covirt

covirt An x86-64 code virtualizer for VM based obfuscation. Features Stack-based virtual machine architecture MBA, self-modifying code obfuscation Support for both PE and ELF binaries Code markers to define protected regions PE support only tested on binaries compiled via MinGW-w64 Getting starte...

Copy-Fail-CVE-2026-31431-modernized

Copy-Fail-CVE-2026-31431-modernized A modernized version of Copy Fail PE How to use it: Just clone the repository and run the Poc.py : Educational purpose This proof of concept is only for educational purpose Inspired by : Main Exploit by theori-io...

AutoIt-Ripper

AutoIt-Ripper What is this This is a short python script that allows for extraction of "compiled" AutoIt scripts from PE executables. References This script is heavily based on 3 resources, definitely check them out if you want to dig a bit deeper into AutoIt stuff:...

WDExtract

WDExtract Extract Windows Defender database from vdm files and unpack it This program is distributed as-is, without any warranty; No official support, if you like this tool, feel free to contribute. Features Unpack VDM containers of Windows Defender/Microsoft Security Essentials; Decrypt VDM...

binprotect

Build instructions See 4. Building for build instructions. Contents 1. Introduction 2. Binary rewriter 2.1. Relative address tracking 2.2. Disassembly 2.2.1. Basic block splitting 2.2.2. Indirect control flow 2.2.2.1. Jump tables 2.2.2.1.1. Bounded jump tables 2.2.2.1.2. Unbounded jump tables...

blenny

Blenny is a proof-of-concept payload obfuscation tool for Windows which hides executable payload data within the icon of the executable. It is named after the sabre-toothed blenny fish, which mimmicks the behavior and looks of cleaner fish to prey on unsuspecting fish. Why? I can't recall exactly...

pe-bear

PE-bear PE-bear is a multiplatform reversing tool for PE files. Its objective is to deliver fast and flexible “first view” for malware analysts, stable and capable to handle malformed PE files. Signatures for PE-bear: SIG.txt updated: Oct 17, 2022 - contains signatures fromPEid's UserDB -...

pev

readpe pev has moved to @mentebinaria/readpe and has a new maintainer. :...

AIDebug

AIDebug Reviewer starting point Evidence-focused reverse-engineering CLI. Andrey Pautov develops the Python analyst interface, offline triage, string intelligence, PE inspection and reporting workflows. Capstone, Ghidra, GDB and optional AI providers are integrations, not original tools authored ...

MalScan

MalScan MalScan is a simple PE File Heuristics Scanners written in python that you can use to quickly analyze a PE file and find out whether anything suspicious exists. It is a simple tool so doesn't offers much fancy features. You are free to extend it or do whatever you want with it. Things...

ft9201-libfprint

ft9201-libfprint Linux fingerprint support for the Focal-systems FT9201 USB reader 2808:93a9, sold as a standalone Windows Hello dongle, as a libfprint driver. The sensor is a tiny 96×96 optical reader. libfprint's built-in matcher does a poor job on an image that small, so this driver instead...

Manalyze

Manalyze Introduction Manalyze is a static analysis tool for PE files that you can use to conduct primary assessment on an executable or set of executables. It collects weak signals that could indicate malicious behavior and displays information that can help a subsequent manual analysis. If you...

interactive-binary-structures

Interactive Binary Structures An interactive web-based toolkit designed to bridge the gap between theoretical documentation and practical analysis of binary formats and system memory layouts. Portable Executable PE Format Documentation This tool serves as an interactive visual map of a Windows PE...

PowerSploit

Forked to add a few features to PowerView.ps1 that I commonly perform manually This project is no longer supported PowerSploit is a collection of Microsoft PowerShell modules that can be used to aid penetration testers during all phases of an assessment. PowerSploit is comprised of the following...

VAXD

VAXD VAXD is a lightweight Windows disassembler, PE inspection tool, MultiCPU binary inspection tool, and patch-assistance environment. It is designed for fast analysis of executable files, firmware images, binaries, Office documents, PDF files, and Windows PE EXE/DLL files. VAXD provides a...

pe-signgen

pe-signgen Cross-version binary signatures and RVA offsets for Windows PE functions Overview pe-signgen is a tool for reverse engineers and security researchers that automatically generates: Binary signatures byte patterns with wildcards for unexported and exported functions RVA and file offsets...

CVE-2013-3900-PowerShell-PoC

CVE-2013-3900-PowerShell-PoC This PoC is provided for educational and research purposes only. The author takes no responsibility for misuse or damage caused by this code. This PowerShell script is a testing tool for simulating the attack described in CVE-2013-3900. CVE-2013-3900 concerns the...

PELoader

PELoader PELoader implement various shellcode injection techniques, and use libpeconv library to load encrypted PE files instead of injecting shellcode into remote thread. Following techniques were implemented: Module Stomping LoadLibrary Module Stomping NtMapViewOfSection PoC Transacted Hollowin...

retdec

Warning The RetDec project is currently in a limited maintenance mode due to a lack of resources: Pull Requests are welcomed. They are reviewed with priority, if possible without delays. Issues are reacted on with delays up to one quarter. Issues are not actively solved unless they relate to a...

DInvoke_rs

DInvokers Rust port of Dinvoke. DInvokers may be used for many purposes such as PE parsing, dynamic exported functions resolution, dynamically loading PE plugins at runtime, API hooks evasion and more. Features: Dynamically resolve and invoke undocumented Windows APIs from Rust. Primitives allowi...