工具

aixisstudio/snitch

实时网络流量可视化工具——查看你计算机建立的每一个连接。隐私优先，100% 本地运行。

hfiref0x/kdu

Windows 内核驱动工具，利用存在漏洞的已签名驱动（BYOVD）绕过 DSE、加载未签名驱动、劫持受保护进程并转储进程内存。

blacktop/ipsw-diffs

Publishes per-build diffs of iOS, iPadOS, and macOS IPSW firmware releases, enabling binary-level comparison of system components across versions and…

pingpongplus/safeguard

CLI Encryption tool written in Go only for learning purposes (not secure)

albinowax/activescanplusplus

Burp Suite 扩展，通过检查主机头攻击、XXE、表达式语言注入、Shellshock 及其他 Web 漏洞来扩展主动和被动扫描。

ubfx/bindiffhelper

Ghidra 扩展，集成 BinDiff 用于函数匹配

safedep/gryph

Security layer for AI coding agents. Works with Claude Code, Cursor, Windsurf, Gemini CLI, OpenCode, Pi Agent and more.

gmh5225/kernelmode-driver

适用于 x64 Windows 系统的内核驱动程序，允许你读写虚拟/物理内存并挂钩 Win32k

gmh5225/keypatchx

KeyPatch Enhanced — IDA Pro plugin for symbol-aware x86/x64 assembly patching, powered by Keystone Engine. Fork of Keypatch with automatic IDA symbol…

gmh5225/kli-ex

面向 Windows 驱动程序的扩展内核延迟导入器，可在运行时解析 API，并使用加密、缓存的导入名称来隐藏内核函数的使用，从而规避静态分析。

gmh5225/kprocterminator

Windows 内核驱动程序，用于终止系统中的特定进程

praetorian-inc/caeruleus

用于Linux/BlueZ上蓝牙低功耗安全测试的单一Go二进制文件：扫描、枚举GATT、读/写/通知、模糊测试特征，并通过JSON输出运行结构化评估。

frida/frida-gum

用 C 编写的跨平台插桩与内省库

vqkro/ultrasploiter

A single binary that folds a port scanner, the full Exploit-DB index (47k entries) and runnable exploit modules into one tool. Written in Rust, runs…

lzwhehe/benign-instruction-bench

Re-evaluating prompt-injection detectors on LLM agent tool outputs (paper draft, scripts, scores)

sliverarmory/sliver-gui

Cross-platform Electron GUI for the Sliver C2 framework, providing session and beacon dashboards, payload generation, listeners, loot, and cloud…

morluto/rea

使用智能体对任何事物进行逆向工程，从应用行为到原生二进制文件。