
fnprint
match functions in binaries by what they do, not what their bytes look like. behavioral function fingerprinting via microexecution.

match functions in binaries by what they do, not what their bytes look like. behavioral function fingerprinting via microexecution.

A Solution For Cross-Platform Obfuscated Commands Detection presented on CIS2019 China. 动静态Bash/CMD/PowerShell命令混淆检测框架 - CIS 2019大会

.NET deobfuscator and unpacker.

VMUnprotect.Dumper can dynamically untamper VMProtected Assembly.

NebulaPulsar is a proof-of-concept in-memory implant framework for Java (JSP) and ASP.NET (ASPX/ASHX/ASMX) webshells, originally developed as part of…

Unpack and deobfuscate VMProtect 2 protected binaries with an emulation-based VM explorer, handler profiler, and experimental LLVM recompiler for…

A script to detect stack-strings by using emulation (leveraging Unicorn)

ExportHider: Generating Export Table during Runtime to Hide the Exported Functions from the DLL File.

x64 Dynamic Reverse Engineering Toolkit

Golang bindings for PE-sieve