Quickly debug shellcode extracted during malware analysis
☆626May 23, 2023Updated 2 years ago
Alternatives and similar repositories for BlobRunner
Users that are interested in BlobRunner are comparing it to the libraries listed below
Sorting:
- Windows kernel and user mode emulation.☆1,860Updated this week
- A Pin Tool for tracing API calls etc☆1,620Feb 8, 2026Updated 3 weeks ago
- Dynamic unpacker based on PE-sieve☆799Sep 13, 2025Updated 5 months ago
- Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-mem…☆3,562Oct 31, 2025Updated 4 months ago
- Converts PE into a shellcode☆2,745Aug 30, 2025Updated 6 months ago
- Public malware techniques used in the wild: Virtual Machine, Emulation, Debuggers, Sandbox detection.☆6,861Feb 1, 2026Updated last month
- Shellcode implementation of Reflective DLL Injection. Convert DLLs to position independent shellcode☆2,503Nov 15, 2023Updated 2 years ago
- IDA python plugin to scan binary with Yara rules☆180Jan 30, 2024Updated 2 years ago
- IFL - Interactive Functions List (plugin for IDA Pro)☆487Updated this week
- Anti-virus artifacts. Listing APIs hooked by: Avira, BitDefender, F-Secure, MalwareBytes, Norton, TrendMicro, and WebRoot.☆754Nov 16, 2021Updated 4 years ago
- Transfer EIP control to shellcode during malware analysis investigation☆77Oct 29, 2014Updated 11 years ago
- An easy-to-use library for emulating memory dumps. Useful for malware analysis (config extraction, unpacking) and dynamic analysis in gen…☆855Feb 2, 2024Updated 2 years ago
- A DTrace on Windows Reimplementation☆372Feb 3, 2026Updated last month
- ☆1,131Dec 19, 2023Updated 2 years ago
- Generates x86, x64, or AMD64+x86 position-independent shellcode that loads .NET Assemblies, PE files, and other Windows payloads from mem…☆4,470Jul 8, 2025Updated 7 months ago
- FLARE Obfuscated String Solver - Automatically extract obfuscated strings from malware.☆3,897Feb 23, 2026Updated last week
- Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks,…☆2,313Oct 31, 2025Updated 4 months ago
- ☆928Aug 14, 2025Updated 6 months ago
- Extract and Deobfuscate XLM macros (a.k.a Excel 4.0 Macros)☆585May 5, 2024Updated last year
- HashDB API hash lookup plugin for IDA Pro☆350Oct 9, 2025Updated 4 months ago
- HackSys Extreme Vulnerable Driver (HEVD) - Windows & Linux☆2,953Feb 24, 2025Updated last year
- A Binary Genetic Traits Lexer Framework☆523Updated this week
- A static analyzer for PE executables.☆1,107Feb 24, 2026Updated last week
- Reflective DLL injection is a library injection technique in which the concept of reflective programming is employed to perform the loadi…☆3,231Sep 3, 2022Updated 3 years ago
- Pinjectra is a C/C++ OOP-like library that implements Process Injection techniques (with focus on Windows 10 64-bit)☆824Mar 10, 2022Updated 3 years ago
- ☆2,168Feb 21, 2023Updated 3 years ago
- AV/EDR evasion via direct system calls.☆1,990Jan 1, 2023Updated 3 years ago
- Imaginary C2 is a python tool which aims to help in the behavioral (network) analysis of malware. Imaginary C2 hosts a HTTP server which …☆446Oct 26, 2022Updated 3 years ago
- AV/EDR evasion via direct system calls.☆1,793Sep 3, 2022Updated 3 years ago
- Assortment of hashing algorithms used in malware☆394Feb 8, 2026Updated 3 weeks ago
- Obfuscate specific windows apis with different apis☆1,023Feb 21, 2021Updated 5 years ago
- IDApython Scripts for Analyzing Golang Binaries☆665Aug 8, 2024Updated last year
- Labeless is a multipurpose IDA Pro plugin system for labels/comments synchronization with a debugger backend, with complex memory dumping…☆578Feb 23, 2026Updated last week
- IDA Pro utilities from FLARE team☆2,435Oct 29, 2024Updated last year
- DEFCON 27 workshop - Modern Debugging with WinDbg Preview☆744Nov 1, 2024Updated last year
- A VBA parser and emulation engine to analyze malicious macros.☆1,119Jul 10, 2024Updated last year
- makin - reveal anti-debugging and anti-VM tricks [This project is not maintained anymore]☆743Mar 17, 2019Updated 6 years ago
- A memory scanning evasion technique☆899May 24, 2017Updated 8 years ago
- A library to load, manipulate, dump PE files. See also: https://github.com/hasherezade/libpeconv_tpl☆1,331Oct 31, 2025Updated 4 months ago