Tools

mandiant/flare-vm

A collection of software installations scripts for Windows systems that allows you to easily setup and maintain a reverse engineering environment on…

hyperdbg/hyperdbg

State-of-the-art native debugging tools

epsilon537/boxlambda

FPGA based microcomputer sandbox for software and RTL experimentation

awslabs/snapchange

Lightweight fuzzing of a memory snapshot using KVM

momo5502/sogen

🪅 Windows & Linux userspace emulator

wkoszek/emuko

RISC-V emulator in Rust that boots Linux with JIT on ARM64/x86_64 and Sv39 virtual memory

usbarmory/gotee-example

GoTEE - example application

mandiant/commando-vm

Customizable Windows-based virtual machine distribution pre-packaged with offensive security tools for penetration testing and red teaming operations.

patriksimek/vm2

Isolated JavaScript sandbox for Node.js that runs untrusted code with restricted access to built-in modules and host resources via Proxy-based…

intellabs/kafl

A fuzzer for full VM kernel/driver targets

cert-ee/cuckoo3

Open-source automated malware analysis sandbox that runs suspicious files and URLs in isolated VMs and generates detailed behavioral reports.

jamesstringer90/appsandbox

Easily create full virtual machines that are sandboxed for development or computer use models.

d4rksystem/vmwarecloak

A PowerShell script that attempts to help malware analysts hide their VMware Windows VM's from malware that may be trying to evade analysis.

remnux/distro

Provides supplemental files and Debian package sources for a specialized Linux distro focused on malware analysis, reverse engineering, and digital…

withsecurelabs/amsidetection

Proof-of-concept tool for detecting AMSI (Antimalware Scan Interface) bypasses and malicious in-memory script activity on Windows endpoints.

sinakarvandi/hypervisor-from-scratch

Source code of a multiple series of tutorials about the hypervisor. Available at: https://rayanfam.com/tutorials

darnellwashingtonjr94-art/sandb0x-xtract0r

Automated cross-platform sandbox that detonates suspicious files in isolated VMs/emulators, captures network and memory artifacts, and creates LLM…

rapid7/metasploitable3

Metasploitable3 is a VM that is built from the ground up with a large amount of security vulnerabilities.