Duncan Ogilvie

ida-pro-mcp. AI-powered reverse engineering assistant that bridges IDA Pro with language models through MCP.

TitanHide. Hiding kernel-driver for x86/x64.

dumpulator. An easy-to-use library for emulating memory dumps. Useful for malware analysis (config extraction, unpacking) and dynamic analysis in general (sandboxing).

perfect-dll-proxy. Perfect DLL Proxying using forwards with absolute paths.

phnt-single-header. Single header version of System Informer's phnt library.

AppInitHook. Global user-mode hooking framework, based on AppInit_DLLs. The goal is to allow you to rapidly develop hooks to inject in an arbitrary process.

zig-cross. Example of using as a CMake Toolchain for cross compiling.

driver_unpacking. Ghetto user mode emulation of Windows kernel drivers.

lolbin-poc. Small PoC of using a Microsoft signed executable as a lolbin.

NtPhp. Ever wanted to execute PHP in your kernel driver? Look no further!

JitMagic. Simple tool that allows you to have multiple Just-In-Time debuggers at once.

akt. Armadillo Key Tool

RiscyWorkshop. Payload Obfuscation for Red Teams workshop materials

EfiCMake. CMake template for a basic EFI application/bootkit. This library is header-only, there is no EDK2 runtime!).

mcp-reversing-dataset. Dataset of reverse engineering tasks done using LLMs.

ArmaG3ddon. ArmaG3ddon by CondZero/ARTeam

haxxmap. Some simple go tools to perform a Man-in-the-middle (MITM) attack on your IMAP server in case you forgot your password.

user-feedback-mcp. Simple MCP Server to enable a human-in-the-loop workflow in tools like Cline and Cursor.

MiniDumpPlugin. [deprecated] Simple x64dbg plugin to save a full memory dump

idapatch. IDA plugin to patch IDA Pro in memory.

REToolSync. Collaboration platform for reverse engineering tools.

rosetta-multipass. Use Rosetta to run amd64 binaries on your M1 with Multipass.

VMProtectTest. VMProtectTest

YaraGen. Plugin for x64dbg to generate Yara rules from function basic blocks.

Diff. Diff plugin for x64dbg

FunUtils. Just some fun utilities I wrote for productivity reasons.

CEAutoAttach. Tool to automatically make Cheat Engine attach to a process via the command line.

WorkraveQt. Modern reimplementation of Workrave in Qt. Optimized to look out for you where you don't.

PatternFinder. Parallel signature matcher in C#

IATFaker. Small project to generate fake DLLs based on an executable's import table

WibuDebugHook. Injectable DLL that helps with debugging Wibu CodeMeter.

DotNetPluginCS. DotNetPluginCS based on:

binja-standalone-api. Standalone API for Binary Ninja's LLIL

CpConverter. Code Page Converter - Convert HTML/Text files to different encoding formats e.g. ANSI to UTF-8 or Unicode. Convert multiple files with 1 click. Works with all encodings.

DisableParallelLoader. Plugin for x64dbg to disable parallel loading of dependencies

cloudflare-redirect. Simple CloudFlare Worker to implement a service similar to redirect.name, but with HTTPS support.

BreakpointUnresolved. Plugin for x64dbg to break on unresolved APIs.