Tools

chef-cft/inspec_cve_2019_15224

Example InSpec profile to detect presence of a malicious rest-client gem (CVE-2019-15224)

lolcaken/javascript-deobfuscator

Deobfuscator for javascript-obfuscator 5.x output (string arrays, control-flow flattening, self-defending, RC4/base64)

zer0condition/reversekit

x64 Dynamic Reverse Engineering Toolkit

void-stack/vmunprotect.dumper

VMUnprotect.Dumper can dynamically untamper VMProtected Assembly.

atomdrift-project/scan

0-day malware detection for binaries, source & scripts (that doesn't suck)

we5ter/flerken

A Solution For Cross-Platform Obfuscated Commands Detection presented on CIS2019 China. 动静态Bash/CMD/PowerShell命令混淆检测框架 - CIS 2019大会

1rhino2/fnprint

match functions in binaries by what they do, not what their bytes look like. behavioral function fingerprinting via microexecution.

ejfkdev/jscd

Reverse bytenode .jsc (V8 code cache) to JavaScript — static, pure Rust, no patched V8/Node. Node 8→26 / V8 5.8–14.6; 25k .jsc tested, 0 fail.

frkngksl/exporthider

ExportHider: Generating Export Table during Runtime to Hide the Exported Functions from the DLL File.

zxgio/ghidra_stack_strings

A script to detect stack-strings by using emulation (leveraging Unicorn)

hasherezade/pesieve-go

Golang bindings for PE-sieve

de4dot/de4dot

.NET deobfuscator and unpacker.

aftermathlabs/vmp2

Unpack and deobfuscate VMProtect 2 protected binaries with an emulation-based VM explorer, handler profiler, and experimental LLVM recompiler for…

eset/malware-research

Code written as part of our various malware investigations

forensicxlab/vision-procmon

A ProcessMonitor visualization application written in rust.

fkie-cad/sandroid_dexray-intercept

A Android malware analysis tool that creates comprehensive runtime profiles by hooking into application behavior across cryptography, file systems,…

ayoubfaouzi/al-khaser

Public malware techniques used in the wild: Virtual Machine, Emulation, Debuggers, Sandbox detection.