
TiEtwAgent
PoC memory injection detection agent based on ETW, for offensive and defensive research purposes

PoC memory injection detection agent based on ETW, for offensive and defensive research purposes

A machine learning malware analysis framework for Android apps.

A Solution For Cross-Platform Obfuscated Commands Detection presented on CIS2019 China. 动静态Bash/CMD/PowerShell命令混淆检测框架 - CIS 2019大会

Technical dossier on the DPRK-linked PolinRider supply-chain attack, documenting obfuscated JS payload injection, git history manipulation, C2…

Automatic USB drive malware scanning tool for the security-minded person

Graphical interface for PortEx, a Portable Executable and Malware Analysis Library

WinDbg plugin for automated malware dynamic analysis and IOC extraction. Executes within the debugger to collect predefined indicators and writes…

A comprehensive Python-based security tool for file scanning, malware detection, and analysis in an ever-evolving cyber landscape.

Multi-session IDALib MCP router for coding agents. Analyze multiple binaries in parallel with IDA-compatible reverse engineering tools.

Headless AI agent for deterministic reverse engineering.

Static and dynamic analysis tool for detecting malicious code, suspicious binaries, and privacy violations

First-ever decryptor for The Gentlemen ransomware — recovers encryption keys from process memory dumps using X25519 ephemeral key extraction. 35/35…

SVG Analysis and generation tools for commonly seen SVG attachment phishing

DriverSentinel is a security tool developed in Go that detects malicious and vulnerable drivers on Windows systems by comparing them against the…

A Qt Widgets desktop UI for exploring Python bytecode with pycdc/pycdas, inspecting native decompilation, and using AI fallback for unsupported code…

Extracts and analyzes PE file security characteristics (ASLR, DEP, CFG, NO_SEH) from DLLs and EXEs across directories, storing results in a SQLite…

Interactive documentation and visual reference for binary formats and system memory layouts.

PETriage: A symbol-unified PE file reader for triage, built for multi-platform and multi-interface use.