enkomio / thematrix
a PE Loader and Windows API tracer. Useful in malware analysis.
☆138Updated 2 years ago
Alternatives and similar repositories for thematrix:
Users that are interested in thematrix are comparing it to the libraries listed below
- GarbageMan is a set of tools for analyzing .NET binaries through heap analysis.☆115Updated last year
- ☆70Updated 2 years ago
- MalUnpack companion driver☆93Updated 9 months ago
- A tool that automates regex generation for the x86 and x86-64 instruction sets☆70Updated 11 months ago
- Using Microsoft Warbird to automatically unpack and execute encrypted shellcode in ClipSp.sys without triggering PatchGuard☆244Updated 2 years ago
- An automation plugin for Tiny-Tracer framework to trace and watch functions directly out of the executable's import table or trace logs (…☆114Updated 8 months ago
- ☆95Updated 3 years ago
- The FLARE team's open-source library to disassemble Common Intermediate Language (CIL) instructions.☆163Updated 2 weeks ago
- Converted phnt (Native API header files from the System Informer project) to IDA TIL, IDC (Hex-Rays).☆129Updated 6 months ago
- Recon 2023 slides and code☆79Updated last year
- Small visualizator for PE files☆67Updated last year
- Evasion Escaper is a project aimed at evading the checks that malicious software performs to detect if it's running in a virtual environm…☆105Updated last month
- Run Processes as PPL with ELAM☆154Updated 3 years ago
- A Python script to download PDB files associated with a Portable Executable (PE)☆119Updated last month
- C# Utilities for Windows Notification Facility☆131Updated 3 months ago
- Detours implementation (x64/x86) which used only ntdll import☆90Updated 9 months ago
- ☆142Updated last year
- msdocsviewer is a simple tool that parses Microsoft's win32 API and driver documentation to be used within IDA.☆149Updated last year
- A PoC designed to bypass all usermode hooks in a WoW64 environment.☆149Updated 4 years ago
- Enumerate various traits from Windows processes as an aid to threat hunting☆186Updated 3 years ago
- Static Binary Instrumentation tool for Windows x64 executables☆198Updated last month
- masm32 kernel programming, drivers, tutorials, examples, and tools (credits Four-F)☆119Updated last year
- A tool for detecting manual/direct syscalls in x86 and x64 processes using Nirvana Hooks.☆109Updated 3 years ago
- A modified RunPE (process hollowing) technique avoiding the usage of SetThreadContext by appending a TLS section which calls the original…☆95Updated 5 years ago
- Finding Truth in the Shadows☆89Updated 2 years ago
- A novel technique to communicate between threads using the standard ETHREAD structure☆110Updated 4 years ago
- Small tool to convert beteween the PE alignments (raw and virtual).☆86Updated 2 years ago
- ☆158Updated 3 years ago
- Code Injection, Inject malicious payload via pagetables pml4.☆231Updated 3 years ago
- Implementation of an export address table protection mitigation, like Export Address Filtering (EAF)☆97Updated last year