sc2pe

sc2pe Simple dotnet Native AOT app that uses AsmResolver to convert shellcode to PE. Both 32-bit and 64-bit x86, x64 shellcode is supported - resulting in 32-bit or 64-bit PE. Releases are compiled for both linux-x64 and win-x64. Description It is compiled to Native AOT format to demonstrate how...

pesieve-go

pesieve-go Golang bindings for PE-sieve. Requires pe-sieve32.dll, pe-sieve64.dll of a supported version to be present in the project directory, or in a path pointed by the environment variable: PESIEVEDIR. API Exposes the following wrappers for PE-sieve API: PESieveVersion uint32 func PESieveHelp...

PE-Obfuscator

PE-Obfuscator PE obfuscator with Evasion in mind , needs Admin Privilege in order to load RTCore64 driver. Video: https://user-images.githubusercontent.com/123980007/234171901-c1eb735e-ceca-481d-9310-02ba30f6836b.mp4 The Obfuscator : - Gets xored Fileless PE from a remote server - Drop the Loader...

CVE-2022-34302

🕷️ CVE-2022-34302 - Уязвимость загрузчика New Horizon Datasys New Horizon Datasys Reboot Restore Boot Loader - Bring Your Own Vulnerable UEFI Application BYOVUA - обход Secure Boot через подписанный загрузчик со встроенным пользовательским загрузчиком PE/COFF, который загружает неподписанные...

AsmResolver

AsmResolver AsmResolver is a library for reading, modifying and reconstructing Portable Executable PE files. It supports PE images running natively on Windows, as well as images containing managed .NET metadata. AsmResolver is released under the MIT license. Main Features AsmResolver has a lot of...

No-Consolation

No-Consolation This is a Beacon Object File BOF that executes unmanaged PEs inline and retrieves their output without allocating a console i.e. spawning conhost.exe. Features Supports 64 and 32 bits Supports EXEs and DLLs Does not create new processes Does not create new threads Links modules to...

wibu-codemeter-analysis

Cryptographic Analysis of WIBU CodeMeter DLL Independent security research on WIBU-Systems CodeMeter protection Responsible Disclosure Vendor notified: December 24, 2025 Disclosure period: 90 days Public release: March 24, 2026 Scope: WibuBz32.dll analysis only Summary Analysis of WIBU CodeMeter...

Cmulator

Cmulator - Scriptable x86 RE Sandbox Emulator v0.3 Beta Cmulator is x86 - x64 Scriptable Reverse Engineering Sandbox Emulator for shellcode and PE binaries Based on Unicorn & Capstone Engine & javascript . 💬 This is the last supported Pascal version and new code base C/C++ will be in here Cmulato...

panopticon

DEPRECATED The Panopticon project moved toGitlab and was restructed into multiple crates. The Qt GUI was replaced with Verso. I will merge PRs but won't do any substantial work on this version. Most links below are dead. Panopticon - A Libre Cross Platform Disassembler Panopticon is a cross...

pupy

Pupy Simple Installation pip3 install pipx pipx ensurepath pipx install git+https://github.com/n1nj4sec/pupy@nextgen pupysh If you want more detailed informationRefer to the wiki Development Install git clone https://github.com/n1nj4sec/pupy cd pupy git checkout nextgen git submodule init git...

pe_tree

PE Tree PE Tree est un module Python permettant d'afficher les fichier Portable Executable PE dans une arborescence à l'aide de pefile et PyQt5. Il peut également être utilisé avec IDA Pro, Ghidra, Volatility, Rekall et minidump pour visualiser et extraire des fichiers PE en mémoire, ainsi que po...

pe_tree

PE Tree PE Tree is a Python module for viewing Portable Executable PE files in a tree-view using pefile and PyQt5. It can also be used with IDA Pro, Ghidra, Volatility, Rekall and minidump to view and dump in-memory PE files, as well as perform import table reconstruction. Table of contents 1...

Mangle

THIS REPOSITORY HAS BEEN ARCHIVED To view the latest version of Mangle or to submit an issue, reference https://github.com/Tylous/Mangle. Mangle Authored By Tyl0us Featured at Source Zero Con 2022 Mangle is a tool that manipulates aspects of compiled executables .exe or DLL. Mangle can remove kno...

AIDebug

AIDebug Отправная точка для рецензента CLI для обратной разработки с фокусом на доказательства. Андрей Паутов разрабатывает интерфейс аналитика на Python, офлайн-триаж, анализ строк, инспекцию PE и рабочие процессы отчётности. Capstone, Ghidra, GDB и опциональные AI-провайдеры являются...

CVE-2026-79298

🐞 CVE-2026-79298: Неполное устранение обхода UEFI Secure Boot в Howyar SysReturn Уязвимость была исправлена. Бинарный файл был отозван. Но исправлена была лишь половина архитектуры. Восемнадцать месяцев спустя путь загрузки IA-32 по-прежнему содержал тот же самый кастомный PE-загрузчик, ту же сам...

binviz

binviz Инструмент визуализации и триажа бинарных файлов: связанные интерактивные представления энтропия, гистограммы, поверхности изображений/точечных графиков, графы потока управления поверх единой модели адресного пространства. pipx install binviz && binviz serve Что он делает Откройте файл — и...

Copy-Fail-CVE-2026-31431-modernized

Copy-Fail-CVE-2026-31431-modernized Современная версия Copy Fail PE Как использовать: Просто склонируйте репозиторий и запустите Poc.py : Образовательные цели Эта proof of concept создана исключительно в образовательных целях Вдохновлено : Основной эксплойт от theori-io...

MaldevAcademyLdr.2

MaldevAcademyLdr.2: RunPE implementation with multiple evasive techniques Quick Links Maldev Academy Home Maldev Academy Syllabus Maldev Academy Pricing !NOTE Although this repo can be used to execute other binaries, the whole focus was on running the mimikatz.exe executable. This is for...

zeek-xor-exe-plugin

================= Corelight::PEXOR Zeek plugin to detect and decrypt XOR-obfuscated Windows EXEs. The key used to XOR the file will be automatically discovered and used to XOR the file back to the original Window's executable. Once the file is deobfucated, it is passed back into the file analysis...

CentOS Linux 6 [TuxCare] Security Update: binutils / binutils-devel Multiple Vulnerabilities (CENTOS6:CLSA-2026:1775148022)

The CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1775148022 advisory. - A buffer overflow vulnerability in function gnuspecial in file cplus-dem.c in BinUtils 2.26 allows attackers to cause a denial of...