Tools

yuatemycat/superghidra

Python toolkit accelerating Ghidra with a cached daemon, ARM64 P-code lifting, Z3 equivalence proofs, GPU-accelerated scanning, binary diffing, and…

eset/malware-research

Code written as part of our various malware investigations

giveen/decomp.anything

decomp.wtf fork: Windows PE matching, MinGW/clang-cl toolchains, and an optional REA MCP bridge

reverserid/jurig

a fully autonomous AI agent for reverse engineering

vmoranv/jshookmcp

A search-first, profile-aware reverse-engineering workspace for AI agents — 735 tools across 36 domains in one MCP server.

lolcaken/javascript-deobfuscator

Deobfuscator for javascript-obfuscator 5.x output (string arrays, control-flow flattening, self-defending, RC4/base64)

ejfkdev/jscd

Reverse bytenode .jsc (V8 code cache) to JavaScript — static, pure Rust, no patched V8/Node. Node 8→26 / V8 5.8–14.6; 25k .jsc tested, 0 fail.

fkie-cad/sandroid_dexray-intercept

A Android malware analysis tool that creates comprehensive runtime profiles by hooking into application behavior across cryptography, file systems,…

atomdrift-project/scan

0-day malware detection for binaries, source & scripts (that doesn't suck)

gmh5225/frida-stalker-ntstrace

frida-stalker based system call tracer on windows(x64).

veridiff/veridiff

Dynamic branch-divergence finder for native code -- traces two Frida executions and finds the exact instruction where they diverge.

mystuffyt/cve-2023-38831-poc

Proof-of-concept demonstrating CVE-2023-38831, a WinRAR path traversal vulnerability, by crafting a malicious ZIP archive that executes arbitrary…

skander1337/winrar-exploit

C++ implementation of CVE-2025-8088 WinRAR exploit using Alternate Data Streams to drop payloads into Windows Startup folder for persistence.

theexploiters/cve-2024-42845-exploit

Exploit For: CVE-2024-42845: Remote Code Execution (RCE) in Invesalius 3.1

shinycolumn/cve-2025-56799

OS Command Injection Vulnerability via Cache Clearing Scheduler in Reolink Desktop Application

papcaii2004/cve-2025-8088-winrar-builder

A POC exploit for WinRAR vulnerability (CVE-2025-8088) affecting versions 7.12 and lower

open-flaw/cve-2026-3462

Acrobat Reader | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)