Tools

1rhino2/fnprint

match functions in binaries by what they do, not what their bytes look like. behavioral function fingerprinting via microexecution.

zxgio/ghidra_stack_strings

A script to detect stack-strings by using emulation (leveraging Unicorn)

zer0condition/reversekit

x64 Dynamic Reverse Engineering Toolkit

hasherezade/pesieve-go

Golang bindings for PE-sieve

byt3bl33d3r/dnschef-ng

DNSChef (NG) - DNS proxy for Penetration Testers and Malware Analysts

void-stack/vmunprotect.dumper

VMUnprotect.Dumper can dynamically untamper VMProtected Assembly.

kaandemir993/salat-stealer-telegram-proxy-decoy-c2-analysis

"Reverse engineering analysis of Salat Stealer, a Go-based info-stealer that uses a Telegram proxy decoy, C2 communication, and encrypted memory…

federicochieregato/darkfox

Remote access trojan created using WinRar with firefox installer and python Reverse Shell embedded.

kaisonox/apiscope

An API hooking framework for intercepting and monitoring Windows applications

abc1230940/soc336-windows-ole-zero-click-rce-exploitation-detected-cve-2025-21298

SOC336 - Windows OLE Zero-Click RCE Exploitation Detected (CVE-2025-21298) Walkthrough

rogerorr/nttrace

An strace-like program for the Windows 'native' API

hackinglz/maps_scanner

MAPS cloud scanner and response parser for Microsoft Defender research.

frkngksl/exporthider

ExportHider: Generating Export Table during Runtime to Hide the Exported Functions from the DLL File.

rshipp/awesome-malware-analysis

Defund the Police.

iphelix/dnschef

DNSChef - DNS proxy for Penetration Testers and Malware Analysts

safedep/pmg

PMG protects developers, AI agents from malicious open source packages using proxy, sandbox and SafeDep's threat intelligence feed.

iss4cf0ng/nebulapulsar

NebulaPulsar is a proof-of-concept in-memory implant framework for Java (JSP) and ASP.NET (ASPX/ASHX/ASMX) webshells, originally developed as part of…

de4dot/de4dot

.NET deobfuscator and unpacker.