tiny_tracer

tinytracer A Pin Tool for tracing: API calls, including input and output of selected functions defined local functions, and functions from statically linked libraries selected instructions: RDTSC, CPUID, INT inline system calls, including parameters of selected syscalls transition between section...

tracee

Before moving on, please consider giving us a GitHub star ⭐️. Thank you! About Tracee Tracee is a runtime security and observability tool that helps you understand how your system and applications behave. It is using eBPF technology to tap into your system and expose that information as events tha...

pe-sieve

Intro PE-sieve is a tool that helps to detect malware running on the system, as well as to collect the potentially malicious material for further analysis. Recognizes and dumps variety of implants within the scanned process: replaced/injected PEs, shellcodes, hooks, and other in-memory patches...

rsyscall

Summary rsyscall is a library which provides a interface to an ever-growing subset of Linux system calls. This interface is: process-independent : all system calls are called as methods on process objects, which can refer to the "local" process or to other processes under our control, possibly on...

gustave

c Airbus 2021, sduverger GUSTAVE - Embedded OS kernel fuzzer What is it ? GUSTAVE is a fuzzing platform for embedded OS kernels. It is based on QEMU and AFL and all of its forkserver siblings. It allows to fuzz OS kernels like simple applications. Thanks to QEMU, it is multi-platform. One can see...

MalDev

MalDev ¡Hola! Bienvenido a mi repositorio : Soy Captain Magma, una persona apasionada dedicada a la ciberseguridad, el desarrollo de malware y el análisis. El propósito de este repositorio es gestionar mi camino de aprendizaje en MalDev mientras aprendo y actualizo este repositorio con mis notas ...

BestEdrOfTheMarket

市场上最佳EDR（BEOTM）V3 🐲🏴‍☠️ 市场上最佳EDR（Best Edr Of The Market）是一个开源实验室，旨在从底层视角实现并理解端点检测与响应（EDR）安全产品所使用的检测方法及其绕过技术。这些技术主要基于利用Windows NT的遥测能力来动态分析进程行为。 ➡️​ BestEdrOfTheMarket内核版本有何新特性？ 防御能力 当前版本（v3）侧重于Windows内核提供的部分拦截能力。这些包括： 通过替代系统调用处理程序进行系统调用拦截 利用虚拟地址描述符（VAD）树进行映像完整性检查...

SysWhispers2

SysWhispers2 SysWhispers 通过生成植入物可用于进行直接系统调用的头文件/汇编文件，帮助进行规避。 所有核心系统调用均受支持，示例生成文件位于 example-output/ 文件夹中。 SysWhispers 1 和 2 的区别 用法与 SysWhispers1 几乎相同，但无需指定要支持哪些 Windows 版本。大多数更改在底层。它不再依赖 @j00ru 的 syscall tables，而是使用由 @modexpblog 推广的“按系统调用地址排序”技术。这大大减少了系统调用存根的大小。 SysWhispers2 的具体实现是 @modexpblog...

osx-re-101

osx & ios re 101 正在进行中，我在积极收集这些资源。 必读 https://reverse.put.as/ https://blog.paloaltonetworks.com/tag/mac-os-x/ https://www.synack.com/blog/r-d-projects/os-x-security-research/ https://pewpewthespells.com/re.html https://github.com/bx/machO-tools https://github.com/kpwn/iOSRE 随时备查 "OSX Mach-O 文件格式参...

SysWhispers3

SysWhispers3 SysWhispers 通过生成头文件/ASM 文件帮助规避检测，使植入程序能够直接进行系统调用。 官方 Discord 频道 快来 Discord 一起玩吧！ 我为什么不为 SysWhispers2 创建 PR？ SysWhispers3 作为独立版本的原因有很多，但最重要的包括： SysWhispers3 是 Inceptor 使用的“事实分支”，并实现了一些与原始版本工具无关的实用类。 SysWhispers2 正朝着支持 NASM 编译（用于 gcc/mingw）的方向发展，而此版本专门设计并测试支持 MSVC（因为 Inceptor...

