Willi Ballenthin

python-evtx. Pure Python parser for Windows Event Log files (.evtx)

python-idb. Pure Python parser and analyzer for IDA Pro database files (.idb).

python-registry. Pure Python parser for Windows Registry hives.

INDXParse. Tool suite for inspecting NTFS artifacts.

EVTXtract. EVTXtract recovers and reconstructs fragments of EVTX log files from raw binary data, including unallocated space and memory images.

idawilli. IDA Pro resources, scripts, and configurations

shellbags. Cross-platform, open-source shellbag parser

process-forest. Reconstruct process trees from event logs

python-sdb. Pure Python parser for Application Compatibility Shim Databases (.sdb files)

lancelot. intel x86(-64) code analysis library that reconstructs control flow

python-ntfs. Open source Python library for NTFS analysis

ida-netnode. Humane API for storing and accessing persistent data in IDA Pro databases

govt. Virustotal API for Go

python-dotnet-binaryformat. Pure Python parser for data encoded by .NET's BinaryFormatter

python-evt. Pure Python parser for classic Windows Event Log files (.evt)

python-vb. analysis of visual basic code

ucutils. Convenience routines for working with the Unicorn emulator in Python

ida-settings. Fetch and set configuration values for IDA Plugins

LfLe. Recover event log entries from an image by heurisitically looking for record structures.

viv-utils. Utilities for working with vivisect

wevt_template. extract and parse WEVT_TEMPLATEs from PE files

Autopsy-WindowsRegistryContentViewer. no longer maintained

vivisect. please use https://github.com/fireeye/vivisect instead

Autopsy-WindowsRegistryIngestModule. no longer maintained

reversing-clj. messing around writing reversing tools in clojure

python-pyqt5-hexview. PyQt5 hex viewer widget.

siglib. function identification signatures

python-pyqt5-vstructui. PyQt5 vstruct hex viewer widget.

Rejistry. Pure Java parser for Windows Registry hive files.

ida-graph-exporter. Layout-preserving graph view exporter plugin for IDA Pro

dotfiles. Local configuration files for various Linux tools

vivisect-vstruct. standalone copy of vstruct from vivisect

srum-dump. A forensic tool to extract data in the Windows SRUM (System Resource Usage Monitor) database.

sleuthkit. The Sleuth Kit (TSK) is a library and collection of command line tools that allow you to investigate volume and file system data. The library can be incorporated into larger digital forensics tools and the command line tools can be directly used to find evidence.

aiwilli. Python

williballenthin.com. Source for my personal website

zydis-wasm. example project with zydis targetting wasm

cfg-ui. experiments in user interfaces around control flow graphs

flare-floss. FLARE Obfuscated String Solver - Automatically extract obfuscated strings from malware.

flare-ida. IDA Pro utilities from FLARE team

highlighter-minor-mode. An Emacs minor mode for log analysis.

Adv360-Pro-ZMK. Production repository for the all-new Advantage360 Professional using ZMK engine