Tools

memn0ps/matrix-rs

Rusty Hypervisor - Windows Kernel Blue Pill Type-2 Hypervisor in Rust (Codename: Matrix)

trailofbits/polytracker

An LLVM-based instrumentation tool for universal taint tracking, dataflow analysis, and tracing.

zer0condition/reversekit

x64 Dynamic Reverse Engineering Toolkit

elyelysiox/recaptcha

Documentation and reverse engineering of reCAPTCHA

void-stack/vmunprotect.dumper

VMUnprotect.Dumper can dynamically untamper VMProtected Assembly.

nccgroup/cartographer

Code Coverage Exploration Plugin for Ghidra

nccgroup/dibf

Windows NT ioctl bruteforcer and modular fuzzer

worksbutnottested/lightkeeper

Maps execution-coverage data onto Ghidra disassembly to highlight visited code paths and accelerate reverse-engineering workflows.

binsec/xyntia

Xyntia, the black-box deobfuscator

r00tkitsmm/pishi

Pishi is a code coverage tool like kcov for macOS.

1rhino2/fnprint

match functions in binaries by what they do, not what their bytes look like. behavioral function fingerprinting via microexecution.

nccgroup/winstrument

Winstrument is a framework of modular scripts to aid in instrumenting Windows software using Frida for reverse engineering and attack surface…

robertdfrench/ifuncd-up

GNU IFUNC is the real culprit behind CVE-2024-3094

frkngksl/exporthider

ExportHider: Generating Export Table during Runtime to Hide the Exported Functions from the DLL File.

zxgio/ghidra_stack_strings

A script to detect stack-strings by using emulation (leveraging Unicorn)

de4dot/de4dot

.NET deobfuscator and unpacker.

aftermathlabs/vmp2

Unpack and deobfuscate VMProtect 2 protected binaries with an emulation-based VM explorer, handler profiler, and experimental LLVM recompiler for…

sentinel-one/peafl64

Static Binary Instrumentation tool for Windows x64 executables