
malware-research
Code written as part of our various malware investigations

Code written as part of our various malware investigations

x64 Dynamic Reverse Engineering Toolkit

Detect, analyze and uniquely identify crashes in Windows applications

Documentation and reverse engineering of reCAPTCHA

VMUnprotect.Dumper can dynamically untamper VMProtected Assembly.

DLLirant is a tool to automatize the DLL Hijacking researches on a specified binary.

A DTrace on Windows Reimplementation

A PoC Java Stager which can download, compile, and execute a Java file in memory.


GUI Burp Plugin to ease discovering of security holes in web applications

Devirtualizes Tencent VM .tvm0 sections: lifts VM handlers to guest-level listings and LLVM IR, recovers CFG and dispatch, and patches recovered code…

GNU IFUNC is the real culprit behind CVE-2024-3094

Maps execution-coverage data onto Ghidra disassembly to highlight visited code paths and accelerate reverse-engineering workflows.

match functions in binaries by what they do, not what their bytes look like. behavioral function fingerprinting via microexecution.

Xyntia, the black-box deobfuscator

Reverse bytenode .jsc (V8 code cache) to JavaScript — static, pure Rust, no patched V8/Node. Node 8→26 / V8 5.8–14.6; 25k .jsc tested, 0 fail.

Distributed coverage-guided fuzzing engine compatible with libFuzzer targets; scales to thousands of concurrent jobs, uses sanitizers and corpus…

CodeQL + DTrace = Memory Disclosure Vulnerabilities in XNU