av-gantimurov

themida-unmutate

Static deobfuscator for Themida, WinLicense and Code Virtualizer 3.x's mutation-based obfuscation.

IIS-Raid

A native backdoor module for Microsoft IIS (Internet Information Services)

pikabot-deobfuscator

An IDA plugin to deobfuscate Pikabot's strings using RC4 and AES

obfus.h

Macro-header for compile-time C obfuscation (tcc, win x86/x64)

Cortex-Analyzers

Cortex Analyzers Repository

PyMuPDF

PyMuPDF is a high performance Python library for data extraction, analysis, conversion & manipulation of PDF (and other) documents.

Waybar

Highly customizable Wayland bar for Sway and Wlroots based compositors. :v: :tada:

blkmenu

Tiny curses wrapper around lsblk and udisksctl

yazi

💥 Blazing fast terminal file manager written in Rust, based on async I/O.

lumina

A Go library speaking Hex-Rays IDA lumina protocol

msdocsviewer

msdocsviewer is a simple tool that parses Microsoft's win32 API and driver documentation to be used within IDA.

msdocsviewer

msdocsviewer is a simple tool that parses Microsoft's win32 API and driver documentation to be used within IDA.

windows-driver-docs

The official Windows Driver Kit documentation sources

ida-plugins

An interactive list of plugins for hex-rays' IDA Pro

pycdc

C++ python bytecode disassembler and decompiler

010-Editor-Template

netifaces

dnfile

Parse .NET executable files.

ps3iso-utils

Windows, Linux, and macOS builds of Estwald's PS3ISO utilities

miasm

Reverse engineering framework in Python

Malware

yarka

IDA plugin for YARA signature creation

allthingsida

Repository for the code snippets from the AllThingsIDA video channel

netspy

netspy是一款快速探测内网可达网段工具（深信服深蓝实验室天威战队强力驱动）

phrank

Tool that automates some useful structure routines in IDA PRO

herast

Framework to automate working with AST in IDA Pro

Miscellaneous

Small programs and scripts that do not require their own repositories

Loki

Loki - Simple IOC and YARA Scanner

mwdb-core

Malware repository component for samples & static configuration with REST API interface.

hollows_hunter

Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).