Skip to content

Files

Latest commit

1a7445d · Dec 31, 2019

History

History
8586 lines (7205 loc) · 959 KB

Readme_full.md

File metadata and controls

8586 lines (7205 loc) · 959 KB

所有收集类项目:

ReverseEngineering

  • 跟逆向有关的资源收集。当前包括的工具个数3500+,并根据功能进行了粗糙的分类。部分工具添加了中文描述。当前包括文章数2300+。
  • 此页只包含部分内容. 查看完整版

说明

EnglishVersion

目录

TODO

  • 对工具进行更细致的分类
  • 为工具添加详细的中文描述,包括其内部实现原理和使用方式
  • 添加非Github repo
  • 补充文章
  • 修改已添加文章的描述

IDA


插件&&脚本

  • 以Github开源工具为主

新添加的

未分类

  • [1058星][17d] [Py] fireeye/flare-ida 多工具
    • StackStrings 自动恢复手动构造的字符串
    • Struct Typer implements the struct typing described here
    • ApplyCalleeType specify or choose a function type for indirect calls as described here
    • argtracker 识别函数使用的静态参数
    • idb2pat FLIRT签名生成
    • objc2_analyzer 在目标Mach-O可执行文件的与Objective-C运行时相关的部分中定义的选择器引用及其实现之间创建交叉引用
    • MSDN Annotations 从XML文件中提取MSDN信息,添加到IDB数据库中
    • ironstrings 使用代码模拟执行(flare-emu), 恢复构造的字符串
    • Shellcode Hashes 生成Hash数据库
  • [737星][7m] [Py] devttys0/ida IDA插件/脚本/模块收集
    • wpsearch 查找在MIPS WPS checksum实现中常见的立即数
    • md5hash 纯Python版的MD5 hash实现(IDA的hashlib有问题)
    • alleycat 查找向指定的函数内代码块的路径、查找两个或多个函数之间的路径、生成交互式调用图、可编程
    • codatify 定义IDA自动化分析时miss的ASCII字符串、函数、代码。将data段的所有未定义字节转换为DWORD(于是IDA可识别函数和跳转表指针)
    • fluorescence 高亮函数调用指令
    • leafblower 识别常用的POSIX函数:printf, sprintf, memcmp, strcpy等
    • localxrefs 在当前函数内部查找所有对任意选择文本的引用
    • mipslocalvars 对栈上只用于存储寄存器的变量进行命名,简化栈数据分析(MISP)
    • mipsrop 在MIPS可执行代码中搜寻ROP。查找常见的ROP
    • rizzo 对2个或多个IDB之间的函数进行识别和重命名,基于:函数签名、对唯一字符串/常量的引用、模糊签名、调用图
  • [318星][2m] [C] ohjeongwook/darungrim 软件补丁分析工具
  • [312星][1y] [C++] nevermoe/unity_metadata_loader 将global-metadata.dat中的字符串和方法/类名称加载到IDA
  • [277星][4m] [Py] jpcertcc/aa-tools 多脚本
  • [114星][1y] [Py] vallejocc/reverse-engineering-arsenal 逆向脚本收集
  • [80星][4m] [Py] takahiroharuyama/ida_haru 多工具
  • [75星][10m] [Py] secrary/ida-scripts 多脚本
    • dumpDyn 保存动态分配并执行的代码的相关信息:注释、名称、断点、函数等,之后此代码在不同基址执行时使保存内容依然可用
    • idenLib 库函数识别
    • IOCTL_decode Windows驱动的IO控制码
    • XORCheck check xor
  • [60星][2y] [Py] tmr232/idabuddy 逆向滴好盆友??
  • [59星][2y] [C++] alexhude/loadprocconfig 加载处理器配置文件
  • [59星][2m] [Py] williballenthin/idawilli IDA Pro 资源、脚本和配置文件等
    • hint_calls 以Hint的形式战士函数引用的call和字符串
    • dynamic_hints 演示如何为动态数据提供自定义hint的示例插件
    • add_segment 将已存在文件的内容添加为新的segment
    • color 对指令进行着色
    • find_ptrs 扫描.text区段查找可能为指针的值,并进行标记
    • yara_fn 创建yara规则,匹配当前函数的basic block
    • idawilli a python module that contains utilities for working with the idapython scripting interface.
    • themes colors and skins
  • [58星][20d] [Py] lich4/personal_script 010Editor/BurpSuite/Frida/IDA等多个工具的多个脚本
  • [54星][1y] [Py] zardus/idalink 使用IDA API时保证不卡界面. 在后台启动与界面脱离IDA CLI会话, 再使用RPyC连接界面
  • [52星][3y] [C++] sektioneins/wwcd Capstone支持的IDA视图
  • [51星][2y] [Py] cseagle/ida_clemency IDA cLEMENCy Tools
    • clemency_ldr IDA加载程序模块,为9位,中端,cLEMENCy可执行文件创建基本的内存布局,并处理其加载。
    • clemency_proc IDA处理器模块,处理反汇编和汇编任务
    • clemency_dump IDA插件,将修改后的数据库内容转储到打包的9位中端字节文件中
    • clemency_fix IDA plugin to assist with fixing up poorly disassembled functions that might branch/call into regions that continue to be marked as data blocks.
  • [49星][12m] [Py] agustingianni/utilities 多个IDAPython脚本
    • DumpFunctionBytes dumps the current function (you need to position the cursor on the start of the function) as a shellcode. It does a very limited analysis of the function in order to let you know that you need to fix call sites to functions
    • func_references print all the function calls to a given function. This is generally used to look for calls to malloc like function
    • arm_frequency takes as input the output of objdump on an ARM binary. It will show the ammount of times every instruction was used, sorted by the most used ones.
    • struct_hint infer what's the underlying structure used by a function. Highly heuristic. Don't trust it blindly, just try to use what it gives you and work from that.
