KsDumper

🔴 This repo is outdated due to the Capcom driver being patched 🔴 Thanks to mastercodeon314 there's now a port working on Windows 11. Enjoy ! https://github.com/mastercodeon314/KsDumper-11 KsDumper I always had an interest in reverse engineering. A few days ago I wanted to look at some game...

allthingsida

Operating system MS Windows PEB/LDRDATATABLEENTRY enumeration scripts PEB/TEB structures x64 PEB/TEB structures x86...

PolyEngine

PolyEngine — Polymorphic PE Packer 📦 PolyEngine is a research-grade, evasive PE packer designed for CTF challenges and low-level Windows security education. It focuses on bypassing EDR and AV heuristics through a layered stack of in-memory execution and obfuscation techniques. This is a side...

HintInject

HintInject HintInject es un insertador y cargador de shellcode que desarrollé mientras jugaba con las estructuras del archivo PE y la Tabla de Directorios de Importación. Toma un archivo de shellcode sin procesar y coloca el shellcode en fragmentos dentro de las entradas de la Tabla de...

ft9201-libfprint

ft9201-libfprint Soporte de huellas dactilares en Linux para el lector USB Focal-systems FT9201 2808:93a9, vendido como un dongle independiente de Windows Hello, como un controlador de libfprint. El sensor es un diminuto lector óptico de 96×96. El comparador incorporado de libfprint funciona mal...

AutoIt-Ripper

AutoIt-Ripper What is this This is a short python script that allows for extraction of "compiled" AutoIt scripts from PE executables. References This script is heavily based on 3 resources, definitely check them out if you want to dig a bit deeper into AutoIt stuff:...

retdec

Warning The RetDec project is currently in a limited maintenance mode due to a lack of resources: Pull Requests are welcomed. They are reviewed with priority, if possible without delays. Issues are reacted on with delays up to one quarter. Issues are not actively solved unless they relate to a...

iocx

IOCX Deterministic, Zero‑Risk IOC Extraction for Modern Security Pipelines Static IOC extraction from a PE file using the IOCX CLI Official IOCX Project This is the original IOCX engine for deterministic static IOC extraction and PE analysis. Any other repositories using the name "iocx" are not...

amber

Inroduction Amber is a position-independentreflective PE loader that enables in-memory execution of native PE filesEXE, DLL, SYS.... It enables stealthy in-memory payload deployment that can be used to bypass anti-virus, firewall, IDS, IPS products, and application white-listing mitigations...

interactive-binary-structures

Interactive Binary Structures An interactive web-based toolkit designed to bridge the gap between theoretical documentation and practical analysis of binary formats and system memory layouts. Portable Executable PE Format Documentation This tool serves as an interactive visual map of a Windows PE...

rustdllproxy

rustdllproxy A Rust crate utility to easily generate and develop proxy DLLs for Windows applications. Installation root@kitploit: cargo install rustdllproxy Compatibility This crate currently only supports the standard DLL PE format. Current Limitations When hooking functions with custom code, th...

cve-2021-40444

cve-2021-40444 Reverse engineering the "A Letter Before Court 4.docx" malicious files exploting cve-2021-40444 Files including malicious word and cab-file may be downloaded on any.run: https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/ Note! The domain name in the original malicious...

PhaseDump

PhaseDump Python tool for decrypting W32/Phase modules, first 16-bytes is the MD5 hash of decrypted code, rest is PE file RC4 encrypted with "Phase" as the key...

binprotect

Build instructions See 4. Building for build instructions. Contents 1. Introduction 2. Binary rewriter 2.1. Relative address tracking 2.2. Disassembly 2.2.1. Basic block splitting 2.2.2. Indirect control flow 2.2.2.1. Jump tables 2.2.2.1.1. Bounded jump tables 2.2.2.1.2. Unbounded jump tables...

TinyLoad

TinyLoad v7.4 - Empaquetador y cifrador PE para Windows TinyLoad es un cifrador/empaquetador PE para ejecutables x64 que empaqueta un exe de entrada con distintas capas de protección para evitar que sea sometido a ingeniería inversa. Es un único archivo .cpp y no tiene dependencias externas. cómo...

SSMA

SSMA SSMA is a simple malware analyzer written in Python 3. Features: Analyze PE file's header and sections number of sections, entropy of sections/PE file, suspicious section names, suspicious flags in the characteristics of the PE file, etc. Analyze ELF file for Linux malware analysis, it uses...

pe2pic

English || 简体中文 pe2pic Small visualizator for PE files Getting started Install the dependencies by: root@kitploit: pip install -r requirements.txt Usage root@kitploit: usage: pe2pic.py -h --infile INFILE --outfile OUTFILE --double --minheight MINHEIGHT PE visualizer options: -h, --help show this...

DInvoke_rs

DInvokers Rust port of Dinvoke. DInvokers may be used for many purposes such as PE parsing, dynamic exported functions resolution, dynamically loading PE plugins at runtime, API hooks evasion and more. Features: Dynamically resolve and invoke undocumented Windows APIs from Rust. Primitives allowi...

TABPE

TABPE ¿Qué es TABPE? TABPE una combinación de TABriz + PE - Tabriz es mi ciudad natal, y nombré este proyecto por mi amor a mi ciudad es un conjunto de datos abierto y estructurado que contiene información sobre todos los archivos PE ejecutables de Windows incluyendo .exe, .dll, .sys, etc., en...

LIEF

Blog • Documentation • About About The purpose of this project is to provide a cross-platform library to parse, modify and abstract ELF, PE and MachO formats. Main features : Parsing : LIEF can parse ELF, PE, MachO, COFF, OAT, DEX, VDEX, ART and provides a user-friendly API to access their...