
de4dot
Deobfuscates and unpacks .NET assemblies by decrypting strings and constants, removing proxy methods and anti-tamper code, restoring control flow,…

Injected x64 runtime analysis toolkit that hooks syscalls/APIs, monitors threads, heaps, imports and URLs, and bypasses common debugger checks.

Dynamically unpacks VMProtect-protected .NET assemblies, removes tamper protection, and restores executable code for reverse engineering.

In-memory implant framework for Java and ASP.NET webshells with AES-encrypted communication, dynamic payload loading, and session-based execution for…

C++ DLL template generator that hides exported functions from the filesystem export directory while reconstructing it at runtime to enable dynamic…

A script to detect stack-strings by using emulation (leveraging Unicorn)

Go bindings for a memory-scanning library to detect and dump in-memory PE injections, shellcode, and process anomalies for malware analysis and…

match functions in binaries by what they do, not what their bytes look like. behavioral function fingerprinting via microexecution.

An strace-like program for the Windows 'native' API

An API hooking framework for intercepting and monitoring Windows applications