Erwan Grelet

unlicense. Dynamic unpacker and import fixer for Themida/WinLicense 2.x and 3.x.

windiff. Tool that allows comparing symbol, type and syscall information of Microsoft Windows binaries across different versions of the OS, using a Web UI and/or LLMs.

resym. Cross-platform tool that allows browsing and extracting C and C++ type declarations from PDB files.

themida-unmutate. Static deobfuscator for Themida, WinLicense and Code Virtualizer 3.x's mutation-based obfuscation.

themida-spotter-bn. A Binary Ninja plugin to detect Themida, WinLicense and Code Virtualizer's obfuscated code locations.

cpplumber. Static analysis tool based on clang, which detects source-to-binary information leaks in C and C++ projects

triton-bn. Binary Ninja plugin that can be used to apply Triton's dead store eliminitation pass on basic blocks or functions.

Scylla. Fork of Scylla with additional fixes and Python bindings.

dll-hot-reload. Small utility DLL that loads and reloads a given DLL when it's updated on disk.

themida-unmutate-bn. A Binary Ninja plugin to deobfuscate Themida, WinLicense and Code Virtualizer 3.x's mutation-based obfuscation.

forklib. Standalone version of forklib from winnie that works on all Windows 10/11 versions.

tiny_tracer. A Pin Tool for tracing API calls etc

llvm-ebctoll. Portable and standalone utility to extract embedded LLVM bitcode from binaries compiled with -fembed-bitcode.

llvm-ebc-lddump. Fake linker plugin compatible with lld and GNU ld, which dumps the linker's command-line in a file.

Jackalope. Binary, coverage-guided fuzzer for Windows and macOS

pdb. A parser for Microsoft PDB (Program Database) debugging information

LIEF. LIEF - Library to Instrument Executable Formats