
pyREtic
pyREtic is an extensible framework for in-memory Python 2.x bytecode reverse engineering

pyREtic is an extensible framework for in-memory Python 2.x bytecode reverse engineering

A DTrace on Windows Reimplementation

Code Coverage Exploration Plugin for Ghidra

Toy scripts for playing with WinDbg JS API

GNU IFUNC is the real culprit behind CVE-2024-3094

Maps execution-coverage data onto Ghidra disassembly to highlight visited code paths and accelerate reverse-engineering workflows.

ComfyEngine is a memory exploration toolkit built for people who need to monitor, patch, and script a running process.

ExportHider: Generating Export Table during Runtime to Hide the Exported Functions from the DLL File.


Golang bindings for PE-sieve

Deobfuscator for javascript-obfuscator 5.x output (string arrays, control-flow flattening, self-defending, RC4/base64)

Dynamic branch-divergence finder for native code -- traces two Frida executions and finds the exact instruction where they diverge.

Unpack and deobfuscate VMProtect 2 protected binaries with an emulation-based VM explorer, handler profiler, and experimental LLVM recompiler for…

An strace-like program for the Windows 'native' API

An API hooking framework for intercepting and monitoring Windows applications