Dump-GUY

Malware-analysis-and-Reverse-engineering. Some of my publicly available Malware analysis and Reverse engineering.

IDA_PHNT_TYPES. Converted phnt (Native API header files from the System Informer project) to IDA TIL, IDC (Hex-Rays).

EXE-or-DLL-or-ShellCode. Just a simple silly PoC demonstrating executable "exe" file that can be used like exe, dll or shellcode...

ConfuserEx2_String_Decryptor. ConfuserEx2 String Decryptor & Full Deobfuscation Guide

ghidra_scripts. Python

sc2pe. Simple dotnet Native AOT app that uses AsmResolver to convert shellcode to PE

Get-PDInvokeImports. Get-PDInvokeImports is tool (PowerShell module) which is able to perform automatic detection of P/Invoke, Dynamic P/Invoke and D/Invoke usage in assembly. Showing all locations from where they are referenced and Exports all to DnSpy_Bookmarks.xml

Invoke-DetectItEasy. Invoke-DetectItEasy is a wrapper for excelent tool called Detect-It-Easy. This PS module is very useful for Threat Hunting and Forensics.

Python3---Binary-Data-Manipulation. Python 3 - Manipulation and conversation with different data type (Bytes operations)

Get-UnJlaive. Get-UnJlaive is tool which is able to reconstruct Jlaive (.NET Antivirus Evasion Tool (Exe2Bat)) to original Assembly and stub Assembly.

CAPA_JsonConver. Converts exported results of CAPA tool from .json format to another formats supporting by different tools.

CrackMe-Examples. Some of CrackMes made by me :)

tiny_tracer_tag_to_cutter. Python

VoiceC2_POC. Simple POC of Voice C2 using Speech Recognition

Powershell-Tools. Collection of some easy of use tools - in powershell.

sc2elf. Simple dotnet Native AOT app that uses LibObjectFile to convert shellcode to ELF

Jlaive. .NET Antivirus Evasion Tool (Exe2Bat)

Malware_TEMP. Temp files related to MA and RE

Go_CrackMe. Little Reversing CrackMe written in GO

capa. The FLARE team's open-source tool to identify capabilities in executable files.

ghidra_scripts-1. Scripts for the Ghidra software reverse engineering suite.

de4dot-cex. 📦 de4dot deobfuscator with full support for vanilla ConfuserEx

AntiCrack-DotNet. .NET Project containing plenty of advanced techniques to detect various types of malicious actions on your software, with syscall support.

minhook. The Minimalistic x86/x64 API Hooking Library for Windows

process_overwriting. Yet another variant of Process Hollowing

.NET-Deobfuscator. Lists of .NET Deobfuscator and Unpacker (Open Source)

practical-python. Practical Python Programming (course by @dabeaz)

tiny_tracer. A Pin Tool for tracing API calls etc

de4dot. .NET deobfuscator and unpacker.

VMPImportFixer. Fix VMProtect Import Protection

SysmonTools. Utilities for Sysmon

dp701. Dark theme for IDA Pro

x64dbg---Dark-Theme. Alternative to x64dbg build in dark theme.

hollows_hunter. Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).

CrossInject. 32 bit process inject shellcode to 32 bit process and 64 bit process

apiscout. This project aims at simplifying Windows API import recovery on arbitrary memory dumps

sandbox-attacksurface-analysis-tools. Set of tools to analyze Windows sandboxes for exposed attack surface.

IDAPython-Malware-Scripts. Python

pe-sieve. Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).

EDR-Freeze. EDR-Freeze is a tool that puts a process of EDR, AntiMalware into a coma state.

signify. Module to generate and verify PE signatures

FuncScanner. Collects extended function properties from IDA Pro databases

idascope. An IDA Pro extension for easier (malware) reverse engineering

SecHex-Spoofy. C# HWID Changer 🔑︎ Disk, Guid, Mac, Gpu, Pc-Name, Win-ID, EFI, SMBIOS Spoofing [Usermode]

hrtng. IDA Pro plugin with a rich set of features: decryption, deobfuscation, patching, lib code recognition and various pseudocode transformations

ghidra-nativeaot. Ghidra .NET Native AOT Analyzer Plugin

dumbassembly. version 0.5.8

dnSpy. .NET debugger and assembly editor

SigFlip. SigFlip is a tool for patching authenticode signed PE files (exe, dll, sys ..etc) without invalidating or breaking the existing signature.

phnt-single-header. Single header version of System Informer's phnt library.

RETools. My reversing tools. Some custom, some not.