47,133 repositories indexed
1–24 of 24 · Most stars
A free, powerful, multi-purpose tool that helps you monitor system resources, debug software and detect malware. Brought to you by Winsider Seminars & Solutions, Inc. @ https://windows-internals.com
Program for determining types of files for Windows, Linux and MacOS.
Thefatrat a massive exploiting tool : Easy tool to generate backdoor and easy tool to post exploitation attack like browser attack and etc . This tool compiles a malware with popular payload and then the compiled malware can be execute on windows, android, mac . The malware that created with this tool also have an ability to bypass most AV software protection .
Exploit Development and Reverse Engineering with GDB & LLDB Made Easy
GEF (GDB Enhanced Features) - a modern experience for GDB with advanced debugging capabilities for exploit devs & reverse engineers on Linux
Public malware techniques used in the wild: Virtual Machine, Emulation, Debuggers, Sandbox detection.
Android virtual machine and deobfuscator
LKM rootkit for Linux Kernels 2.6.x-7.x (x86/x86_64 and ARM/ARM64)
DRAKVUF Black-box Binary Analysis
A Virtual Machine For Assessing Android applications, Reverse Engineering and Malware Analysis
Sandboxed Execution Environment
HaboMalHunter is a sub-project of Habo Malware Analysis System (https://habo.qq.com), which can be used for automated malware analysis and security assessment on the Linux system.
WinDBG Anti-RootKit Extension
Modular file scanning/analysis framework
Linker/Compiler/Tool detector for Windows, Linux and MacOS.
Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.
A Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.
Drltrace is a library calls tracer for Windows and Linux applications.
Limon is a sandbox developed as a research project written in python, which automatically collects, analyzes, and reports on the run time indicators of Linux malware. It allows one to inspect Linux malware before execution, during execution, and after execution (post-mortem analysis) by performing static, dynamic and memory analysis using open source tools
Yet Another Linux Virtual Machine for Mobile Application Pentesting and Mobile Malware Analysis
Zero-overhead eBPF process tracer for Linux malware triage and incident response. Traces syscalls, network, and file events per-process without strace overhead.
Cryptographic Dataset Generation & Modelling Framework
A modular Linux telemetry engine built with eBPF, libbpf CO-RE, and Modern C++ that captures kernel-level process, file, syscall, and network events through a portable event-processing pipeline for decoding, enrichment, filtering, and structured output—forming the foundation for higher-level runtime intelligence.
Advanced eBPF-driven Digital Forensics and Incident Response (DFIR) framework for live Golang malware analysis, threat hunting, and observability.