kaandemir993/python-shellcode-anydesk-apc-injection-remote-ip-address-analysisReverse engineering write-up of Python shellcode that APC-injects into AnyDesk, exfiltrates to a C2 over HTTPS with AES/RSA, and persists via…
therealsaumil/static-arm-binsStatically compiled ARM binaries for debugging and runtime analysis
akha-security/akcaEvidence-oriented DAST scanner in Go that crawls web apps and APIs, then runs adaptive SQLi, XSS, RCE, SSRF, and auth checks with replayable proof.
sunghoojung/reverse-engineering-browserLocal-first macOS research browser built on a custom Brave build that captures network traffic, fingerprints, scripts, and runtime evidence for…
fkie-cad/sandroid_dexray-interceptA Android malware analysis tool that creates comprehensive runtime profiles by hooking into application behavior across cryptography, file systems,…
gmh5225/frida-meditCross-platform CUI process memory scanner built on Frida for finding, filtering, patching, and dumping live process memory during reverse engineering…
gmh5225/frida-stalker-ntstracefrida-stalker based system call tracer on windows(x64).
danieldev23/frida-ssl-bypassFrida toolkit that bypasses SSL/TLS certificate pinning on Android apps, hooking Java TrustManager, OkHttp, Conscrypt, and native OpenSSL/BoringSSL…
veridiff/veridiffDynamic branch-divergence finder for native code -- traces two Frida executions and finds the exact instruction where they diverge.
google/artemisNatural-language Android automation agent that drives real devices via ADB, captures Logcat and screenshots, and exposes an MCP server for AI IDEs…
shivammittal2403/cve-2026-59827-metabase-cyber-rangeEducational cyber range for CVE-2026-59827 (Metabase H2 unsafe deserialization / CWE-502). Isolated Docker lab — training only, not for attacking…
shivammittal2403/cve-2026-80428-ctfContainerized educational CTF lab emulating CVE-2026-80428 (CWE-502 deserialization) for safe, isolated student and researcher practice.
off-by-1-labs/flawedFix-Like Artifacts With Embedded Defects
kaandemir993/stealc-stealer-runtimebroker-hollowing-c2-extraction-payload-extraction-analysisReverse engineering analysis of StealC Stealer, an info-stealer that uses RuntimeBroker.exe hollowing, C2 infrastructure, and payload extraction.…
crissyfield/super-trouperMCP server exposing Frida instrumentation as tools for coding agents to connect to devices, inspect processes, manage sessions, and load JavaScript…
amd2g2zz/kunglao-agentThe reverse-engineering expert agent: plans its own analysis path, derives every fact from raw evidence, and converges under mechanical verification…
gmh5225/driver-kalderetaUnsigned Kernel Mode Driver that does memory modifications
gmh5225/driver-pidqserializationwrite-exampleHow to use PiDqSerializationWrite. Introduces how to safely read and write from mapped driver
