 16.04 - Linux distro for threat hunting, enterprise security monitoring, and log management

A modular OSINT & SOCMINT framework for social media intelligence, investigation, and public data analysis.

Read-only N-able N-central CVE-2026-18556/CVE-2026-18577 post-exploitation IoC hunter for Windows endpoints