csvl / SEMALinks
SEMA is based on angr, a symbolic execution engine used to extract API calls. Especially, we extend ANGR with strategies to create representative signatures based on System Call Dependency graph (SCDG). Those SCDGs can be exploited in machine learning modules to do classification/detection.
☆119Updated 8 months ago
Alternatives and similar repositories for SEMA
Users that are interested in SEMA are comparing it to the libraries listed below
Sorting:
- ☆83Updated 3 months ago
- ☆109Updated 2 years ago
- The MinHash-based Code Relationship & Investigation Toolkit (MCRIT) is a framework created to simplify the application of the MinHash alg…☆94Updated last week
- Slides, recordings and materials of my public presentations, talks and workshops.☆79Updated this week
- A tool for firmware cartography☆161Updated 5 months ago
- Dynamic-Static binary instrumentation framework on top of GDB☆50Updated 2 years ago
- A tool that automates regex generation for the x86 and x86-64 instruction sets☆71Updated last year
- ☆59Updated 3 months ago
- FLARE Team's Binary Navigator☆293Updated last month
- Các IDA Flirt signatures HTC tạo☆20Updated last year
- Hardening code obfuscation against automated attacks☆145Updated last year
- ☆79Updated 11 months ago
- Notes on using the Python bindings for the Unicorn Engine☆80Updated 5 years ago
- Writeups for CTF challenges☆33Updated 2 years ago
- How to retro theme your Ghidra☆35Updated last month
- Native Python3 bindings for @horsicq's Detect-It-Easy☆74Updated 6 months ago
- ELF binary forensics tool for APT, virus, backdoor and rootkit detection☆50Updated last year
- Get information about stripped rust executables☆37Updated 6 months ago
- Static Binary Instrumentation tool for Windows x64 executables☆207Updated last month
- ☆32Updated 2 years ago
- IDA Pro plugin for recognizing known hashes of API function names☆82Updated 3 years ago
- Leveraging patch diffing to discover new vulnerabilities☆136Updated last year
- IDA Pro plugin to aid with the analysis of native IIS modules☆19Updated last year
- This repository contains an IDA processor for loading and disassembling compiled yara rules.☆43Updated 10 months ago
- This IDA plugin extends the functionality of the assembly and hex view. With this plugin, you can conveniently decode/decrypt/alter data …☆85Updated 5 months ago
- A collection of ready-to-use library code and symbols for the MinHash-based Code Relationship & Investigation Toolkit (MCRIT)☆12Updated 4 months ago
- ☆133Updated last month
- Powershell script deobfuscation using AST in Python☆72Updated last month
- ☆149Updated last year
- ☆24Updated last year