Dna

Dna Dna is a static binary analysis framework built on top of LLVM. Notably it's written almost entirely in C, including managed bindings for LLVM, Remill, and Souper. Functionality Dna implements an iterative control flow graph reconstruction inspired heavily by the SATURN paper. It iteratively...

binprotect

Build instructions See 4. Building for build instructions. Contents 1. Introduction 2. Binary rewriter 2.1. Relative address tracking 2.2. Disassembly 2.2.1. Basic block splitting 2.2.2. Indirect control flow 2.2.2.1. Jump tables 2.2.2.1.1. Bounded jump tables 2.2.2.1.2. Unbounded jump tables...

retdec

Warning The RetDec project is currently in a limited maintenance mode due to a lack of resources: Pull Requests are welcomed. They are reviewed with priority, if possible without delays. Issues are reacted on with delays up to one quarter. Issues are not actively solved unless they relate to a...

obfuscation_detection

Obfuscation Detection v2.4 Author: Tim Blazytko Automatically detect obfuscated code and other interesting code constructs Description: Obfuscation Detection is a Binary Ninja plugin to detect obfuscated code and interesting code constructs e.g., state machines in binaries. Given a binary, the...

angr

angr angr is a platform-agnostic binary analysis framework. It is brought to you by the Computer Security Lab at UC Santa Barbara, SEFCOM at Arizona State University, their associated CTF team, Shellphish, the open source community, and @rhelmot. Project Links Homepage: https://angr.io Project...

jadx

JADX jadx - Dex to Java decompiler Command line and GUI tools for producing Java source code from Android Dex and Apk files !WARNING Please note that in most cases jadx can't decompile all 100% of the code, so errors will occur. Check Troubleshooting guide for workarounds. Main features: decompil...

Alcatraz

Alcatraz Alcatraz is a x64 binary obfuscator that is able to obfuscate various different pe files including: .exe .dll .sys Overview Alcatraz Requirements Usage Features Obfuscation of immediate moves Control flow flattening ADD mutation Entry-point obfuscation Lea obfuscation Anti disassembly...

Fault-Injection-Finder

Fault Injection Finder root@kitploit: ▄▖ ▜ ▗ ▄▖ ▘ ▗ ▘ ▄▖▘ ▌ ▙▖▀▌▌▌▐ ▜▘ ▐ ▛▌ ▌█▌▛▘▜▘▌▛▌▛▌ ▙▖▌▛▌▛▌█▌▛▘ ▌ █▌▙▌▐▖▐▖ ▟▖▌▌ ▌▙▖▙▖▐▖▌▙▌▌▌ ▌ ▌▌▌▙▌▙▖▌ ▙▌ Geeoon Chung and Nate Snyder This repository is the software side of our fault injection attack project. For the hardware side, check out this repo...

panopticon

已弃用 Panopticon 项目已迁移至Gitlab，并重组为多个 crate。Qt GUI 已被 Verso 替代。 我会合并拉取请求，但不会再对此版本进行实质性工作。下方大多数链接已失效。 Panopticon - 一个自由的跨平台反汇编器 Panopticon 是一个使用 Rust 编写的跨平台逆向工程反汇编器。它支持 AMD64、x86、AVR 和 MOS 6502 指令集，并能打开 ELF 文件。Panopticon 自带 Qt GUI，用于浏览和注释控制流图。 安装 如果你只是想使用 Panopticon，请访问官网查看安装说明。 编译 Panopticon 使用 Rust...

diaphora

δiaphora 安装 使用 Hex-Rays 插件管理器 安装： root@kitploit: hcli plugin install https://github.com/joxeankoret/diaphora/archive/refs/tags/3.4.2.zip 手动安装说明见下文。 Diaphora（διαφορά，希腊语中意为“差异”）3.4 版本是截至目前（2026 年）可用的最先进的程序差异比较工具（作为 IDA 插件工作）。它于 2015 年在 SyScan 期间首次发布，此后一直得到积极维护：Diaphora 已经被移植了 11 年，覆盖了从 6.8 到 9.4...

UnConfuserEx

UnConfuserEx Enhanced fork of UnconfuserEx with improved support for modern ConfuserEx2 variants, anti-tamper recovery, compressor removal, control-flow restoration, and resource reconstruction. https://github.com/user-attachments/assets/de2c7fd9-6736-4f39-83c0-3c25aa9c1f24 If u ever played with...

ved-ebpf

VED-eBPF: Kernel Exploit and Rootkit Detection using eBPF VED Vault Exploit Defense-eBPF leverages eBPF extended Berkeley Packet Filter to implement runtime kernel security monitoring and exploit detection for Linux systems. Introduction eBPF is an in-kernel virtual machine that allows code...

ved-ebpf

VED-eBPF：使用 eBPF 进行内核利用和 Rootkit 检测 VED（Vault 利用防御）-eBPF 利用 eBPF（扩展的伯克利数据包过滤器）为 Linux 系统实现运行时内核安全监控和利用检测。 简介 eBPF 是一种内核实机，允许在无需修改内核源代码的情况下在内核中执行代码。eBPF 程序可以附加到 tracepoints、kprobes 和其他内核事件上，以高效地分析执行并收集数据。 VED-eBPF 使用 eBPF 追踪对安全敏感的内核行为，并检测可能表明存在利用或 rootkit 的异常。它提供两种主要检测：...

pharos

Pharos Static Binary Analysis Framework The Pharos static binary analysis framework is a project of the Software Engineering Institute at Carnegie Mellon University. The framework is designed to facilitate the automated analysis of binary programs. It uses the ROSE compiler infrastructure develop...

zyrox

Zyrox LLVM Obfuscator llvm compile and link-time plugin for obfuscating native code Why why not ¯\ツ/¯ One of my biggest projects, where I learned a lot about LLVM internals, binary formats, assembly and obfuscation techniques. I believe that learning through building is the best way to learn, thu...

windbg-decompile-ext

Windbg Decompile Extension via LLM This project is a Windows x64 WinDbg extension skeleton that resolves a function by name or address, reconstructs a deterministic control-flow view, and asks an LLM directly from the extension to produce pseudocode. Layout src/extension: WinDbg extension DLL and...

shredder-rs

Shredder-RS A polymorphic mutation engine for x8664 binaries. Overview Shredder-RS implements instruction-level shredding to defeat static analysis. By breaking the linear flow of the code and injecting randomized junk nodes, it forces disassemblers to follow a complex graph of JMP-linked...

DataInject-BOF

Data Inject BOF Una implementación en beacon object file de la prueba de concepto de inyección de procesos de mi entrada de blog Control Flow Hijacking via Data Pointers. Secuestra el flujo de control sobrescribiendo los punteros de función de Control Flow Guard de combase.dll que son llamados po...

process_overwriting

Process Overwriting Process Overwriting is a PE injection technique, closely related to Process Hollowing and Module Overloading. With its help, you can replace the main executable not a DLL of the target process. It works only for a newly created process - injection to existing processes is not...

vmp2

Introducción Este repositorio es una colección de herramientas heredadas para trabajar con binarios protegidos con VMProtect 2. Estas herramientas permiten desempaquetar, analizar y realizar desvirtualización experimental de software protegido con VMProtect 2. En el núcleo de esta colección se...