advanced-threat-research / DotDumper
An automatic unpacker and logger for DotNet Framework targeting files
☆252Updated last year
Alternatives and similar repositories for DotDumper:
Users that are interested in DotDumper are comparing it to the libraries listed below
- The FLARE team's open-source library to disassemble Common Intermediate Language (CIL) instructions.☆163Updated 3 weeks ago
- Tools and PoCs for Windows syscall investigation.☆359Updated 2 months ago
- A simple C# executable that invokes an arbitrary method of an arbitrary C# DLL☆134Updated last year
- GarbageMan is a set of tools for analyzing .NET binaries through heap analysis.☆115Updated last year
- ☆105Updated last year
- Sysmon-Like research tool for ETW☆352Updated 2 years ago
- Unprotect is a collaborative platform dedicated to uncovering and documenting malware evasion techniques. We invite you to join us in thi…☆158Updated last month
- An automation plugin for Tiny-Tracer framework to trace and watch functions directly out of the executable's import table or trace logs (…☆114Updated 8 months ago
- Yet another variant of Process Hollowing☆384Updated 2 months ago
- SHAREM is a shellcode analysis framework, capable of emulating more than 20,000 WinAPIs and virutally all Windows syscalls. It also conta…☆387Updated last week
- masm32 kernel programming, drivers, tutorials, examples, and tools (credits Four-F)☆119Updated last year
- a PE Loader and Windows API tracer. Useful in malware analysis.☆138Updated 2 years ago
- Parse .NET executable files.☆76Updated last month
- ☆112Updated last month
- My notes while studying Windows exploitation☆186Updated last year
- Set of antianalysis techniques found in malware☆129Updated last year
- Various Process Injection Techniques☆148Updated 2 years ago
- Dynamic unpacker based on PE-sieve☆717Updated last week
- MalUnpack companion driver☆95Updated 9 months ago
- Leverage AMSI (Antimalware Scan Interface) technology to aid your analysis. This tool saves all buffers (scripts, .NET assemblies, etc) …☆108Updated 3 years ago
- ETWProcessMon2 is for Monitoring Process/Thread/Memory/Imageloads/TCPIP via ETW + Detection for Remote-Thread-Injection & Payload Detecti…☆299Updated last year
- Enumerating and removing kernel callbacks using signed vulnerable drivers☆556Updated 2 years ago
- Recon 2023 slides and code☆79Updated last year
- MSI Dump - a tool that analyzes malicious MSI installation packages, extracts files, streams, binary data and incorporates YARA scanner.☆206Updated last year
- ☆295Updated 3 years ago
- Small tool to convert beteween the PE alignments (raw and virtual).☆86Updated 2 years ago
- Exploring RPC interfaces on Windows☆320Updated last year
- A Feature Rich Modular Malware Configuration Extraction Utility for MalDuck☆127Updated last year
- Virus Exchange (VX) - Collection of malware or assembly code used for "offensive" purposed.☆180Updated 3 years ago
- HashDB API hash lookup plugin for IDA Pro☆308Updated 5 months ago