
no-access-protection-x86
It encrypts the text section and set the protection to NO_ACCESS.

It encrypts the text section and set the protection to NO_ACCESS.

Full static & memory analysis of Overlord RAT: Go agent architecture, HTTP/2 + WebSocket C2, reflective DLL injection, browser keylogging, and IOCs.…

0-day malware detection for binaries, source & scripts (that doesn't suck)

Windows kernel driver technique that hides kernel threads by abusing IoCancelIrp and IRP cancel routines, with detection methods for identifying…

GarbageMan is a set of tools for analyzing .NET binaries through heap analysis.

IDA python scripts to decrypt strings from KPOT and set those as comments

A curated set of NSO Group internal documents, product materials and sworn testimony that entered the public record in WhatsApp Inc. and Meta…

A set of functions to increase productivity while hacking with Bash

GEF (GDB Enhanced Features) - a modern experience for GDB with advanced debugging capabilities for exploit devs & reverse engineers on Linux

Tool that gathers a customizable set of ETW telemetry and generates user-defined detections


TeleShadow - Telegram Desktop Session Stealer (Windows)

Modular file scanning/analysis framework

A python2 script for sweeping a network to find windows systems compromised with the DOUBLEPULSAR implant.

Virus Total API Maltego Transform Set For Canari

Telegram Desktop Session Stealer

UNIX-like reverse engineering framework and command-line toolset

Incident Response & Digital Forensics Debugging Extension