
fnprint
match functions in binaries by what they do, not what their bytes look like. behavioral function fingerprinting via microexecution.

match functions in binaries by what they do, not what their bytes look like. behavioral function fingerprinting via microexecution.

Deobfuscates and unpacks .NET assemblies by decrypting strings and constants, removing proxy methods and anti-tamper code, restoring control flow,…

Injected x64 runtime analysis toolkit that hooks syscalls/APIs, monitors threads, heaps, imports and URLs, and bypasses common debugger checks.

Dynamically unpacks VMProtect-protected .NET assemblies, removes tamper protection, and restores executable code for reverse engineering.

A Solution For Cross-Platform Obfuscated Commands Detection presented on CIS2019 China. 动静态Bash/CMD/PowerShell命令混淆检测框架 - CIS 2019大会

Unpack and deobfuscate VMProtect 2 protected binaries with an emulation-based VM explorer, handler profiler, and experimental LLVM recompiler for…

In-memory implant framework for Java and ASP.NET webshells with AES-encrypted communication, dynamic payload loading, and session-based execution for…

Go bindings for a memory-scanning library to detect and dump in-memory PE injections, shellcode, and process anomalies for malware analysis and…

A script to detect stack-strings by using emulation (leveraging Unicorn)

C++ DLL template generator that hides exported functions from the filesystem export directory while reconstructing it at runtime to enable dynamic…