crudd

malware_decoders

Static based decoders for malware samples

refinery

High Octane Triage Analysis

hem-hashes

Hiew External Module (HEM) to calculate CRC-32, MD5, SHA-1, and SHA-256 hashes of a given file/block

admarus

Peer-to-Peer Search Engine for IPFS

awesome-docker-malware-analysis

Repository of tools and resources for analyzing Docker containers

bochscpu-python

Python bindings for BochsCPU

InsightEngineering

Hardcore Debugging

shiva

A custom ELF linker/loader for installing ET_REL binary patches at runtime

netbird

Connect your devices into a secure WireGuard®-based overlay network with SSO, MFA and granular access controls.

mcrit

The MinHash-based Code Relationship & Investigation Toolkit (MCRIT) is a framework created to simplify the application of the MinHash algorithm in the context of code similarity.

hvext

The Windbg extension that implements commands helpful to study Hyper-V on Intel processors.

pwru

Packet, where are you? -- eBPF-based Linux kernel networking debugger

FuncScanner

Collects extended function properties from IDA Pro databases

gootloader

Collection of scripts used to deobfuscate GOOTLOADER malware samples.

ShellGhost

A memory-based evasion technique which makes shellcode invisible from process start to end.

BinaryNinjaImporter

WinDbg_Scripts

Useful scripts for WinDbg using the debugger data model

Decoders

Decoders from blogs and twitter posts

zmap

ZMap is a fast single packet network scanner designed for Internet-wide network surveys.

zgrab2

Fast Go Application Scanner

redlotus-rs

Rusty Bootkit - Windows UEFI Bootkit in Rust (Codename: RedLotus)

PORTALofPi

PORTAL of Pi - RaspberyPi based PORTAL device. Certified UNIX Network Technicians only!

bootOS

bootOS is a monolithic operating system in 512 bytes of x86 machine code.

egos-2000

Envision a future where every student can read all the code of a teaching operating system.

assemblyline

AssemblyLine 4: File triage and malware analysis

docker-binaryexploitation

Docker container that has all the CLI tooling for binary exploitation (thanks to @LiveOverflow)

AMAnDe

Extract, gather and analyze information from an Android Manifest file or an APK.

edb-debugger

edb is a cross-platform AArch32/x86/x86-64 debugger.

malexandria

A tool for organizing malware samples and their corresponding analyses!

docker-onion-nmap

Scan .onion hidden services with nmap using Tor, proxychains and dnsmasq in a minimal alpine Docker container.