
bifrost
High-performance HTTP/HTTPS/SOCKS5 MITM proxy in Rust with TLS interception, rule-based request rewriting, traffic capture, breakpoints, script…

High-performance HTTP/HTTPS/SOCKS5 MITM proxy in Rust with TLS interception, rule-based request rewriting, traffic capture, breakpoints, script…

Code written as part of our various malware investigations

match functions in binaries by what they do, not what their bytes look like. behavioral function fingerprinting via microexecution.

Deobfuscator for javascript-obfuscator 5.x output (string arrays, control-flow flattening, self-defending, RC4/base64)

GNU IFUNC is the real culprit behind CVE-2024-3094

An strace-like program for the Windows 'native' API

An API hooking framework for intercepting and monitoring Windows applications

An LLVM-based instrumentation tool for universal taint tracking, dataflow analysis, and tracing.

Rusty Hypervisor - Windows Kernel Blue Pill Type-2 Hypervisor in Rust (Codename: Matrix)

ExportHider: Generating Export Table during Runtime to Hide the Exported Functions from the DLL File.

A script to detect stack-strings by using emulation (leveraging Unicorn)

HTTP Proxy Analysis for reverse engineering protocol communication

Static Binary Instrumentation tool for Windows x64 executables

Code Coverage Exploration Plugin for Ghidra

x64 Dynamic Reverse Engineering Toolkit

VMUnprotect.Dumper can dynamically untamper VMProtected Assembly.

.NET deobfuscator and unpacker.

Winstrument is a framework of modular scripts to aid in instrumenting Windows software using Frida for reverse engineering and attack surface…