Daniel Plohmann

apiscout. This project aims at simplifying Windows API import recovery on arbitrary memory dumps

smda. SMDA is a minimalist recursive disassembler library that is optimized for accurate Control Flow Graph (CFG) recovery from memory dumps.

idascope. An IDA Pro extension for easier (malware) reverse engineering

mcrit. The MinHash-based Code Relationship & Investigation Toolkit (MCRIT) is a framework created to simplify the application of the MinHash algorithm in the context of code similarity.

empty_msvc. A collection of empty MSVC projects, compiled using various versions and configurations of Visual Studio.

docker-mcrit. Dockerized Setup for the MinHash-based Code Recognition & Investigation Toolkit (MCRIT)

mcrit-data. A collection of ready-to-use library code and symbols for the MinHash-based Code Relationship & Investigation Toolkit (MCRIT)

tars. The Threat Actor Rosetta Stone (TARS) is a public listing to keep track of who keeps calling which actor groups by which names.

gui-plugin-template. A template for cross-compatible GUI plugins (IDA, Ghidra, Binary Ninja, Cutter)

picblocks. JavaScript

mcrit-plugin. A plugin to use MCRIT from IDA Pro

malware_name_mapping. A mapping of used malware names to commonly known family names

lib2smda. Helper tool to use IDA Pro to convert lib files into SMDA format

yarachecker. A helper utility for processing YARA results, as used by IDAscope.

capa. The FLARE team's open-source tool to identify capabilities in executable files.

bda. Programmer De-anonymization from Binary Executables

danielplohmann.github.io. Next iteration of a personal blog.