
BiBi-Windows-Wiper-Analysis
Technical Analysis of Bibi-Windows Wiper Targeting Israeli Organizations

Technical Analysis of Bibi-Windows Wiper Targeting Israeli Organizations

Solution for analsing gozi malware: Please wait patiently while i develop the write-up :)

This repo stores necessary files for the analysis blog which will come soon

TCP JSON bridge servers for IDA Pro and Ghidra exposing decompilation, xrefs, symbols, vtables, RTTI and memory patching to external scripts and…

Small language model that names and describes functions in stripped x86-64 binaries, with an open dataset, baselines, and LoRA fine-tuning…

Benchmark datasets and synthesis artifacts for QSynth, containing Tigress-obfuscated C functions, x86_64 binaries, execution traces, ground truth,…

Minimalistic VT-x hypervisor for Windows x64 providing syscall, MSR, IDT, and kernel inline hooks plus EPT-based page substitution and TLB splitting.

IDA Pro plugin that imports runtime-resolved symbols in .NET Native binaries, parsing SharedLibrary.dll and its PDB to restore missing imports for…

Chase H.Q. for ZX Spectrum — reverse-engineered and reconstructed in portable C

Kernel hardware debugger module for dumping rootkit operations and inspecting kernel-level activity for malware analysis and reverse engineering.

A Windows userland tool to enumerate and classify ALPC ports, including PPL-protected processes.

Greybox Synthesizer geared for deobfuscation of assembly instructions.

This is part of a module for the framework that i'm constantly developing. Currently only information of the C2 are disclosed here.

Static analysis and structure recovery toolkit for ACE .qvm0-protected PE images

A simple hypervisor demonstrating the use of the Intel VT-rp (redirect protection) technology.


Devirtualizes Tencent VM .tvm0 sections: lifts VM handlers to guest-level listings and LLVM IR, recovers CFG and dispatch, and patches recovered code…

Rusty Hypervisor - Windows UEFI Blue Pill Type-1 Hypervisor in Rust (Codename: Illusion)