Repository Index

A collection of PowerShell modules designed for artifact gathering and reconnaisance of Windows-based endpoints.

• threat
• hunt
• red
• blue

Forensics artefact collection tool for systems running Microsoft Windows

• dfir
• incident-response
• collection

Drltrace is a library calls tracer for Windows and Linux applications.

• dbi
• malware-analysis
• malware-detection
• api-trace

Delphi Detours Library

• hooks
• detours
• x86-64
• windows

🗜️ A packer for Windows x86 executable files written in C and Intel x86 Assembly. The new file after packing can obstruct reverse engineering（使用C和Intel x86汇编开发的Windows x86可执行文件打包工具，打包后的新文件可以阻碍逆向工程）

• windows
• reverse-engineering
• security
• pe

Astral-PE is a low-level mutator (Headers/EP obfuscator) for native Windows PE files (x32/x64)

• cybersecurity
• hacktoberfest
• low-level
• mutator

The Cold Disk Quick Response (CDQR) tool is a fast and easy to use forensic artifact parsing tool that works on disk images, mounted drives and extracted artifacts from Windows, Linux, MacOS, and Android devices

Create adversarial attacks against machine learning Windows malware detectors

• adversarial-machine-learning
• infosec
• python
• attack

Minimal code to connect to a CEF debugger.

• security
• electron
• cef
• windows

Open source Windows x64 PE packer and crypter. Compresses and encrypts executables with a custom virtual machine into a self extracting stub.

• compression
• packer
• pe-packer
• pe-compress

A Highly Accessible and Automated Virtualization Platform for Security Education

• cybersecurity
• virtualization
• docker
• virtualbox

Windows Live Artifacts Acquisition Script

Toggle the iPhone call-recording announcement on/off from a Windows GUI, built on the airlift AirTraffic sandbox escape.

• airlift
• airtraffic
• ios
• sandbox-escape

simple YARA-based IOC scanner

• yara
• ioc
• security
• incident-response

Deep memory analysis for Windows processes — the tool that saves you hours of debugging

• analyzer
• binary-analysis
• delphi
• dissassembler

Incident Response Triage - Windows Evidence Collection for Forensic Analysis

windows pe packing

NTFUZZ: Enabling Type-Aware Kernel Fuzzing on Windows with Static Binary Analysis (IEEE S&P '21)

• fuzzer
• fuzzing
• kernel-fuzzer
• windows-kernel

Tool to find code cave in PE image (x86 / x64) - Find empty space to place code in PE files

• codecave
• cpp
• pe
• winapi

GoSDDL converter

• sddl
• go
• security
• windows

Hudinx is a tiny interaction SSH honeypot engineered in Python to log brute force attacks and, most importantly, the entire shell interaction performed by the attacker.

• honeypot
• engineering
• python
• attacker

Application to manage certificates on Windows.