
NebulaPulsar
In-memory implant framework for Java and ASP.NET webshells with AES-encrypted communication, dynamic payload loading, and session-based execution for…

In-memory implant framework for Java and ASP.NET webshells with AES-encrypted communication, dynamic payload loading, and session-based execution for…

Injected x64 runtime analysis toolkit that hooks syscalls/APIs, monitors threads, heaps, imports and URLs, and bypasses common debugger checks.

C++ DLL template generator that hides exported functions from the filesystem export directory while reconstructing it at runtime to enable dynamic…

Dynamically unpacks VMProtect-protected .NET assemblies, removes tamper protection, and restores executable code for reverse engineering.

A Solution For Cross-Platform Obfuscated Commands Detection presented on CIS2019 China. 动静态Bash/CMD/PowerShell命令混淆检测框架 - CIS 2019大会

A script to detect stack-strings by using emulation (leveraging Unicorn)

Go bindings for a memory-scanning library to detect and dump in-memory PE injections, shellcode, and process anomalies for malware analysis and…

match functions in binaries by what they do, not what their bytes look like. behavioral function fingerprinting via microexecution.