no-access-protection-x86
gmh5225/no-access-protection-x86It encrypts the text section and set the protection to NO_ACCESS.
anti-botbinary-analysisdefensive-tools+4
1
gmh5225/no-access-protection-x86It encrypts the text section and set the protection to NO_ACCESS.
neo23x0/process-watcherA process monitoring tool that tries to detect exploitation
mandiant/goresymParses Go binaries to recover symbols, function metadata, types, file paths, and embedded strings, including stripped or UPX-packed samples, with IDA…
raj3shp/malscoreMaliciousness scoring for Linux commands
silentisvox/syscallrevenantClean Indirect Syscalls with Syscall Tampering.
yasindce1998/barzakhRing -4 to Ring 0: offense-defense firmware research platform. We build the bootkits, then we catch them. Closed-loop. Zero trust in silicon.
blackvectorops/semantic_firewallGenerate deterministic semantic fingerprints for Go functions. Detect xz-style backdoors and verify semantic equivalence using Static Single…
gmh5225/minidumpreaderParses Windows MiniDump (MDMP) files with Kaitai Struct, extracting memory strings and scanning them against YARA rules for forensic and malware…
kaandemir993/amadey-loader-multi-stage-malware-with-keylogging-clipboard-hijack-privilege-escalation-analysisReverse engineering Amadey Loader with x64dbg: dynamic API resolution, token privilege escalation, keylogger hooks, clipboard capture, and…
oyesanyf/oshoosiclawAutonomous Rust endpoint security agent combining Ring-0 Windows driver and Linux eBPF pre-execution blocking, YARA detection, MITRE ATT&CK mapping,…
gmh5225/memtoolsWindows Linux DMA、Dump 、Direct、inject 内存读取、写入工具
gmh5225/maldec-edrUnix endpoint detection and response solution using kernel-level mechanisms to detect anomalies and malware attacks in real time.
gmh5225/mapped-dumperA program written in C++ for remotely dumping manual mapped modules.
gmh5225/memory-relocallocC proof-of-concept that locates code caves in the .reloc section of mapped DLLs to allocate and execute small shellcode, replacing typical memory…
maximilianfeix/hexveroKnow what changed inside your app: inspect Electron apps and binaries, trace findings to file and line, compare releases. Locally, without executing…
twosevenonet/injectsetconsoleProof of Concept for Process Code Injection Without Using WriteProcessMemory
swastiksagar/wazuhlabprojectHands-on Wazuh SIEM/XDR home lab covering OVA deployment, agent enrollment, file integrity monitoring, VirusTotal malware detection, and MITRE ATT&CK…
sk4r4b/ntdll-reconstructionA technique that mixes NTDLL unhooking and hellsgate gate varients