EvilSapphire

TraceON

A x32Dbg (so far doesn't work on x64DbG) Plugin that single steps through the instructions and stops the trace at once when the Instruction pointer is outside any known DLL memory region. Can be used to detect Self injected PE/ dump out shellcode from memory. Works slower than expected.

dsync

IDAPython plugin that synchronizes disassembler and decompiler views

EvilSapphire.github.io

Build a Jekyll blog in minutes, without touching the command line.

MalwareTechniques