-
libpeconv Public
A library to load, manipulate, dump PE files. See also: https://github.com/hasherezade/libpeconv_tpl
-
tiny_tracer Public
A Pin Tool for tracing API calls etc
-
-
-
hollows_hunter Public
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
-
pe-sieve Public
Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).
-
-
ida_ifl Public
IFL - Interactive Functions List (plugin for IDA Pro)
-
pe-bear Public
Portable Executable reversing tool with a friendly GUI
-
libpeconv_tpl Public template
A ready-made template for a project based on libpeconv.
-
hidden_bee_tools Public
Parser for a custom executable format from Hidden Bee malware (first stage)
-
thread_namecalling Public
Process Injection using Thread Name
-
bearparser Public
Portable Executable parsing library (from PE-bear)
-
pin_n_sieve Public
An experimental dynamic malware unpacker based on Intel Pin and PE-sieve
-
IAT-Tracer Public
Forked from YoavLevi/IAT-TracerAn automation plugin for Tiny-Tracer framework to trace and watch functions directly out of the executable's import table or trace logs (.tag) files.
-
masm_shc Public
A helper utility for creating shellcodes. Cleans MASM file generated by MSVC, gives refactoring hints.
-
malware_training_vol1 Public
Materials for Windows Malware Analysis training (volume 1)
-
mal_unpack_drv Public
MalUnpack companion driver
-
sig_finder Public
Signature finder (from PE-bear)
-
instrumentation-callbacks Public
Forked from not-wlan/instrumentation-callbacksbased on https://github.com/secrary/Hooking-via-InstrumentationCallback
-
shellc_encoder Public
Standalone Metasploit-like XOR encoder for shellcode
-
process_ghosting Public
Process Ghosting - a PE injection technique, similar to Process Doppelgänging, but using a delete-pending file instead of a transacted file
-
-
transacted_hollowing Public
Transacted Hollowing - a PE injection technique, hybrid between ProcessHollowing and ProcessDoppelgänging
-
module_overloading Public
A more stealthy variant of "DLL hollowing"
-
mal_unpack Public
Dynamic unpacker based on PE-sieve
-
crypto_utils Public
Set of my small utils related to cryptography, encoding, decoding etc
-
-
-
pe2pic Public
Small visualizator for PE files
{{ message }}