
javascript-deobfuscator
Deobfuscator for javascript-obfuscator 5.x output (string arrays, control-flow flattening, self-defending, RC4/base64)

Deobfuscator for javascript-obfuscator 5.x output (string arrays, control-flow flattening, self-defending, RC4/base64)

Code written as part of our various malware investigations

Extract the managed (.NET) assemblies out of a MAUI Android assembly store.

CMake build of Ghidra's SLEIGH processor specification library, providing standalone disassembly and p-code lifting engines for reverse engineering…

An LLVM-based instrumentation tool for universal taint tracking, dataflow analysis, and tracing.

A collection of my Frida instrumentation scripts to reverse engineer mobile apps and more.

Dynamic branch-divergence finder for native code -- traces two Frida executions and finds the exact instruction where they diverge.

Sample extensions, scripts, and API uses for WinDbg.

The Mobile App Pentest cheat sheet was created to provide concise collection of high value information on specific mobile application penetration…

An Interactive Binary Patching Plugin for IDA Pro

Unpack and deobfuscate VMProtect 2 protected binaries with an emulation-based VM explorer, handler profiler, and experimental LLVM recompiler for…

Documentation and reverse engineering of reCAPTCHA

Record and replay framework for deterministic debugging of multi-threaded applications, enabling reverse execution, hardware watchpoints, and…

Runtime instrumentation framework for building dynamic analysis tools: tracing, profiling, code coverage, memory debugging, fuzzing, and disassembly…

ExportHider: Generating Export Table during Runtime to Hide the Exported Functions from the DLL File.

NebulaPulsar is a proof-of-concept in-memory implant framework for Java (JSP) and ASP.NET (ASPX/ASHX/ASMX) webshells, originally developed as part of…

pyREtic is an extensible framework for in-memory Python 2.x bytecode reverse engineering

An strace-like program for the Windows 'native' API