
facedancer
Implement your own USB device in Python, supported by a hardware peripheral such as Cynthion or GreatFET

Implement your own USB device in Python, supported by a hardware peripheral such as Cynthion or GreatFET

Collection of Windows internals research and exploitation techniques covering privilege escalation, token abuse, and post-exploitation tricks for red…

Standalone zero-driver Windows system and API monitor in Rust

Yet another llvm based obfuscator based on goron.

Obfuscates Go builds by wrapping the Go toolchain, replacing identifiers, package paths, and position data with hashes and stripping debug and build…

Obfuscates Go source code via AES-256 string encryption with runtime decryption, identifier renaming, and comment removal to hinder reverse…

Linux kernel exploitation toolkit providing an exploit-building library, ROP chain and stack pivot generators, kernel image runners, and a target…

Code deobfuscation framework to simplify Mixed Boolean-Arithmetic (MBA) expressions

Collection of Google Project Zero vulnerability research documents and small standalone security tools, including exploitation and…

Static analysis and structure recovery toolkit for ACE .qvm0-protected PE images

Python bindings for the Icicle emulator, enabling grey-box firmware fuzzing, binary emulation, and reverse-engineering workflows across x64 and ARM64…

CMake build of Ghidra's SLEIGH processor specification library, providing standalone disassembly and p-code lifting engines for reverse engineering…

Experimental x86-64 to LLVM IR lifter in Python that translates machine code into analyzable IR for reverse engineering, optimization, and VM handler…

Open source binary analysis framework and decompiler built on LLVM and QEMU, lifting binaries to a readable intermediate representation for reverse…

Windows kernel proof-of-concept demonstrating an anti-debugging technique that prevents WinDbg from breaking by manipulating the kernel exception…

Kernel hardware debugger module for dumping rootkit operations and inspecting kernel-level activity for malware analysis and reverse engineering.

The research UEFI hypervisor that supports booting an operating system.

Windows kernel driver that hooks Nt* SSDT functions to hide debuggers and processes from anti-debug checks, with an x64dbg plugin for stealth…