machscope

MachScope A native macOS binary analysis tool providing Mach-O parsing, ARM64 disassembly, and process debugging. Built entirely in Swift with zero external dependencies. Features...

chronomaly

Chronomaly Chronomaly is a kernel exploit for the Android / Linux kernel using CVE-2025-38352. The exploit was written specifically for Linux kernel v5.10.157, but should work against all vulnerable v5.10.x kernels, as it does not require any specific kernel text offsets to work. I covered the...

VMPacker

🛡️ VMPacker ARM64 ELF Virtual Machine Protection System Translate ARM64 native instructions into custom VM bytecode for function-level code protection 🇨🇳 中文文档 • Features • Architecture • Quick Start • Usage • License Overview VMPacker is a Virtual Machine Protection VMP system for ARM64 AArch64...

patching

Patching - Interactive Binary Patching for IDA Pro Overview Patching assembly code to change the behavior of an existing program is not uncommon in malware analysis, software reverse engineering, and broader domains of security research. This project extends the popular IDA Pro disassembler to...

patching

Patching - Parcheo Binario Interactivo para IDA Pro Resumen No es poco común en el análisis de malware, la ingeniería inversa de software y campos más amplios de investigación en seguridad, parchear código ensamblador para cambiar el comportamiento de un programa existente. Este proyecto extiende...

voltron

Voltron Voltron is an extensible debugger UI toolkit written in Python. It aims to improve the user experience of various debuggers LLDB, GDB, VDB and WinDbg by enabling the attachment of utility views that can retrieve and display data from the debugger host. By running these views in other TTYs...

lfi

Lightweight Fault Isolation LFI Welcome to the top-level repository for the Lightweight Fault Isolation LFI project. What is LFI? LFI is a system for sandboxing native code. Like WebAssembly and Native Client, LFI isolates sandboxed code in-process i.e., in the same address space as a host...

magisk-renef

MagiskRenef Un módulo de Magisk / KernelSU / APatch que empaqueta y ejecuta automáticamente renef — un kit de instrumentación dinámica para Android. Inspirado por magisk-frida. Requisitos Dispositivo Android rooteado Magisk / KernelSU / KernelSU Next / APatch Solo ARM64 — renef solo soporta Andro...

magisk-renef

MagiskRenef A Magisk / KernelSU / APatch module that automatically packages and runs renef — a dynamic instrumentation toolkit for Android. Inspired by magisk-frida. Requirements Rooted Android device Magisk / KernelSU / KernelSU Next / APatch ARM64 only — renef only supports ARM64 Android Androi...

metasploit_in_termux

Metasploit Framework 6 in Termux How to Install Before In order to have updated Termux: Purge all data of Termux in Android Settings Uninstall and reinstall latest Termux version from F-Droid Version on Play Store is outdated Then launch Termux to initialization, close it force stop, not swap...

r2frida

r2frida Radare2 and Frida better together Description Self-contained plugin for radare2 that ships frida and allows to instrument local or remote processes using r2 commands instead but not limited to Frida scripts. The radare project provides a complete toolchain for reverse engineering, it's...

oppo-pgem10-ghostlock

OPPO Find X6 Pro GhostLock Adaptation Project Overview This project conducts adaptation research for the CVE-2026-43499 GhostLock vulnerability on the OPPO Find X6 Pro PGEM10. Based on the original exploit architecture from NebuSec CyberMeowfia, referencing adaptation ideas from oppo-ghostlock...

blutter

Blutter Herramienta de ingeniería inversa de aplicaciones móviles Flutter mediante la compilación del tiempo de ejecución AOT de Dart Actualmente la aplicación solo soporta libapp.so de Android solo arm64. Además, la aplicación actualmente solo funciona contra versiones recientes de Dart. Para...

CVE-2024-7965

CVE-2024-7965 Este repositorio contiene el PoC para CVE-2024-7965. Esta es la vulnerabilidad en V8 que ocurre solo en ARM64. Agradecimientos Yuri Pazdnikov — Investigador Junior de Vulnerabilidades @ BI.ZONE...

ITScape

ITScape: Guest-to-Host Escape in KVM/arm64 Abstract This document describes the ITScape CVE-2026-46316 vulnerability reported and patched by Hyunwoo Kim @v4bel. It is a KVM escape vulnerability that lets a guest escape to the host in a KVM/arm64 environment and run commands on the host with kerne...

cryptomator

Supporting Cryptomator Cryptomator is provided free of charge as an open-source project despite the high development effort and is therefore dependent on donations. If you are also interested in further development, we offer you the opportunity to support us: One-time or recurring donation via...

CVE-2026-43499-Poc-Analysis

CVE-2026-43499 Adaptación de escalada de privilegios local para Android arm64 English | Chino Este es un proyecto de adaptación de escalada de privilegios local para Android arm64 para CVE-2026-43499. El proyecto genera target.h basado en la boot.img del dispositivo objetivo y la información del...

CVE-2021-28664-PoC

CVE-2021-28664-PoC Mali kbase GPU 驱动 UAFCVE-2021-28664→ 内核任意物理内存 读/写原语 的 PoC 骨架。面向通用 ARM64 Android 平台,与任何具体厂商、机型无关。 研究范围 仅到"内核任意物理内存读/写原语"为止 :如何把一个 GPU 驱动的 use-after-free 变成稳定、可控、可安全失败的内核内存读写能力。 本仓库不提供任何攻击。 不含成品 exploit、不含可直接运行的代码、 不含任何设备的偏移量/序列号/固件;禁止将任何内容用于攻击行为见下。 免责声明 / Disclaimer必读 1. 本仓库不提供攻...

CVE-2026-89727

A flaw was found in the Kernel-based Virtual Machine KVM for ARM64 arm64 architecture. A malicious guest operating system can provide an interrupt ID INTID that is outside the expected range to the GICv2 Generic Interrupt Controller version 2 during interrupt deactivation. This can trigger a...

CVE-2026-80939

A flaw was found in the Linux kernel's rtw89 PCI driver. During a warm reboot on ARM64 platforms, the driver's missing shutdown callback fails to stop radio frequency kill rfkill polling. This leads to attempts to read from a non-responding device, causing a fatal asynchronous SError and resultin...