Repository Index

An open-source user mode debugger for Windows. Optimized for reverse engineering and malware analysis.

• debugger
• windows
• x64
• disassembler

Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.

• security
• compliance
• log-analysis
• vulnerability-detection

Public malware techniques used in the wild: Virtual Machine, Emulation, Debuggers, Sandbox detection.

• anti-analysis
• anti-debugging
• anti-sandbox
• anti-vm

LIEF - Library to Instrument Executable Formats (C++, Python, Rust)

• reverse-engineering
• malware-analysis
• binary-analysis
• parser

DRAKVUF Black-box Binary Analysis

• malware-analysis
• virtualization
• xen
• introspection

WinDBG Anti-RootKit Extension

• kernel-mode
• c-plus-plus
• malware
• malware-analysis

Linker/Compiler/Tool detector for Windows, Linux and MacOS.

• detect
• reverse-engineering
• signature
• malware-analysis

A pintool in order to unpack malware

Demos of various (also non standard) persistence methods used by malware

ShowStopper is a tool for helping malware researchers explore and test anti-debug techniques or verify debugger plugins or other solutions that clash with standard anti-debug methods.

• research
• anti-debug
• malware

A SDK for the creation of analysis tools without obtaining app source code in order to profile runtime performance, examine code coverage, and track high-risk behaviors of a given app on Android 5.0 and above.

• binary-instrument
• android
• malware-research
• reverse-engineering

BluePill: Neutralizing Anti-Analysis Behavior in Malware Dissection (Black Hat Europe 2019, IEEE TIFS 2020)

• malware-analysis
• reverse-engineering
• debugger
• malware

Attack tool for altering packed samples so that they evade static packing detection

• adversarial
• attack-defense
• evasion
• executable-packing

A modular Linux telemetry engine built with eBPF, libbpf CO-RE, and Modern C++ that captures kernel-level process, file, syscall, and network events through a portable event-processing pipeline for decoding, enrichment, filtering, and structured output—forming the foundation for higher-level runtime intelligence.

• cpp20
• ebpf
• event-logger
• filesystem