malware-research
eset/malware-researchCode written as part of our various malware investigations
digital-forensicsdynamic-code-analysismalware-analysis+4
415
eset/malware-researchCode written as part of our various malware investigations
lifting-bits/sleighCMake build of Ghidra's SLEIGH processor specification library, providing standalone disassembly and p-code lifting engines for reverse engineering…
lolcaken/javascript-deobfuscatorDeobfuscator for javascript-obfuscator 5.x output (string arrays, control-flow flattening, self-defending, RC4/base64)
ejfkdev/jscdReverse bytenode .jsc (V8 code cache) to JavaScript — static, pure Rust, no patched V8/Node. Node 8→26 / V8 5.8–14.6; 25k .jsc tested, 0 fail.
fkie-cad/sandroid_dexray-interceptA Android malware analysis tool that creates comprehensive runtime profiles by hooking into application behavior across cryptography, file systems,…
anonmoty/xxstrikeXSStrike based XSS scanner with custom features. Detects XSS vulnerabilities in web applications.
trailofbits/polytrackerAn LLVM-based instrumentation tool for universal taint tracking, dataflow analysis, and tracing.
momalab/icsfuzzInstrumented fuzzer for PLC-based ICS control applications, targeting Codesys runtime on Wago controllers to uncover memory corruption and…
angorafuzzer/angoraCoverage-guided fuzzer that uses taint tracking and scalar optimization to solve path constraints without symbolic execution, improving branch…
tomnomnom/gfA wrapper around grep, to help you grep for things
google/honggfuzzSecurity oriented software fuzzer. Supports evolutionary, feedback-driven fuzzing based on code coverage (SW and HW based)
rust-fuzz/cargo-fuzzCargo subcommand for coverage-guided Rust fuzzing with libFuzzer: create and run fuzz targets, minimize failures and corpora, and report coverage.
chichou/grapefruitOpen-source mobile security testing suite for iOS and Android. Previously Passionfruit
1rhino2/fnprintmatch functions in binaries by what they do, not what their bytes look like. behavioral function fingerprinting via microexecution.
open-flaw/cve-2026-56848Exploit PoC for CVE-2026-56848, a Node.js HTTP/2 heap-use-after-free that allows remote unauthenticated DoS. Includes raw-socket trigger, ASan build…
worksbutnottested/lightkeeperMaps execution-coverage data onto Ghidra disassembly to highlight visited code paths and accelerate reverse-engineering workflows.
zxgio/ghidra_stack_stringsA script to detect stack-strings by using emulation (leveraging Unicorn)
binsec/xyntiaXyntia, the black-box deobfuscator