
PrologWinDbg
Use Prolog to analyze memory dumps and stopped live processes in WinDbg.

Use Prolog to analyze memory dumps and stopped live processes in WinDbg.

Rust port of REA, a local-only reverse-engineering tool with CLI/MCP workflows and a native Ghidra worker

Decompile and disassemble Python bytecode (.pyc/.pyo) back to readable source. Supports Python 2.0 - 3.15 (CPython, PyPy and other implementations).…

A process monitoring tool that tries to detect exploitation

Python bindings for the Icicle emulator, enabling grey-box firmware fuzzing, binary emulation, and reverse-engineering workflows across x64 and ARM64…

Disassembler, decompiler and x64dbg-style debugger for PE/ELF binaries with IDA-style listing, function graphs, Lua plugins, CLI, and a built-in MCP…

Standalone Windows VM malware sandbox running capemon, with GUI triage viewer, YARA signatures, IOC extraction, network analysis, and…

A helper script for unpacking and decompiling EXEs compiled from python code.

Evidence-focused malware reverse engineering with deep PE/.NET inspection, Ghidra reconstruction, AI cross-checks, YARA, and ELF debugging

Project Date : Feb 2026 / Memory corruption vulnerability within the kernel driver of MiniTool. Demonstrates a debugger-assisted arbitrary kernel…

Linux system-call monitor using ptrace to trace file, process, network, and memory activity, with namespace isolation and machine learning…

Open-source automated malware analysis sandbox that runs suspicious files and URLs in isolated VMs and generates detailed behavioral reports.

Dynamic unpacker and import fixer for Themida/WinLicense 2.x and 3.x.

Dynamic unpacker based on PE-sieve

Static config extractor for SmokeLoader samples that deobfuscates, unpacks, and emulates protected routines to recover final-stage C2 settings.

Use YARA rules on Time Travel Debugging traces

Python bindings for BochsCPU

SVG Analysis and generation tools for commonly seen SVG attachment phishing