csvl / SEMALinks
SEMA is based on angr, a symbolic execution engine used to extract API calls. Especially, we extend ANGR with strategies to create representative signatures based on System Call Dependency graph (SCDG). Those SCDGs can be exploited in machine learning modules to do classification/detection.
☆119Updated 10 months ago
Alternatives and similar repositories for SEMA
Users that are interested in SEMA are comparing it to the libraries listed below
Sorting:
- ☆85Updated 5 months ago
- ☆116Updated 3 years ago
- The MinHash-based Code Relationship & Investigation Toolkit (MCRIT) is a framework created to simplify the application of the MinHash alg…☆96Updated this week
- Dynamic-Static binary instrumentation framework on top of GDB☆50Updated 2 years ago
- Dataset of packed PE samples☆42Updated last year
- Writeups for CTF challenges☆35Updated 2 years ago
- ELF binary forensics tool for APT, virus, backdoor and rootkit detection☆50Updated last year
- How to retro theme your Ghidra☆35Updated 3 months ago
- Slides, recordings and materials of my public presentations, talks and workshops.☆81Updated 2 months ago
- A tool for firmware cartography☆162Updated last month
- ☆33Updated 2 years ago
- Powershell script deobfuscation using AST in Python☆72Updated 3 months ago
- ☆149Updated last year
- FLARE Team's Binary Navigator☆300Updated last month
- Get information about stripped rust executables☆42Updated 8 months ago
- Leveraging patch diffing to discover new vulnerabilities☆137Updated last year
- Hardening code obfuscation against automated attacks☆151Updated last year
- IDA Pro plugin for recognizing known hashes of API function names☆83Updated 3 years ago
- Static binary instrumentation for windows kernel drivers, to use with winafl☆79Updated 11 months ago
- An attempt to detect malware using Opcodes and Hexadecimal Instructions.☆32Updated 4 years ago
- Writeups, PoCs of the bugs I found while preparing for the Pwn2Own Miami 2023 contest targeting UaGateway from the OPC UA Server category…☆63Updated 2 years ago
- ☆32Updated 3 years ago
- Code for the paper "EMBERSim: A Large-Scale Databank for Boosting Similarity Search in Malware Analysis"☆38Updated 2 years ago
- Leveraging CVEs as North Stars in vulnerability discovery and comprehension.☆71Updated last year
- Notes on using the Python bindings for the Unicorn Engine☆80Updated 5 years ago
- IDA Pro plugin to aid with the analysis of native IIS modules☆21Updated last year
- ☆24Updated last year
- ☆133Updated 3 months ago
- Native Python3 bindings for @horsicq's Detect-It-Easy☆77Updated 8 months ago
- A Unit-Based Symbolic Execution Method for Detecting Heap Overflow Vulnerability in Executable Codes☆22Updated 3 years ago