gkucherin / de4dot
.NET deobfuscator and unpacker (with a control flow unflattener for DoubleZero added).
☆28Updated 2 years ago
Related projects ⓘ
Alternatives and complementary repositories for de4dot
- ☆25Updated last week
- Here are some of my malware reversing papers that I will be publishing☆31Updated 2 years ago
- ☆22Updated 5 months ago
- Progress of learning kernel development☆14Updated last year
- C# implementation to produce ROR-13 numeric hash for given function API name☆31Updated 5 years ago
- IDA Python deobfuscation script for ConfuserEx binaries☆35Updated 2 years ago
- Small visualizator for PE files☆67Updated last year
- Get-PDInvokeImports is tool (PowerShell module) which is able to perform automatic detection of P/Invoke, Dynamic P/Invoke and D/Invoke u…☆51Updated 2 years ago
- Extract data of TTD trace file to a minidump☆28Updated last year
- genpatch is IDA plugin that generates a python script for patching binary☆31Updated 10 months ago
- IDA plugin to deobfuscate emotet CFF☆13Updated 2 years ago
- This x64dbg plugin allows you to upload your sample to Malcore and view the results.☆32Updated last year
- ☆28Updated last year
- Winbindex bot to pull in binaries for specific releases☆46Updated last year
- A modular Karton Framework service that unpacks common packers like UPX and others using the Qiling Framework.☆51Updated 3 years ago
- The Frida-Jit-unPacker aims at helping researchers and analysts understand the behavior of packed malicious .NET samples.☆53Updated 6 months ago
- A small tool to unmap PE memory dumps.☆11Updated last year
- A class to emulate the behavior of NtQuerySystemInformation when passed the SystemHypervisorDetailInformation information class☆24Updated last year
- ☆17Updated 2 years ago
- A Linux x86/x86-64 tool to trace registers and memory regions.☆34Updated 2 years ago
- HEVD Exploit: BufferOverflowNonPagedPoolNx on Windows 10 22H2 - Escalating from Low Integrity to SYSTEM via Aligned Chunk Confusion☆39Updated 3 months ago
- Process Injection without R/W target memory and without creating a remote thread☆19Updated 2 years ago
- ☆31Updated 2 years ago
- ☆15Updated last year
- A simple commandline application to automatically decrypt strings from Obfuscator protected binaries☆38Updated 4 months ago
- ☆18Updated 11 months ago
- ☆18Updated last year
- Slides from various conference talks☆36Updated last year
- Enabled / Disable LSA Protection via BYOVD☆62Updated 2 years ago
- A post-processing script for TinyTracer☆37Updated last year