
malware-research
Code written as part of our various malware investigations

Code written as part of our various malware investigations

match functions in binaries by what they do, not what their bytes look like. behavioral function fingerprinting via microexecution.

Deobfuscator for javascript-obfuscator 5.x output (string arrays, control-flow flattening, self-defending, RC4/base64)

An strace-like program for the Windows 'native' API

NebulaPulsar is a proof-of-concept in-memory implant framework for Java (JSP) and ASP.NET (ASPX/ASHX/ASMX) webshells, originally developed as part of…

An API hooking framework for intercepting and monitoring Windows applications

ExportHider: Generating Export Table during Runtime to Hide the Exported Functions from the DLL File.

A script to detect stack-strings by using emulation (leveraging Unicorn)

Golang bindings for PE-sieve

x64 Dynamic Reverse Engineering Toolkit

VMUnprotect.Dumper can dynamically untamper VMProtected Assembly.

.NET deobfuscator and unpacker.