hasherezade

pe-sieve. Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).

pe-bear. Portable Executable reversing tool with a friendly GUI

pe_to_shellcode. Converts PE into a shellcode

hollows_hunter. Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).

malware_training_vol1. Materials for Windows Malware Analysis training (volume 1)

tiny_tracer. A Pin Tool for tracing API calls etc

libpeconv. A library to load, manipulate, dump PE files. See also: https://github.com/hasherezade/libpeconv_tpl

exe_to_dll. Converts a EXE into DLL

mal_unpack. Dynamic unpacker based on PE-sieve

dll_to_exe. Converts a DLL into EXE

demos. Demos of various injection techniques found in malware

pe-bear-releases. PE-bear (builds only)

process_ghosting. Process Ghosting - a PE injection technique, similar to Process Doppelgänging, but using a delete-pending file instead of a transacted file

bearparser. Portable Executable parsing library (from PE-bear)

process_doppelganging. My implementation of enSilo's Process Doppelganging (PE injection technique)

transacted_hollowing. Transacted Hollowing - a PE injection technique, hybrid between ProcessHollowing and ProcessDoppelgänging

ida_ifl. IFL - Interactive Functions List (plugin for IDA Pro)

process_overwriting. Yet another variant of Process Hollowing

malware_analysis. Various snippets created during malware analysis

module_overloading. A more stealthy variant of "DLL hollowing"

thread_namecalling. Process Injection using Thread Name

IAT_patcher. Persistent IAT hooking application - based on bearparser

waiting_thread_hijacking. Waiting Thread Hijacking - injection by overwriting the return address of a waiting thread

chimera_pe. ChimeraPE (a PE injector type - alternative to: RunPE, ReflectiveLoader, etc) - a template for manual loading of EXE, loading imports payload-side

persistence_demos. Demos of various (also non standard) persistence methods used by malware

masm_shc. A helper utility for creating shellcodes. Cleans MASM file generated by MSVC, gives refactoring hints.

dll_injector. A simple commandline injector using classic DLL injection

shellconv. Small tool for disassembling shellcode (using objdump)

antianalysis_demos. Set of antianalysis techniques found in malware

password_scrambler. Password scrambler - a deterministic password re-generator (alternative to a password manager)

pe_unmapper. Small tool to convert beteween the PE alignments (raw and virtual).

process_chameleon. A process overwriting its own PEB to make an illusion that it has been loaded from a different path.

funky_malware_formats. Parsers for custom malware formats ("Funky malware formats")

crypto_utils. Set of my small utils related to cryptography, encoding, decoding etc

mal_unpack_drv. MalUnpack companion driver

ViDi. ViDi Visual Disassembler (experimental)

pe2pic. Small visualizator for PE files

petya_key. A decoder for Petya victim keys, using the Janus' masterkey.

pin_n_sieve. An experimental dynamic malware unpacker based on Intel Pin and PE-sieve

paramkit. A small library helping to parse commandline parameters (for C/C++)

hidden_bee_tools. Parser for a custom executable formats from Hidden Bee and Rhadamanthys malware

petya_recovery. Application for cracking Red Petya key based on genetic algorithms.

libpeconv_tpl. A ready-made template for a project based on libpeconv.

shellc_encoder. Standalone Metasploit-like XOR encoder for shellcode

pesieve-go. Golang bindings for PE-sieve

sig_finder. Signature finder (from PE-bear)

pe_utils. A set of small utilities, helpers for PIN tracers

mal_sort. Various scripts helpful in sorting collections of malware samples.

flareon2024. Python

flareon2019. Flare-On solutions

IAT_patcher_samples. Sample libraries to be used with IAT Patcher

mal_unpack_py. Python wrappers for mal_unpack

metasploit_modules. My metasploit modules

asm16_projects. My small projects writen in 16 bit asm (NOTE: those are my practice projects that I wrote when I was 15, I give no warranty for this code!)

loaderine. A demo implementation of a well-known technique used by some malware to evade userland hooking, using my library: libpeconv.

bunitu_tests. Scripts for communication with Bunitu Trojan C&Cs

7ev3n_decoders. Decoders for 7ev3n ransomware

drawings. Some of my drawings

libpeconv_demo. Demo projects and utilities made with the help of libPeConv

SweetDreams. Implementation of Advanced Module Stomping and Heap/Stack Encryption