scan
atomdrift-project/scan0-day malware detection for binaries, source & scripts (that doesn't suck)
binary-analysiscode-analysisdefensive-tools+9
514 days ago
atomdrift-project/scan0-day malware detection for binaries, source & scripts (that doesn't suck)
gmh5225/evilkasperskyWindows kernel driver experiment based on KasperskyHook that uses direct syscalls for interprocess memory copying, with support for unloading the…
withsecurelabs/python-exe-unpackerA helper script for unpacking and decompiling EXEs compiled from python code.
withsecurelabs/amsidetectionProof-of-concept tool for detecting AMSI (Antimalware Scan Interface) bypasses and malicious in-memory script activity on Windows endpoints.
withsecurelabs/dotnet-gargoyleA spiritual .NET equivalent to the Gargoyle memory scanning evasion technique
withsecurelabs/radare2-scriptsCollection of radare2 scripts for malware analysis: carve binaries from memory dumps, patch PE headers, and decode hashed function imports in…
volatilityfoundation/communityCommunity-maintained Volatility plugin collection for memory forensics, extending memory dump analysis with modules for malware and process…
hasherezade/libpeconvCustom PE loading and manipulation library for manual mapping, IAT hooking, memory dumping, and rebuilding imports for malware analysis and reverse…
securityronin/memory-forensicWalk any memory dump. Find what's hidden. Linux + Windows kernel forensics from a single static Rust binary — no Python required.
1rhino2/fnprintmatch functions in binaries by what they do, not what their bytes look like. behavioral function fingerprinting via microexecution.
zxgio/ghidra_stack_stringsA script to detect stack-strings by using emulation (leveraging Unicorn)
withsecurelabs/ticktockEnumerates Windows timer-queue timers to detect Ekko sleep obfuscation, aiding memory forensics and malware analysis in identifying evasive…
zer0condition/reversekitx64 Dynamic Reverse Engineering Toolkit
hasherezade/pesieve-goGolang bindings for PE-sieve
elastic/labs-releasesElastic Security Labs releases
hasherezade/sig_finderSignature finder (from PE-bear)
void-stack/vmunprotect.dumperVMUnprotect.Dumper can dynamically untamper VMProtected Assembly.