BLUESPAWN

BLUESPAWN Code Status Our Mission BLUESPAWN helps blue teams monitor systems in real-time against active attackers by detecting anomalous activity What is BLUESPAWN BLUESPAWN is an active defense and endpoint detection and response tool which means it can be used by defenders to quickly detect ,...

monomorph

root@kitploit: ════════════════════════════════════╦═══ ╔═╦═╗ ╔═╗ ╔═╗ ╔═╗ ╔═╦═╗ ╔═╗ ╔══╔═╗ ╠═╗ ═╩ ╩ ╩═╚═╝═╩ ╩═╚═╝═╩ ╩ ╩═╚═╝═╩ ╠═╝═╩ ╩═ ════════════════════════════════╩═══════ By Retr0id ═══ MD5-Monomorphic Shellcode Packer ═══ USAGE: python3 monomorph.py inputfile outputfile payloadfile What doe...

vxlang-page

VxLang Contents Docs What is VxLang? Supported File Formats Preview Virtualization Preview Dual-Mode Preview Obfuscation Preview Code-Flattening Preview Tutorial Usage & Guide-Code Precautions How to get the full version Donate and Subscription Patreon Link Event 2026 June Event Extension-Codes a...

grap

grap: define and match graph patterns within binaries https://github.com/QuoSecGmbH/grap grap takes patterns and binary files, uses a Casptone-based disassembler to obtain the control flow graphs from the binaries, then matches the patterns against them. Patterns are user-defined graphs with...

CrackMapExecWin

CrackMapExecWin Description The great CrackMapExec tool compiled for Windows Features Latest 2.2 version Compiled for x86 so should work on x86 and x64 platforms Usage 1. Download the whole archive 2. Extract it and run crackmapexec.exe 3. Profit Older versions Browse the release section to find...

BareMetal-RAM-Dumper

BareMetal RAM Dumper A simple x86 bare-metal tool designed to boot from a disk/USB and dump the system's RAM directly to the booting medium. It relies on BIOS interrupts to boot and perform disk operations, and enters unreal mode to access memory above the 1MB barrier. Background: Cold Boot Attac...

moneta

/ \ / | / \ / \ / \ / / \ \ / Y | \ /| | / | //| | / | / / / / / Moneta v1.0 | Forrest Orr | 2020 REQUIRED -m |region|referenced|ioc -p |PID OPTIONAL -v detail|debug|surface -d --option from-base|statistics --filter unsigned-module|clr-prvx|clr-heap|metadata-modules --address --region-size -m...

nocturne

nocturne Named after one of my favorite games, "nocturne" is a bin2bin x86-64 PE code virtualizer and binary rewriter. Features Native Call Bridge 30+ VM Handlers Built-in junk code obfuscation Thread-safe per-invocation VM state Usage To use the Nocturne virtualizer, copy and include...

plasma

PLASMA The old project name was Reverse. PLASMA is an interactive disassembler. It can generate a more readable assembly pseudo code with colored syntax. You can write scripts with the available Python api see an example below. The project is still in big development. wiki : TODO list and some...

patching

Patching - Interactive Binary Patching for IDA Pro Overview Patching assembly code to change the behavior of an existing program is not uncommon in malware analysis, software reverse engineering, and broader domains of security research. This project extends the popular IDA Pro disassembler to...

makin

I create makin to make initial malware assessment little bit easier for me, I think it's useful for others as well, It helps to reveal a debugger detection techniques used by a sample. Any feedback is greatly appreciated: @qazqaz How does it work? makin opens a sample as a debuggee and injects...

drow

drow Description TL;DR drow is a command-line utility that is used to inject code and hook the entrypoint of ELF executables post-build. It takes unmodified ELF executables as input and exports a modified ELF contianing an embedded user-supplied payload that executes at runtime. Slightly more...

gustave

c Airbus 2021, sduverger GUSTAVE - Embedded OS kernel fuzzer What is it ? GUSTAVE is a fuzzing platform for embedded OS kernels. It is based on QEMU and AFL and all of its forkserver siblings. It allows to fuzz OS kernels like simple applications. Thanks to QEMU, it is multi-platform. One can see...

cve-2016-7255_x86_x64

cve-2016-7255 x86, x64 교육 목적으로 CVE-2016-7255를 x86으로 포팅합니다. 참조 코드 https://github.com/rlarabee/exploits/tree/master/cve-2016-7255...

CVE-2019-0708

CVE-2019-0708 PoC 지금까지 x86 버전의 Windows에서만 테스트된 셸코드입니다. 책임감을 가지고 좋은 의도로만 사용하십시오...

cve-2011-3026-firefox

cve-2011-3026-firefox Black Hat 2012 발표에서 소개한, FirefoxLinux/x86에서 CVE-2011-3026을 악용하는 예제: "jemalloc 메모리 할당자 악용하기: Firefox 힙 장악하기" 원본 슬라이드 자료는 다음에서 확인할 수 있습니다: https://www.blackhat.com/html/bh-us-12/bh-us-12-archives.htmlArgyroudis 업데이트된 슬라이드 자료:...

attesor

Rosetta 2 Reverse Engineering Project Apple의 Rosetta 2 바이너리 변환 기술을 이해하고 문서화하기 위한 포괄적인 리버스 엔지니어링 프로젝트입니다. 목차 1. 배경 2. Rosetta란? 3. Rosetta 2란? 4. Apple이 macOS에서 Rosetta 2를 제공하는 방식 5. 기술 아키텍처 6. 이 프로젝트 7. 파일 구조 8. 사용 방법 9. 진행 상황 10. 참고 자료 배경 아키텍처 전환 2020년 11월, Apple은 첫 Apple Silicon Mac을 발표하며 Intel...

ghidra_stack_strings

Ghidra Stack-strings 選択されたx86/x64命令によって書き込まれたスタック文字列を検出するスクリプトで、Unicornを使用してエミュレーションします。 このスクリプトはPython 3で書かれているため、Ghidrathonが必要です。...

xed

Intel® X86 인코더 디코더 Intel® XED Doxygen API 매뉴얼 및 소스 빌드 매뉴얼: https://intelxed.github.io 버그: https://github.com/intelxed/xed/issues/new 간단한 GITHUB 빌드 지침: root@kitploit: git clone https://github.com/intelxed/xed.git xed git clone https://github.com/intelxed/mbuild.git mbuild cd xed ./mfile.py 그런 다음 o...

retoolkit

Набор инструментов реверс-инженера Что это? Это сборник инструментов, который может пригодиться, если вы интересуетесь реверс-инжинирингом и/или анализом вредоносного ПО в системах Windows x86 и x64. После установки этой программы у вас будет два способа доступа к инструментам: Дважды щелкните по...