grap

grap: define and match graph patterns within binaries https://github.com/QuoSecGmbH/grap grap takes patterns and binary files, uses a Casptone-based disassembler to obtain the control flow graphs from the binaries, then matches the patterns against them. Patterns are user-defined graphs with...

shellen

Shellen General Shellen is an interactive shellcoding environment. If you want a handy tool to write shellcodes, then shellen may be your friend. Shellen can also be used as an assembly or disassembly tool. keystone and capstone engines are used for all of shellen's operations. Shellen only works...

Ropper

Ropper You can use ropper to display information about binary files in different file formats and you can search for gadgets to build rop chains for different architectures x86/X8664, ARM/ARM64, MIPS/MIPS64, PowerPC/PowerPC64, SPARC64. For disassembly ropper uses the awesome Capstone Framework...

xori

Xori - Custom disassembly framework Xori is an automation-ready disassembly and static analysis library that consumes shellcode or PE binaries and provides triage analysis data. Acknowledgements: Xori wouldn't exist without inspiration and ideas from the open source community. We are indebted to...

gef

GEF pronounced ʤɛf - "Jeff" is a set of commands for x86/64, ARM, MIPS, PowerPC and SPARC to assist exploit developers and reverse-engineers when using old school GDB. It provides additional features to GDB using the Python API to assist during the process of dynamic analysis and exploit...

keystone

Keystone Engine Keystone is a lightweight multi-platform, multi-architecture assembler framework. It offers some unparalleled features: Multi-architecture, with support for Arm, Arm64 AArch64/Armv8, Ethereum Virtual Machine, Hexagon, Mips, PowerPC, RISC-V, Sparc, SystemZ & X86 include 16/32/64bit...

iblessing

☠️ ██╗██████╗ ██╗ ███████╗███████╗███████╗██╗███╗ ██╗ ██████╗ ██║██╔══██╗██║ ██╔════╝██╔════╝██╔════╝██║████╗ ██║██╔════╝ ██║██████╔╝██║ █████╗ ███████╗███████╗██║██╔██╗ ██║██║ ███╗ ██║██╔══██╗██║ ██╔══╝ ╚════██║╚════██║██║██║╚██╗██║██║ ██║ ██║██████╔╝███████╗███████╗███████║███████║██║██║...

sandsifter

s a n d s i f t e r : the x86 processor fuzzer Overview The sandsifter audits x86 processors for hidden instructions and hardware bugs, by systematically generating machine code to search through a processor's instruction set, and monitoring execution for anomalies. Sandsifter has uncovered secre...

capstone

Capstone Engine !TIP ¡Bienvenido a unirte a nuestro grupo comunitario! Capstone es un framework de desensamblaje con el objetivo de convertirse en el motor de desensamblaje definitivo para el análisis binario y la ingeniería inversa en la comunidad de seguridad. Creado por Nguyen Anh Quynh, luego...

peCloakCapstone

peCloak - Capstone This is a simple fork of SecuritySift's peCloak that uses Capstone. The intention is to provide a fork based on a well-maintained, up-to-date disassembly library and to make the script multi-platform. Here's what I did so far: Replaced pydasm with Capstone Included a patched...

fhex

Fhex - 功能齐全的十六进制编辑器 本项目旨在开发一个轻量级但实用的工具。原因在于现有十六进制编辑器存在一些不同的限制（例如，依赖过多、缺少十六进制着色功能等）。 本项目基于 qhexedit2 、capstone 和 keystone 引擎。未来可能会增加新功能，欢迎提交 PR。 功能 块加载器 - 用于仅加载大文件的一部分，避免耗尽内存（使用 alt + 左/右箭头在块间移动）。请注意，在块模式下，所有操作（例如搜索）仅应用于当前块，但文件保存除外（整个文件被保存）。然而，每次编辑一个块后，在移动到另一个块之前请先保存，否则更改将丢失。 搜索与替换（支持...

fhex

Fhex - A Full-Featured HexEditor This project is born with the aim to develop a lightweight, but useful tool. The reason is that the existing hex editors have some different limitations e.g. too many dependencies, missing hex coloring features, etc.. This project is based on qhexedit2 , capstone...

pyvex

PyVEX PyVEX is Python bindings for the VEX IR. Project Links Project repository: https://github.com/angr/pyvex Documentation: https://api.angr.io/projects/pyvex/en/latest/ Installing PyVEX PyVEX can be pip-installed: pip install pyvex Using PyVEX import pyvex import archinfo translate an AMD64...

strilight

Strilight v0.2.0 High-Performance Algebraic Loop Lifting & Exact Rational Recurrence Engine for Python and C %20/%20O\log%20N-orange.svg Overview: Why Iterate When You Can Solve? Traditional compilers, runtimes, and JIT engines such as GCC, Clang, PyPy, or Numba treat loops as repetitive...

silica

SILICA An exhaustive comparison of A64 instruction-allocation decisions. Silica checks every one of the 4,294,967,296 possible A64 instruction words. It compares whether Capstone, LLVM, Unicorn, and a table compiled from Arm's XML encoding diagrams accept each word. A decoder and an encoding...

psr

Pointer Sequence Reverser Diseñado para ayudar a un ingeniero inverso a ver fácilmente cómo una aplicación C++ de Windows está accediendo a un miembro de datos u objeto en particular. Dada la dirección de memoria de un miembro de datos u objeto, esta herramienta establecerá un breakpoint de memor...

binviz

binviz Visualizador y herramienta de triaje de binarios: vistas interactivas vinculadas entropía, histogramas, superficies de imagen/dot-plot, grafos de flujo de control sobre un único modelo de espacio de direcciones compartido. pipx install binviz && binviz serve Qué hace Abre un archivo y cada...

JOP_ROCKET

JOP ROCKET NOTA: Con la 2.15, introducimos el dispatcher de dos gadgets--esto expande significativamente las posibilidades con los dispatcher gadgets. Se han añadido muchas optimizaciones y nuevas características adicionales con la 2.15 el 26 de mayo de 2021. Actualización: 29 de noviembre de 202...

Rocky Linux 9.6 [TuxCare] Security Update: capstone / capstone-devel / capstone-java / python3-capstone (ALMALINUX9.6:CLSA-2026:1774374355)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1774374355 advisory. - Capstone is a disassembly framework. In versions 6.0.0-Alpha5 and prior, Skipdata length is not bounds- checked, so a user-provided...

Rocky Linux 9 [CIQ] Security Update: capstone / capstone-debuginfo / capstone-debugsource / etc (crlsa-2026_39309)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202639309 advisory. capstone: Capstone: Memory corruption via unchecked vsnprintf return CVE-2025-68114 Tenable has extracted the preceding description block directly from the CIQ...