CallStackSpoofer

CallStackSpoofer 该仓库演示了一个 PoC 实现，用于在进行系统调用时伪造任意调用栈。完整的技术分析请参阅随附的博客文章：https://labs.withsecure.com/blog/spoofing-call-stacks-to-confuse-edrs。 默认情况下，它包含三个可供模仿的示例调用栈，可通过提供 --wmi、--rpc 或 --svchost 参数来选择，如下所示： 这些调用栈是通过启用进程访问事件的 SysMon 运行并搜索 lsass 为句柄操作目标的事件而获得的。 注意，作为提醒，此 PoC 已在以下 Windows 版本上测试：...

LetMeowIn

LetMeowIn 一款使用 C++ 和 MASM x64 编写的复杂隐蔽 LSASS 转储工具。 如 Binary Defense 和 Cyber Security News 上所见 免责声明 不要用它作恶。我创建这个工具是为了学习。如果联邦探员敲你的门，我不负责任。 历史上曾能绕过（现在可能依然可以）绕过 Windows Defender Malwarebytes Anti-Malware CrowdStrike Falcon EDR Falcon Complete + OverWatch Palo Alto Cortex xDR 当与强大的初始访问方法结合使用时 功能特性...

EUVD-2026-75802

IBM Aspera Enterprise WebApps 1.0.0 through 1.0.5 could allow a local attacker to escape container protections due to unrestricted system calls being permitted within the container...

CVE-2026-75777

IBM Aspera Enterprise WebApps 1.0.0 through 1.0.5 could allow a local attacker to escape container protections due to unrestricted system calls being permitted within the container...

CVE-2026-75777

IBM Aspera Enterprise WebApps versions 1.0.0 through 1.0.5 are vulnerable to a container escape caused by unrestricted system calls being permitted within the container. A local attacker with low privileges can exploit this to break out of the container, resulting in high impact to confidentialit...

CVE-2026-75777 Multiple vulnerabilities in IBM Aspera Enterprise Webapps

IBM Aspera Enterprise WebApps 1.0.0 through 1.0.5 could allow a local attacker to escape container protections due to unrestricted system calls being permitted within the container...

play-go-copy-fail-cve-2026-31431

Play Go Copy Fail CVE-2026-31431 Propósito Aprender syscalls de Linux bajo nivel Portar Python y C a Golang Crear tu propio payload y explotarlo como novato Actualizar automáticamente la pty de forma manual Inspiración tgies/copy-fail-c painoob/Copy-Fail-Exploit-CVE-2026-31431 Recursos Código...

SysWhispers4

SysWhispers4 通过直接和间接系统调用实现 AV/EDR 规避 Windows NT 3.1 至 Windows 11 24H2 · x64 · x86 · WoW64 · ARM64 SysWhispers4 是一个基于 Python 的系统调用存根生成器，可生成 C/ASM 代码，直接调用 NT 内核函数，绕过 AV/EDR 产品在 ntdll.dll 上放置的用户态挂钩。 它继承了 SysWhispers → SysWhispers2 → SysWhispers3 的演进脉络，这一版本新增了迄今最全面的 SSN 解析策略、调用方法和规避能力。 演进：SysWhispers...

PT-2026-79296

Software installed and run as a non-privileged user may conduct GPU system calls which cause GPU memory leaks and possible kernel heap corruption. Scenario caused by memory free paths not maintaining state data of upgraded higher order allocations. This could cause memory leak or double free even...

CVE-2026-49428

In FreeBSD's posixshm module, open(2) with O_TRUNC and fspacectl(2) failed to verify whether operations are permitted on largepage objects, incorrectly freeing kernel memory. An unprivileged local user can read freed kernel memory and escalate privileges. Affected: all supported versions prior to...