hasherezade

pycdc

C++ python bytecode disassembler and decompiler

flare-floss

FLARE Obfuscated String Solver - Automatically extract obfuscated strings from malware.

CAPEv2

Malware Configuration And Payload Extraction

pefile

pefile is a Python module to read and work with PE (Portable Executable) files

Ponce

IDA 2016 plugin contest winner! Symbolic Execution just one-click away!

pocs

Proof of Concepts (PE, PDF...)

rewolf-wow64ext

Helper library for x86 programs that runs under WOW64 layer on x64 versions of Microsoft Windows operating systems.

awesome-edr-bypass

Awesome EDR Bypass Resources For Ethical Hacking

Ekko

Sleep Obfuscation

PR0CESS

some gadgets about windows process and ready to use :)

polytracker

An LLVM-based instrumentation tool for universal taint tracking, dataflow analysis, and tracing.

Hunt-Sleeping-Beacons

Aims to identify sleeping beacons

CallStackSpoofer

A PoC implementation for spoofing arbitrary call stacks when making sys calls (e.g. grabbing a handle via NtOpenProcess)

PowerLoaderEx

PowerLoaderEx - Advanced Code Injection Technique for x32 / x64

Classy

IDA Pro plugin to manage classes

HookingNirvana

Recon 2015 Presentation from Alex Ionescu

SweetDreams

Implementation of Advanced Module Stomping and Heap/Stack Encryption

C-To-Shellcode-Examples

phnt-single-header

Single header version of System Informer's phnt library.

pi-defender

Kernel Security driver used to block past, current and future process injection techniques on Windows Operating System.

FOLIAGE

Experiment on reproducing Obfuscate & Sleep

mwcfg

A Feature Rich Modular Malware Configuration Extraction Utility for MalDuck

IAT-Tracer

An automation plugin for Tiny-Tracer framework to trace and watch functions directly out of the executable's import table or trace logs (.tag) files.

yara-rules

YARA rules for use with ProcFilter

MoP

MoP - "Master of Puppets" - Advanced malware tracking framework

CCHookReloaded

A modern, mod independent open source cheat for Enemy Territory

TinyProcessor

A post-processing script for TinyTracer

talks

Repo containing my public talks

Writeups

CTF writeups

TrknHuntRthys

Specific C2 Detection Tool Written To Detect C2 Servers From Rhadamanthys Stealer Malware.