pe-sieve
hasherezade/pe-sieveScans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).
binary-analysisforensicsmalware-analysis+2
3.9k
hasherezade/pe-sieveScans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).
mr-un1k0d3r/edrsRed team tool for EDR evasion: dynamically resolves syscall IDs, patches ntdll stubs, unhooks IAT hooks, and lists hooked APIs from major EDR vendors.
attify/firmware-analysis-toolkitToolkit to emulate firmware and analyse it for security vulnerabilities
binref/refineryComposable command-line toolkit for malware triage and binary analysis: decode, decrypt, carve, and extract indicators from malicious files and…
matthieu-hackwitharts/win32_offensive_cheatsheetWin32 and Kernel abusing techniques for pentesters
robertcprice/ncpuResearch runtime for differentiable neural computers, GPU-based CPU emulation, and program synthesis. Features neural ALU, constant-time crypto, JEPA…
hasherezade/mal_unpackRuns packed malware in a controlled environment, waits for self-unpacking, dumps PE files and shellcodes from memory, and terminates the process.
pandaadir05/ghostDetects process injection and memory manipulation used by malware. Finds RWX regions, shellcode patterns, API hooks, thread hijacking, and process…
ergrelet/windiffTool that allows comparing symbol, type and syscall information of Microsoft Windows binaries across different versions of the OS, using a Web UI…
hfiref0x/wdextractExtract Windows Defender database from vdm files and unpack it
jeanextreme002/pymemoryeditorA pure-Python library that lets you inspect, modify and search the memory of any running process in a few lines of Python :snake: .
sjkim1127/reversecore_mcpA security-first MCP server that empowers AI agents to perform automated reverse engineering, malware analysis, forensics, vulnerability research,…
iamsopotatoe-coder/tinyloadOpen source Windows x64 PE packer and crypter. Compresses and encrypts executables with a custom virtual machine into a self extracting stub.
trailofbits/mquireZero-dependency Linux memory forensics, leveraging kernel-embedded BTF and kallsyms for type-aware memory analysis without external debug info.
advanced-threat-research/dotdumperAn automatic unpacker and logger for DotNet Framework targeting files
hdm/juniper-cve-2015-7755Notes, binaries, and related information from analysis of the CVE-2015-7755 & CVE-2015-7756 issues within Juniper ScreenOS
pandaadir05/snoopA modern syscall tracer built on eBPF. Think strace, but with a real TUI, smart filters, TLS decryption, and output that's actually readable.
nccgroup/asadbgasadbg is a framework of tools to aid in automating live debugging of Cisco ASA devices