
polytracker
An LLVM-based instrumentation tool for universal taint tracking, dataflow analysis, and tracing.

An LLVM-based instrumentation tool for universal taint tracking, dataflow analysis, and tracing.

match functions in binaries by what they do, not what their bytes look like. behavioral function fingerprinting via microexecution.

.NET deobfuscator and unpacker.

Documentation and reverse engineering of reCAPTCHA

GNU IFUNC is the real culprit behind CVE-2024-3094

Maps execution-coverage data onto Ghidra disassembly to highlight visited code paths and accelerate reverse-engineering workflows.

Xyntia, the black-box deobfuscator

Static Binary Instrumentation tool for Windows x64 executables

VMUnprotect.Dumper can dynamically untamper VMProtected Assembly.

A script to detect stack-strings by using emulation (leveraging Unicorn)

Rusty Hypervisor - Windows Kernel Blue Pill Type-2 Hypervisor in Rust (Codename: Matrix)

Winstrument is a framework of modular scripts to aid in instrumenting Windows software using Frida for reverse engineering and attack surface…

Code Coverage Exploration Plugin for Ghidra

Pishi is a code coverage tool like kcov for macOS.

ExportHider: Generating Export Table during Runtime to Hide the Exported Functions from the DLL File.

Unpack and deobfuscate VMProtect 2 protected binaries with an emulation-based VM explorer, handler profiler, and experimental LLVM recompiler for…

x64 Dynamic Reverse Engineering Toolkit

Windows NT ioctl bruteforcer and modular fuzzer