    • string_finder Utility to find all the strings inside an ill formed IDA Database
    • simple_jack Simple Jack symbol porting tool by goose
    • renamer Rename files in a directory to its sha1 sum plus an extension.
    • prolog_finder Find potential ARM procedures prolog
    • minset Tool to calculate the minimum set of files that have approximatelly the best coverage.
    • mark_interesting Small idapython script that finds all the signed comparisions and marks them with a color.
    • machofinder Hacky script to gather all the mach-o file (and fat).
    • find_hardref Script to find hardcoded references inside an IDA database.
  • [47星][4y] [Py] jjo-sec/idataco 多功能
  • [46星][7y] [Py] carlosgprado/milf IDA瑞士军刀
    • milf 辅助漏洞挖掘
  • [42星][4y] [C++] nihilus/guid-finder 查找GUID/UUID
  • [40星][7m] [Visual Basic .NET] dzzie/re_plugins 逆向插件收集
    • IDASrvr wm_copydata IPC 服务器,通过WM_COPYDATA机制监听远程消息, 可从其他进程中想IDA发送命令,查询数据,控制接口显示
    • IDA_JScript 通过IDASrvr,使用JavaScript编写IDA脚本(依赖ActiveX)
    • IDA_JScript_w_DukDbg IDA_JScript进阶版
    • IDASrvr2 IDASrvr进阶版,添加x64支持
    • IdaUdpBridge this replaces the udp command socket in idavbscript which was crashy
    • IdaVbScript ton of small tools for IDA all thrown into one interface
    • OllySrvr wm_copydata IPC server running in olly
    • Olly_hittrace You set breakpoints in the UI and it will then run the app automating it and logging which ones were hit.
    • Olly_module_bpx allow you to set breakpoints within modules which have not yet been loaded.
    • Olly_vbscript vbscript automation capability for olly including working across breakpoint events.
    • PyIDAServer 测试在IDA中运行IPC服务器
    • Wingraph32 This is another experiment at a wingraph32 replacement for ida. This one has more features to hide nodes, and can also navigate IDA to the selected function when you click on it in the graph.
    • rabc_gui this is a GUI front end for RABCDAsm to disasm, reasm, and reinsert modified script blocks back into flash files.
    • swfdump_gui when run against a target swf, it will create a decompressed version of the swf and a .txt disasm log file these files will be cached and used on subsequent loads. if you wish to start over from scratch use the tools->delete cached * options.
    • gleegraph a quick Wingraph32/qwingraph replacement that has some extra features such as being able to navigate IDA to the selected nodes when they are clicked on in graph view, as well as being able to rename the selected node from the graph, or adding a prefix to all child nodes below it.
    • hidden_strings scans for strings being build up in char arrays at runtime to hide from traditional strings output
    • memdump_conglomerate reads a folder full of memory dumps and puts them all into a single dll husk so they will disassemble at the proper offsets.
    • memdump_embedder takes a memory dump and embeds it into a dummy dll husk so that you can disassemble it at the target base address without having to manually reset it everytime
    • rtf_hexconvert small tool to extract hex strings from a rtf document and show them in a listview. click on listitem to see decoded data in a hexeditor pane where you can save it
    • uGrapher rename real wingraph32.exe to _wingraph.exe and put this one in its place.
    • wininet_hooks Hook以下API调用并记录关键信息:HttpOpenRequest,InternetConnect,InternetReadFile,InternetCrackUrl,HttpSendRequest
  • [40星][2y] [Py] mxmssh/idametrics 收集x86体系结构的二进制可执行文件的静态软件复杂性度量
  • [38星][2y] [Py] saelo/ida_scripts 多脚本
    • kernelcache 识别并重命名iOS kernelcache函数stub。ARM64 Only
    • ssdt 解析Windows内核中的syscall表
  • [34星][4y] [Py] madsc13ntist/idapython IDAPython脚本收集(无文档)
  • [32星][5y] [Py] iphelix/ida-pomidor 在长时间的逆向中保存注意力和效率
  • [28星][1y] [Py] xyzz/vita-ida-physdump help with physical memory dump reversing
  • [27星][1y] [Py] daniel_plohmann/simplifire.idascope 简化恶意代码分析
