
unicorn_pe
Emulates Windows PE execution using Unicorn engine for malware analysis, unpacking packed binaries, and decrypting VMProtect strings and imports.

Emulates Windows PE execution using Unicorn engine for malware analysis, unpacking packed binaries, and decrypting VMProtect strings and imports.

Rust Weaponization for Red Team Engagements.

Another RTTI Parsing IDA plugin

CVE-2025-21479 proof-of-concept, I think

Define and match user-defined graph patterns against binary control flow graphs using a Capstone-based disassembler, with CLI, Python bindings, and…

N-gram-based type recovery tool for binaries, recovering structures and function signatures from decompiled code with high throughput and actionable…

Interactive documentation and visual reference for binary formats and system memory layouts.

DECAF (short for Dynamic Executable Code Analysis Framework) is a binary analysis platform based on QEMU. This is also the home of the DroidScope…

Open source binary analysis framework and decompiler built on LLVM and QEMU, lifting binaries to a readable intermediate representation for reverse…

An experimental webkit-based kernel exploit (Arb. R/W) for the PS5 on <= 4.51FW

Endpoint behavior monitoring and analysis system for processes, files, registry, and networks. Supports scripting, extensions, and plugins for…

Static deobfuscator for Themida, WinLicense and Code Virtualizer 3.x's mutation-based obfuscation.

Maps attack surface of GWT applications by extracting obfuscated RPC endpoints and generating serialized request payloads for security testing.

Greybox Synthesizer geared for deobfuscation of assembly instructions.

BLE-based Fitbit research tool for authentication replay, encrypted activity dump decryption, memory/firmware extraction, and custom firmware…

MAPS cloud scanner and response parser for Microsoft Defender research.

ComfyEngine is a memory exploration toolkit built for people who need to monitor, patch, and script a running process.

Heap analysis tooling for mempool