zx41r/awesome-reverse-engineering-and-malware-analysisA verified map of reverse engineering and malware analysis. Disassemblers, unpacking, exploit dev, fuzzing, DFIR, and the deep-cut writeups other…
1rhino2/fnprintmatch functions in binaries by what they do, not what their bytes look like. behavioral function fingerprinting via microexecution.
tadash10/detect-cve-2024-0762Detecting vulnerabilities like CVE-2024-0762, particularly in UEFI firmware, is quite challenging due to the low-level nature
emproof-com/workshop_firmware_reverse_engineeringWorkshop on firmware reverse engineering
amd2g2zz/kunglao-agentThe reverse-engineering expert agent: plans its own analysis path, derives every fact from raw evidence, and converges under mechanical verification…
ares-sys/uefi_bootkit_softlandingFirst public analysis of SoftLanding UEFI bootkit: Ring -2 implant, CVE-2025-7029, 240+ Gigabyte boards, GPU AI evasion, dual C2. YARA + Sigma +…
mrphrazer/obfuscation_detectionBinary Ninja plugin to identify obfuscated code and other interesting code constructs
nccgroup/idahuntidahunt is a framework to analyze binaries with IDA Pro and hunt for things in IDA Pro
phype/telnet-iot-honeypotPython telnet honeypot for catching botnet binaries
cmu-sei/kaijuCERT Kaiju is a binary analysis framework extension for the Ghidra software reverse engineering suite. This repository is a "mirror" -- please file…
arthastang/iot-implant-toolkitToolkit for implant attack of IoT devices
xoreaxlmbdx/die-in-browserStatic binary analysis with Detect It Easy — 100% in your browser, no uploads.
splintersfury/autopiffSemantic analysis engine for detecting vulnerability fixes in Windows kernel driver patches — 58 YAML rules, Ghidra decompilation, reachability…
jas502n/010-editor-templateBinary template repository for 010 Editor, providing .bt scripts for parsing executables, filesystem images, registry hives, and forensic artifacts…
mucoze/umayIoT Malware Similarity Analysis Platform
pandipanda69/my-little-honeypotLightweight telnet honeypot for capturing IoT malware samples and identifying active command-and-control infrastructure, designed for educational…
themalwareguardian/uefi-security-research-howyar-sysreturn-netcopyPost CVE-2024-7344 analysis of Howyar SysReturn NetCopy - reverse engineering notes, vulnerable binaries, vendor correspondence, and proof-of-concept…
engrbilal992/deaddialectA session-unique RISC-V ISA — every boot speaks a different dialect. Old binaries become invalid. Malware cannot persist.
