reverseame / sigcheckLinks
Volatility plugin to validate Authenticode-signed processes, either with embedded signature or catalog-signed
☆21Updated 2 years ago
Alternatives and similar repositories for sigcheck
Users that are interested in sigcheck are comparing it to the libraries listed below
Sorting:
- Authenticode-parser is a simple C library for Authenticode format parsing using OpenSSL.☆21Updated last year
- Plugin for x64dbg to generate Yara rules from function basic blocks.☆37Updated 8 years ago
- Robust API monitoring system presented in the paper "Designing Robust API Monitoring Solutions" (IEEE TDSC)☆24Updated 3 years ago
- Resources for the workshop titled "Repacking the unpacker: Applying Time Travel Debugging to malware analysis", given at HackLu 2019☆42Updated 6 years ago
- An IDA plugin to deal with Event Tracing for Windows (ETW)☆55Updated 3 years ago
- Various WinDbg extensions and scripts☆31Updated 7 years ago
- A collection of empty MSVC projects, compiled using various versions and configurations of Visual Studio.☆33Updated last year
- IDARay is an IDA Pro plugin that matches the database against multiple YARA files which themselves may contain multiple rules.☆18Updated 7 years ago
- A tool to help malware analysts tell that the sample is injecting code into other process.☆79Updated 10 years ago
- [ARCHIVED] mov rax, ${Thalium/IceBox}; jmp rax;☆76Updated 6 years ago
- Adding exceptions to Microsoft's Control Flow Guard (CFG)☆57Updated 9 years ago
- VrtuleTree is a tool that displays information about driver and device objects present in the system and relations between them. Its func…☆58Updated 4 years ago
- IDAPython scripts☆15Updated 8 years ago
- Elevation of privilege detector based on HyperPlatform☆123Updated 8 years ago
- Named pipe I/O ETW provider for Windows☆71Updated 5 years ago
- Use WinDBG to trace the Windows API calls of any Portable Executable file☆32Updated 8 years ago
- Simple driver to register all available process, thread, image, Registry, and Object callbacks☆124Updated 8 years ago
- This tool is the result of a reverse engineering process of the Windows service called SysMain. Time to interact with the prefetch files …☆32Updated 5 years ago
- libemu shim layer and win32 environment for Unicorn Engine☆73Updated 8 years ago
- Yet another rule generator for Yara☆29Updated 5 months ago
- CallMon is an experimental system call monitoring tool that works on Windows 10 versions 2004+ using PsAltSystemCallHandlers☆144Updated 5 years ago
- Miscellaneous Code and Docs☆84Updated 4 months ago
- PoC for detecting and dumping code injection (built and extended on UnRunPE)☆58Updated 7 years ago
- GetHooks is a program designed for the passive detection and monitoring of hooks from a limited user account.☆61Updated 4 years ago
- WinDbg debugger extension library providing various tools to analyse, dump and fix (restore) Microsoft Portable Executable files for both…☆84Updated last year
- A driver to intercept low level windows events☆63Updated 6 years ago
- Debug Windows Application / Kernel☆91Updated 7 years ago
- Kernel Pool Monitor☆127Updated 3 years ago
- NDC Oslo 2019 slides and demos☆32Updated 5 years ago
- File system minifilter driver for Windows to block symbolic link attacks.☆52Updated 4 years ago