saferwall / pe
A lightweight Go package to parse, analyze and extract metadata from Portable Executable (PE) binaries. Designed for malware analysis tasks and robust against PE malformations.
☆335Updated last month
Alternatives and similar repositories for pe:
Users that are interested in pe are comparing it to the libraries listed below
- Go symbol recovery tool☆642Updated 2 months ago
- IDApython Scripts for Analyzing Golang Binaries☆600Updated 5 months ago
- A command line Windows API tracing tool for Golang binaries.☆156Updated last year
- Pakkero is a binary packer written in Go made for fun and educational purpose. Its main goal is to take in input a program file (elf bina…☆254Updated 2 years ago
- GoRE - Package gore is a library for analyzing Go binaries☆468Updated last month
- A DTrace on Windows Reimplementation☆337Updated 2 months ago
- Dynamic unpacker based on PE-sieve☆688Updated last week
- Yet another variant of Process Hollowing☆356Updated 10 months ago
- x86 malware emulator☆207Updated this week
- Fork of pkg/debug that adds some additional functionality.☆120Updated 9 months ago
- Anti Virtulization, Anti Debugging, AntiVM, Anti Virtual Machine, Anti Debug, Anti Sandboxie, Anti Sandbox, VM Detect package. Windows ON…☆422Updated 4 months ago
- Donut Injector ported to pure Go. For use with https://github.com/TheWover/donut☆318Updated 2 years ago
- A way to delete a locked file, or current running executable, on disk.☆508Updated 5 months ago
- It's a go variant of Hells gate! (directly calling windows kernel functions, but from Go!)☆493Updated 2 years ago
- Universal Shared Library User-space Loader☆221Updated 2 years ago
- Golang PE injection on windows☆163Updated 3 years ago
- Assortment of hashing algorithms used in malware☆338Updated 6 months ago
- Transacted Hollowing - a PE injection technique, hybrid between ProcessHollowing and ProcessDoppelgänging☆522Updated 10 months ago
- Redress - A tool for analyzing stripped Go binaries☆973Updated last week
- Injects additional machine instructions into various binary formats.☆275Updated 11 months ago
- 🗜️ A packer for Windows x86 executable files written in C and Intel x86 Assembly. The new file after packing can obstruct reverse engine…☆335Updated 2 months ago
- SHAREM is a shellcode analysis framework, capable of emulating more than 20,000 WinAPIs and virutally all Windows syscalls. It also conta…☆350Updated 2 months ago
- Process Injection Techniques with Golang☆76Updated 4 years ago
- Signtool for expired certificates☆465Updated last year
- Exploiting DLL Hijacking by DLL Proxying Super Easily☆475Updated last year
- HWSyscalls is a new method to execute indirect syscalls using HWBP, HalosGate and a synthetic trampoline on kernel32 with HWBP.☆645Updated last year
- Native API online documentation, based on the System Informer (formerly Process Hacker) phnt headers☆190Updated this week
- Elf binary infector written in Go.☆206Updated last week
- Set of antianalysis techniques found in malware☆129Updated last year