
SysTrace
Linux system-call monitor using ptrace to trace file, process, network, and memory activity, with namespace isolation and machine learning…

Linux system-call monitor using ptrace to trace file, process, network, and memory activity, with namespace isolation and machine learning…

DrSemu - Sandboxed Malware Detection and Classification Tool Based on Dynamic Behavior

A machine learning tool that ranks strings based on their relevance for malware analysis.

Windows artifact analysis toolkit that maps AV detections to PE offsets, sections, RVA/VA and strings, with YARA, AMSI, capa and multi-engine…

Signature-based detection of malware features based on Windows API call sequences. It's like YARA for sandbox API traces!

RetDec is a retargetable machine-code decompiler based on LLVM.

Automatic analysis of SWF files based on some heuristics. Extensible via plugins.

🐍 🔍 GuardDog is a CLI tool to Identify malicious PyPI and npm packages

Python Command-Line Ghidra MCP

Python scriptable Reverse Engineering Sandbox, a Virtual Machine instrumentation and inspection framework based on QEMU

Cmulator is ( x86 - x64 ) Scriptable Reverse Engineering Sandbox Emulator for shellcode and PE binaries . Based on Unicorn & Zydis Engine &…

Image-based Android malware detection framework tackling obfuscation and concept drift. Includes curated datasets and Python code for training…

Dynamic unpacker based on PE-sieve

A comprehensive binary emulation and instrumentation platform.

Command-line and Python debugger for instrumenting and modifying native software behavior on Windows and Linux.

ThePhish: an automated phishing email analysis tool

Static deobfuscator for Themida, WinLicense and Code Virtualizer 3.x's mutation-based obfuscation.

ParanoiDF - PDF Analysis Suite based on PeePDF by Jose Miguel Esparza (http://peepdf.eternal-todo.com/). Tools added: Password cracking, redaction…