
STrace
A DTrace on Windows Reimplementation

A DTrace on Windows Reimplementation

Code Coverage Exploration Plugin for Ghidra

The first analysis framework for CPU microcode

Python toolkit accelerating Ghidra with a cached daemon, ARM64 P-code lifting, Z3 equivalence proofs, GPU-accelerated scanning, binary diffing, and…

Toy scripts for playing with WinDbg JS API

Elite is the client-side component of the Covenant project. Covenant is a .NET command and control framework that aims to highlight the attack…

A PoC Java Stager which can download, compile, and execute a Java file in memory.

A native APK and DEX decompiler written in Rust

User-mode x86_64 binary emulator for malware analysis and reverse engineering. Supports PE, ELF, memory dumps, and raw binaries with syscall tracing,…

The ARTful library for dynamically modifying the Android Runtime


A powerful decompiler that lets you reverse-engineer React Native mobile apps by converting their compiled Hermes bytecode (.hbc) files back into…

Runtime schema + RTTI extraction tool for Deadlock, CS2, Dota, and others (Source 2). No source2gen required.

decomp.wtf fork: Windows PE matching, MinGW/clang-cl toolchains, and an optional REA MCP bridge

Windows NT ioctl bruteforcer and modular fuzzer

GUI Burp Plugin to ease discovering of security holes in web applications

A Solution For Cross-Platform Obfuscated Commands Detection presented on CIS2019 China. 动静态Bash/CMD/PowerShell命令混淆检测框架 - CIS 2019大会

Detours implementation (x64/x86) which used only ntdll import