season-lab / bluepill
BluePill: Neutralizing Anti-Analysis Behavior in Malware Dissection (Black Hat Europe 2019, IEEE TIFS 2020)
☆125Updated 3 years ago
Alternatives and similar repositories for bluepill:
Users that are interested in bluepill are comparing it to the libraries listed below
- MemoryRanger protects kernel data and code by running drivers and hosting data in isolated kernel enclaves using VT-x and EPT features. M…☆225Updated 4 years ago
- Static unpacker for FinSpy VM☆100Updated 3 years ago
- Hyper-V Research is trendy now☆178Updated last year
- Analyses in IDA/Hex-Rays☆81Updated 2 years ago
- IDA python plugin to scan binary with Yara rules☆172Updated last year
- Parsers for custom malware formats ("Funky malware formats")☆96Updated 3 years ago
- An IDA Pro extension for easier (malware) reverse engineering☆114Updated 2 years ago
- Windbg2ida lets you dump each step in Windbg then shows these steps in IDA☆75Updated 10 months ago
- VT-based PCI device monitor (SPI)☆151Updated 4 years ago
- ☆105Updated 5 years ago
- Robust Automated Malware Unpacker☆84Updated 2 years ago
- Control-flow-flattening and string deobfuscator☆150Updated 3 years ago
- Set of antianalysis techniques found in malware☆132Updated last year
- Automatically rebuild Import Address Table for dumped PE file. With python bindings!☆119Updated 6 years ago
- Retrieve pointers to undocumented kernel functions and offsets to members within undocumented structures to use in your driver by using t…☆55Updated 5 years ago
- Hyper-V scripts☆122Updated last year
- Some research on AltSystemCallHandlers functionality in Windows 10 20H1 18999☆217Updated 5 years ago
- SMDA is a minimalist recursive disassembler library that is optimized for accurate Control Flow Graph (CFG) recovery from memory dumps.☆231Updated 3 weeks ago
- Bindings for Microsoft WinDBG TTD☆220Updated last year
- A branch-monitor-based solution for process monitoring.☆133Updated 5 years ago
- Research on Windows Kernel Executive Callback Objects☆286Updated 5 years ago
- ShowStopper is a tool for helping malware researchers explore and test anti-debug techniques or verify debugger plugins or other solution…☆205Updated 2 years ago
- Hyper-V Research is trendy now☆163Updated 2 weeks ago
- ☆226Updated 2 years ago
- Two IDAPython Scripts help you to reconstruct Microsoft COM (Component Object Model) Code☆182Updated 4 years ago
- A Windows kernel dump C++ parser library with Python 3 bindings.☆200Updated 9 months ago
- Elevation of privilege detector based on HyperPlatform☆120Updated 8 years ago
- ☆72Updated 3 years ago
- ☆19Updated 2 weeks ago
- This project aims at simplifying Windows API import recovery on arbitrary memory dumps☆249Updated 2 years ago