
capa
Rule-based static and dynamic analysis tool that identifies capabilities in PE, ELF, .NET, and shellcode files, mapping them to MITRE ATT&CK…

Rule-based static and dynamic analysis tool that identifies capabilities in PE, ELF, .NET, and shellcode files, mapping them to MITRE ATT&CK…

Fast and accurate AI powered file content types detection


Real-time Windows system monitor with advanced process, network, and disk analysis, stack trace debugging, malware detection, and service management.…

Portable Executable reversing tool with a friendly GUI

Program for determining types of files for Windows, Linux and MacOS.

Universal Windows extraction tool that detects unknown files and routes them to the right bundled extractor.

🐍 🔍 GuardDog is a CLI tool to Identify malicious PyPI and npm packages

Advanced macOS system monitor leveraging Apple Endpoint Security to collect, enrich, and display process, file, memory, and XPC events for malware…

Clusters and elements to attach to MISP events or attributes (like threat actors)

Curated infosec knowledge base of practitioner notes, methodologies, and daily-updated CVE, news, and tool digests organized by offensive, defensive,…

A Linux version of the ProcDump Sysinternals tool

An automated Themida / Code Virtualizer / WinLicense (v3.0-v4) unpacker and dump fixer tool

An intelligent reverse engineering and AI-assisted analysis tool for HarmonyOS NEXT (HAP/APP/ABC), Android (APK/AAB), iOS (IPA), and native…

ELEGANTBOUNCER is a detection tool for file-based mobile exploits.


Rust port of REA, a local-only reverse-engineering tool with CLI/MCP workflows and a native Ghidra worker

Cross-platform syscall-powered implant & C2 — direct syscalls (Win), raw syscalls (Linux), HTTPS/DNS/ICMP channels. No winapi layer.