rpef

Router Post-Exploitation Framework Currently, the framework includes a number of firmware image modules: 'Verified' - This module is confirmed to work and is stable. 'Unverified' - This module is believed to work or should work with little additional effort, but awaits being tested on a physical...

disrobe

Disrobe Disrobe is a static decompiler, deobfuscator, and unpacker. It strips packing and obfuscation from compiled software one layer at a time and recovers the source code or the original bytes underneath. Give disrobe auto an executable, an app package, a script, or a firmware image. It names...

miasm

What is Miasm? Miasm is a free and open source GPLv2 reverse engineering framework. Miasm aims to analyze / modify / generate binary programs. Here is a non exhaustive list of features: Opening / modifying / generating PE / ELF 32 / 64 LE / BE Assembling / Disassembling X86 / ARM / MIPS / SH4 /...

upx-recovery-tool

upx-recovery-tool upx-recovery-tool is a script that aims to repair the most common modifications done by malware creators to ELF UPX-compressed files done to prevent their automatic unpacking with a standard UPX tool. Implemented UPX fixes / Features This tool detects and repairs the following...

CAPEv2

CAPE: Malware Configuration And Payload Extraction - Documentation CAPE is a malware sandbox. A sandbox is used to execute malicious files in an isolated environment whilst instrumenting their dynamic behaviour and collecting forensic artefacts. CAPE was derived from Cuckoo v1 which features the...

WDExtract

WDExtract Extract Windows Defender database from vdm files and unpack it This program is distributed as-is, without any warranty; No official support, if you like this tool, feel free to contribute. Features Unpack VDM containers of Windows Defender/Microsoft Security Essentials; Decrypt VDM...

pyxamstore

Xamarin AssemblyStore Explorer pyxamstore This is an alpha release of an assemblies.blob AssemblyStore parser written in Python. The tool is capable of unpack and repackaging assemblies.blob and assemblies.manifest Xamarin files from an APK. Installing Run the installer script: python setup.py...

CVE-2025-64459-Poc

CVE-2025-64459: Django ORM SQL Injection PoC Vulnerability: SQL Injection via QuerySet and Q keyword argument unpacking. CVE ID: CVE-2025-64459 Discovered By: Me Cyberstan Disclosure Date: November 5, 2025 🚨 Executive Summary This repository contains a Dockerized Proof of Concept PoC demonstratin...

flare-qdb

FireEye Labs Query-Oriented Debugger flare-qdb is a command-line and scriptable Python-based tool for evaluating and manipulating native program state. It uses Vivisect to set a breakpoint on each queried instruction and executes Python code when hit. flare-qdb frees the analyst to take a nonline...

nuitka-static-unpacker

This repository does not have a README...

Analysis-for-stage1-shellcode-loader-from-hacking-

Analysis for stage1 shellcode loader from hacking team Flowchart of code Network IoC https://172\.20\.20\.164 Mozilla/4.0 compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; MDDRJS...

archivo-syxe05-snat

SyXe'05 / Snat Reverse Engineering Archive Historical archive of reverse engineering and unpacking tutorials originally written under the aliases SyXe'05 and later Snat. The texts were originally published in various technical communities of the time, mainly within CracksLatinos , and have now be...

BlackDex

BlackDex BlackDex is an Android unpack tool, it supports Android 5.012 and need not rely to any environment. BlackDex can run on any Android mobile phone or emulator, you can unpack APK File in several seconds. Declaration This project is not directed against any encryption, it does not deal with...

Shinigami

Shinigami Shinigami is an experimental tool designed to detect and unpack malware implants that are injected via process hollowing or generic packer routines. How this works The tool operates by hooking NT functions related to Process Hollowing and marking newly executable memory pages with the...

kavanoz

🫙 kavanoz 🫙 Kavanoz jar in turkish is a tool to statically unpack common android banker malware. Do you ever wanted to get payload from packed malware without running android emulator ? Me neither : But here is a tool anyway. 👀 Installation pip install kavanoz To install from source, clone the...

unlicense

Unlicense A Python 3 tool to dynamically unpack executables protected with Themida/WinLicense 2.x and 3.x. Warning: This tool will execute the target executable. Make sure to use this tool in a VM if you're unsure about what the target executable does. Note: You need to use a 32-bit Python...

log4jhound

log4jhound Bash script that detects Log4j occurences in your projects and systems: unpacks JARs and analyzes their Manifest files, text search in source code. Usage: ./log4jhound.sh rootdirectory...

vmp2

Introduction This repository is a collection of legacy tools for working with VMProtect 2 -protected binaries. These tools enable unpacking, analysis, and experimental devirtualization of software protected with VMProtect 2. At the core of this collection is vmprofiler , a utility library that...

VMUnprotect.Dumper

VMUnprotect.Dumper VMUnprotect.Dumper is a project engaged in hunting tampered VMProtect assemblies. It makes use of AsmResolver to dynamically unpack VMP protected assembly. Works on VMProtect 3.7.0 Latest and few versions back. Before usage of VMUnprotect.Dumper After usage of VMUnprotect.Dumpe...

CVE-2026-95838

A flaw was found in containerd. When unpacking image layers with specific file configurations such as opaque whiteout markers, the unpack handler performs repeated directory traversals. An attacker can exploit this by providing a maliciously crafted container image, leading to a Denial of Service...