letenz Goto Github PK

nacos-poc

owned_alignment

Hooking kernel functions by abusing alignment

oxgenpdb

a Windows kernel Pdb parsing and downloading library that running purely in kernel mode without any R3 programs.

pdbdownloader

Standalone program to download PDB Symbol files for debugging without WDK

perses

X86 Mutation Engine with Portable Executable compatibility.

poolmonxv3

Monitor Kernel pool allocations tags

procmonxv2

Process Monitor X v2

qemu-anti-detection

A patch to hide qemu itself, bypass mhyprot,EAC,nProtect / VMProtect,VProtect, Themida, Enigma Protector,Safegine Shielden

rellume

Lift machine code to performant LLVM IR

reversekit

x64 Dynamic Reverse Engineering Toolkit

screen_capture

Cross Platform Screen Capture Library

security-study-plan

Complete Practical Study Plan to become a successful cybersecurity engineer based on roles like Pentest, AppSec, Cloud Security, DevSecOps and so on...

sliver

Adversary Emulation Framework

stackplz

基于eBPF的堆栈追踪工具

stealthy-kernelmode-injector

Manual mapper that uses PTE manipulation, Virtual Address Descriptor (VAD) manipulation, and forceful memory allocation to hide executable pages. (VAD hide / NX bit swapping)

syswhispers3

SysWhispers on Steroids - AV/EDR evasion via direct system calls.

threadstackspoofer

Thread Stack Spoofing - PoC for an advanced In-Memory evasion technique allowing to better hide injected shellcode's memory allocation from scanners and analysts.

ticklingvmprotect

Assets for the "Tickling VMProtect with LLVM" blog post.

tigress_protection

Playing with the Tigress software protection. Break some of its protections and solve their reverse engineering challenges. Automatic deobfuscation using symbolic execution, taint analysis and LLVM.

tinypdbparser

Windows PDB Parser using Imagehlp library.

tp-emulator

A basic 100 loc CPU emulator using the existing code of ntoskrnl.exe

tpm-spoofer

Simple proof of concept kernel mode driver hooking tpm.sys dispatch to randomize any public key reads

virtualizationobfuscatoranalysis

A repository of IDA Databases and Binaries used for the analysis of popular commercial virtual-machine obfuscators

vmdevirt-vtil

vmemu3

vmp2-devirtualization

vmp2.x virtualization

vmp3-import-fix

Fix VMProtect3 IAT

vmphelper

an ida plugin used to decompile vmp

vmpimportfixer

Fix VMProtect Import Protection

vmprotect

Obfuscation method using virtual machine.