
PortexAnalyzerGUI
Graphical interface for PortEx, a Portable Executable and Malware Analysis Library

Graphical interface for PortEx, a Portable Executable and Malware Analysis Library

Algorithmic PE de-obfuscator, Shannon entropy radar, and incident triage engine

Portable Executable reversing tool with a friendly GUI

pefile is a Python module to read and work with PE (Portable Executable) files


Windows tool for dumping malware PE files from memory back to disk for analysis.

Configuration Extractors for Malware

A blazingly fast, multi-threaded TUI malware analysis tool built in Rust. Features deep PE parsing, YARA scanning, and heuristic risk scoring.

Static-first research tool for unpacking Nuitka-compiled binaries: extracts constants, modules, recovers .pyc files, and generates analysis reports.

macOS IPC, launchd, Mach-O, and trust relationship explorer — zero-dependency terminal-native forensic tool

Detects process injection and memory manipulation used by malware. Finds RWX regions, shellcode patterns, API hooks, thread hijacking, and process…

PETriage: A symbol-unified PE file reader for triage, built for multi-platform and multi-interface use.

Lua-based Wireshark postdissector that decrypts and parses Ubiquiti AirMAX/RouterBoard 802.11 vendor IEs into filterable fields.

PowerShell toolkit for AMSI/Defender detection-boundary analysis and static malware triage maps byte offsets to detection triggers, plus YARA,…

Intercepts and analyzes USB Mass Storage traffic at the block and file level, emulates USB devices, and supports custom Python stubs for security…

Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).

Detection, mitigation, and reverse-engineering tooling for CVE-2026-41940 (SessionScribe): the cPanel/WHM unauthenticated session-forgery…