kaandemir993/nwh-stealer-analysis-fileless-bun-runtime-execution-clipboard-image-theft-cloud-c2-aws-r2-Static analysis and payload extraction of NWH Stealer. Features deep dive into fileless execution via Bun JavaScript Runtime, in-memory clipboard…
nanashili/rea-rustRust port of REA, a local-only reverse-engineering tool with CLI/MCP workflows and a native Ghidra worker
seclog-open/seclogCollects multi-source security logs from reproducible Docker attack scenarios, builds attack chains, and provides the SecLog-Bench-216 benchmark for…
kaandemir993/vidar-stealer-chrome-injection-malicious-js-targeting-google-reddit-sessions-analysisReverse engineering Vidar Stealer: From obfuscated memory strings to Chrome process injection, malicious JS execution, and active session hijacking…
neo23x0/process-watcherA process monitoring tool that tries to detect exploitation
kaandemir993/overlord-rat-reverse-engineering-a-go-based-rat-injection-keylogging-c2-exfiltration-analysisFull static & memory analysis of Overlord RAT: Go agent architecture, HTTP/2 + WebSocket C2, reflective DLL injection, browser keylogging, and IOCs.…
kaandemir993/python-shellcode-anydesk-apc-injection-remote-ip-address-analysisReverse engineering write-up of Python shellcode that APC-injects into AnyDesk, exfiltrates to a C2 over HTTPS with AES/RSA, and persists via…
morluto/reaReverse engineer anything with agents, from app behavior down to native binaries.
0vercl0k/kepabooNeutralize KEPServerEX anti-debugging techniques
notrequiem/antidbgA stealthy, fully syscalled C/C++ userland anti-debugging library for Windows, designed to protect software from reverse engineering
gavmor/x86-cpp-reversing-skillClaude Code skill for reverse-engineering 32-bit little-endian x86 C++ binaries (vtables, RTTI, inheritance recovery)
kaandemir993/stealc-stealer-runtimebroker-hollowing-c2-extraction-payload-extraction-analysisReverse engineering analysis of StealC Stealer, an info-stealer that uses RuntimeBroker.exe hollowing, C2 infrastructure, and payload extraction.…
amd2g2zz/kunglao-agentThe reverse-engineering expert agent: plans its own analysis path, derives every fact from raw evidence, and converges under mechanical verification…
gmh5225/driver-pidqserializationwrite-exampleHow to use PiDqSerializationWrite. Introduces how to safely read and write from mapped driver
doctormord/philips-pm-5139-5138a-5136-firmware-projectFirmware reverse engineering of the Philips PM5139 / PM5138A / PM5136 function generators: 8051 emulators used as measuring instruments, 35 sections…
orbitcurve/firmware-reverse-engineeringAgent skills for firmware extraction, static analysis, Ghidra reverse engineering, emulation, and security reporting, packaged for Claude Code and…
withsecurelabs/python-exe-unpackerA helper script for unpacking and decompiling EXEs compiled from python code.
remnux/distroProvides supplemental files and Debian package sources for a specialized Linux distro focused on malware analysis, reverse engineering, and digital…
