CERT-Polska / drakvufLinks
DRAKVUF Black-box Binary Analysis
☆15Updated 2 months ago
Alternatives and similar repositories for drakvuf
Users that are interested in drakvuf are comparing it to the libraries listed below
Sorting:
- The MinHash-based Code Relationship & Investigation Toolkit (MCRIT) is a framework created to simplify the application of the MinHash alg…☆96Updated 2 weeks ago
- A tool that automates regex generation for the x86 and x86-64 instruction sets☆71Updated last year
- pyGoRE - Python library for analyzing Go binaries☆66Updated 3 years ago
- Robust Automated Malware Unpacker☆87Updated 2 years ago
- A modular Karton Framework service that unpacks common packers like UPX and others using the Qiling Framework.☆58Updated 4 years ago
- ☆73Updated 2 years ago
- CERT Kaiju is a binary analysis framework extension for the Ghidra software reverse engineering suite. This repository is a "mirror" -- p…☆135Updated 2 weeks ago
- IDA Pro plugin for recognizing known hashes of API function names☆83Updated 3 years ago
- Port of the binary diffing library, diaphora, for radare2 and mariadb☆54Updated 2 years ago
- Use YARA rules on Time Travel Debugging traces☆96Updated 2 years ago
- Analyses in IDA/Hex-Rays☆84Updated 2 years ago
- Import DynamoRIO drcov code coverage data into Ghidra☆44Updated 2 years ago
- An IDA Pro extension for easier (malware) reverse engineering☆116Updated 3 years ago
- Automatically generate AV byte signatures from sets of similar binaries.☆285Updated last year
- Symbol hash for ELF files☆113Updated 3 years ago
- Parsing of YARA rules into AST and building new rulesets in C++.☆129Updated last week
- Tools for inspecting YARA bytecode☆21Updated 5 years ago
- ☆116Updated 3 years ago
- Ghidra data type archive for Windows driver analysis☆29Updated last year
- Resources for the workshop titled "Repacking the unpacker: Applying Time Travel Debugging to malware analysis", given at HackLu 2019☆42Updated 6 years ago
- Notes on using the Python bindings for the Unicorn Engine☆80Updated 5 years ago
- ☆28Updated 5 years ago
- WIP Emotet Control Flow Unflattening using miasm and radare2☆23Updated 3 years ago
- BluePill: Neutralizing Anti-Analysis Behavior in Malware Dissection (Black Hat Europe 2019, IEEE TIFS 2020)☆128Updated 4 years ago
- SEMA is based on angr, a symbolic execution engine used to extract API calls. Especially, we extend ANGR with strategies to create repr…☆119Updated 10 months ago
- Write-ups for FireEye's FLARE-On challenges☆25Updated 6 years ago
- IDA python plugin to scan binary with Yara rules☆180Updated 2 years ago
- A Ghidra extension for scripting with GraalVM languages, including Javascript, Python3, R, and Ruby.☆61Updated 4 years ago
- Bindings for Microsoft WinDBG TTD☆234Updated 2 years ago
- Ghidra plugin for https://analyze.intezer.com☆72Updated 3 years ago