Amsi-Killer

Lifetime AMSI bypass Opcode Scan we get the exact address of the jump instruction by searching for the first byte of each instruction this technique is effective even in the face of updates or modifications to the target data set. for example : | 48:85D2 | test rdx, rdx | | 74 3F | je...

CVE-2021-33624

Proof of Concept for CVE-2021-33624 compile with gcc -pthread -o bpfspectretypeconfusion bpfspectretypeconfusion.c -Wall -ggdb -std=gnu99 execute with sudo ./bpfspectretypeconfusion 1 2 ffffffffa4925620 0x10 where 1 and 2 are CPU threads which run on two distinct hardware cores, ffffffffa4925620 ...

sass-king

SASS King Reverse engineering NVIDIA SASS from controlled kernels to production audits. Article 1 · Article 2 · Knowledge base · Pattern library · SM120 instruction glossary · Encoding notes · Start here · Project structure · Tensor-core chapters · Contributing SASS King is a systematic...

sleigh

Sleigh Library Sleigh is a language used to describe the semantics of instruction sets of general-purpose microprocessors, with enough detail to facilitate the reverse engineering of software compiled for these architectures. It is part of the Ghidra reverse engineering platform and underpins two...

NOP_Plugin

NOPPlugin Plugin for NOPing instructions in IDA. The creation of the plugin was inspired by Vidar Stealer I was trying to remove the junk bytes / instructions. Before: After: Instructions Paste the NOPPlugin.py file under "plugins" subdirectory of IDA. To NOP the instructions out just select the...

B2R2

B2R2 B2R2 is a fully managed binary analysis framework written in F. It provides a rich set of algorithms, functions, and tools for reverse engineering, program analysis, and binary-level inspection. The name B2R2 takes inspiration from R2-D2, the iconic robot from Star Wars. Originally named B2-...

xed

Intel® X86 Encoder Decoder Intel® XED Doxygen API manual and source build manual: https://intelxed.github.io Bugs: https://github.com/intelxed/xed/issues/new Abbreviated GITHUB building instructions: git clone https://github.com/intelxed/xed.git xed git clone https://github.com/intelxed/mbuild.gi...

sandsifter

s a n d s i f t e r : the x86 processor fuzzer Overview The sandsifter audits x86 processors for hidden instructions and hardware bugs, by systematically generating machine code to search through a processor's instruction set, and monitoring execution for anomalies. Sandsifter has uncovered secre...

sandsifter

s a n d s i f t e r : the x86 processor fuzzer Overview The sandsifter audits x86 processors for hidden instructions and hardware bugs, by systematically generating machine code to search through a processor's instruction set, and monitoring execution for anomalies. Sandsifter has uncovered secre...

CVE-2021-27965

CVE-2021-27965 Proof of concept for CVE-2021-27965 Stack-based Buffer Overflow NOTE: I probably will not update this any further there is still a chance I will finish it. I currently have the ability to cleanly overwrite the instruction pointer, but I believe that this is enough to prove I have t...

static_asm

staticasm A header-only C++20 library for compile-time x86/x86-64 instruction encoding. This project is dual-licensed under the Boost Software License 1.0 and the MIT License. You may choose either license. Purpose Learning x86 assembly encoding in a practical and fun way Generating assembly...

Lucky-Spark

LUCKY-SPARK ⟪ LUCKY-SPARK ⟫ is a stager designed for shellcode payloads staged with http/https like sliver or on github raw. It uses modern obfuscation and evaion methods like sliding window just-in-time decryption of the payload and cpu instruction patching. By default it creates an executable...

HallWatch

HallWatch Copyright C 2026 Adam Zypherion — licensed under GPL-3.0. Indirect syscalls are simple once you have seen one. The loader walks ntdll, reads the SSN out of Nt prologue, finds the 0F 05 two bytes further in, sets r10/rax/rdx/r8/r9 itself, and jmps straight at those two bytes. The syscall...

shredder-rs

Shredder-RS A polymorphic mutation engine for x8664 binaries. Overview Shredder-RS implements instruction-level shredding to defeat static analysis. By breaking the linear flow of the code and injecting randomized junk nodes, it forces disassemblers to follow a complex graph of JMP-linked...

ghidra-emotionengine

ghidra-emotionengine Ghidra Processor for the Play Station 2's Emotion Engine CPU. The core MIPS/FPU/COP0 instruction are based off the MIPS32/64 processor included in Ghidra, with superfluous instructions stripped out and some instructions modified. The following instuction sets are currently...

psr

Pointer Sequence Reverser Designed to help a reverse engineer easily see how a Windows C++ application is accessing a particular data member or object. Given the memory address of a data member or object, this tool will set a memory breakpoint at that address and then produce traces of the...

ASM-Obfuscator

ASM-Obfuscator Advanced x86-64 assembly obfuscator. Description The Assembly Code Obfuscator is a powerful and versatile tool designed to enhance the security of your x86-64 assembly code. It shields your projects from reverse engineering and analysis by employing a wide range of obfuscation...

-SCTT-2026-33-0002-DWM-Visual-Field-Singularity

SCTT-2026-33-0002: DWM Visual-Field Singularity 📡 Theoretical Classification ID: SCTT-2026-33-0002 Researcher: Americo Simoes SimoesCTT Physics: Theorem 4.2 - Turbulent Phase Transition TPT Constant: α = 0.0302011 Target: Desktop Window Manager dwm.exe / Windows Graphics Component Obsoletes:...

Fault-Injection-Finder

Fault Injection Finder ▄▖ ▜ ▗ ▄▖ ▘ ▗ ▘ ▄▖▘ ▌ ▙▖▀▌▌▌▐ ▜▘ ▐ ▛▌ ▌█▌▛▘▜▘▌▛▌▛▌ ▙▖▌▛▌▛▌█▌▛▘ ▌ █▌▙▌▐▖▐▖ ▟▖▌▌ ▌▙▖▙▖▐▖▌▙▌▌▌ ▌ ▌▌▌▙▌▙▖▌ ▙▌ Geeoon Chung and Nate Snyder This repository is the software side of our fault injection attack project. For the hardware side, check out this repo. Overall Project The...

skill-safety-bench

SkillSafetyBench SkillSafetyBench is a fully materialized benchmark for evaluating safety failures caused by attacks on skill-facing context. Each case keeps the user-facing task ordinary, while the attack is placed in local skills, helper scripts, sidecar files, corpora, templates, or other...