  • [27星][6m] [Py] enovella/re-scripts IDA/Ghidra/Radare2脚本收集(无文档)
  • [26星][5y] [Py] bastkerg/recomp IDA recompiler(无文档)
  • [26星][8m] [C++] offlinej/ida-rpc Discord rich presence plugin for IDA Pro 7.0
  • [25星][3y] [Py] zyantific/continuum Plugin adding multi-binary project support to IDA Pro (WIP)
  • [23星][3m] [Py] rceninja/re-scripts
  • [23星][10m] [C++] trojancyborg/ida_jni_rename IDA JNI clal rename
  • [22星][5y] [Py] nihilus/idascope 辅助恶意代码逆向(Bitbucket上的代码较新)
  • [22星][4m] [Py] nlitsme/idascripts 枚举多种类型数据:Texts/NonFuncs/...
  • [22星][4y] [Py] onethawt/idapyscripts IDAPython脚本
  • [22星][3y] [C++] patois/idaplugins Random IDA scripts, plugins, example code (some of it may be old and not working anymore)
  • [20星][1y] [Py] hyuunnn/ida_python_scripts IDAPython脚本
  • [20星][2y] [C#] zoebear/radia 创建一个用于可视化代码的交互式、沉浸式环境,辅助二进制文件逆向
  • [20星][3y] [Py] ztrix/idascript Full functional idascript with stdin/stdout handled
  • [20星][1y] [Py] hyuunnn/ida_python_scripts ida python scripts
  • [20星][2m] [Py] mephi42/ida-kallsyms (No Doc)
  • [19星][1y] [Py] a1ext/ida-embed-arch-disasm 使IDA可在32位数据库中反汇编x64代码(WOW64)
  • [19星][9m] [Py] yellowbyte/reverse-engineering-playground 逆向脚本收集,包括:IDAPython、文件分析、文件格式分析、文件系统分析、Shellcode分析
    • idapython-scripts
    • IDA-ARMdetect Identifies all sections in a ARM binary that is setting up (writing to) a pin, reading a pin (using the pin as input pin), or interfacing with other devices on the board using I2C
    • IDA-CCCheck The 0xCC byte is the byte representing int 3, or software breakpoint. When you make a software breakpoint on an instruction, the debugger replaces the first byte of the instruction to 0xCC.
    • IDA-Deobfuscate directly patch the bytes in IDA so IDA will show the correct deobfuscated listing rather than writing the deobfuscated listing to a separate file
    • IDA-FindMain automatically find and rename main as "main" and then move cursor position in IDA's disassembly listing to beginning of main.(In a stripped ELF executable, IDA will not be able to identify main)
    • IDA-intCheck Interrupts are either generated by external sources, such as I/O devices, or by processor-detected exceptions in the running code
    • IDA-JccFlip Changes a jcc instruction to its opposite representation.
    • IDA-LocFuncAnalyzer In a stripped ELF binary, local functions are deprived of its original name. This is why local functions are not usually the starting point when doing analysis since without its original name, all local functions look exactly the same as one another. This script aims to change that
    • IDA-MalCheck Checks an executable for usage of API that has a high chance of being used maliciously or for anti-reversing purposes such as IsDebuggerPresent
    • IDA-NopSled Either convert the instructions that user select/highlight or the instruction that the mouse cursor is on to NOPs
    • IDA-RdtscCheck rdtsc instruction puts the number of ticks since the last system reboot in EDX:EAX
    • file_format_hacks File Format Hacks
    • file_analysis
    • shellcode_analysis Shellcode Analysis
  • [17星][1y] [Py] honeybadger1613/etm_displayer IDA Pro плагин для отображения результата Coresight ETM трассировки perf'а
  • [16星][5y] fabi/idacsharp C# 'Scripts' for IDA 6.6+ based on
  • [15星][8m] [CMake] google/idaidle 如果用户将实例闲置时间过长,则会警告用户。在预定的空闲时间后,该插件首先发出警告,然后再保存当前的disassemlby数据库并关闭IDA
  • [14星][4y] [C++] nihilus/fast_idb2sig_and_loadmap_ida_plugins 2个插件
    • LoadMap An IDA plugin, which loads a VC/Borland/Dede map file into IDA 4.5
    • idb2sig
  • [13星][2y] [Py] cisco-talos/pdata_check 根据pdata节和运行时函数的最后一条指令识别异常运行时。
  • [13星][1y] [C++] nihilus/graphslick IDA Plugin - GraphSlick
  • [13星][1y] [Py] cxm95/ida_wrapper An IDA_Wrapper for linux, shipped with an Function Identifier. It works well with Driller on static linked binaries.
  • [12星][1y] [Assembly] gabrielravier/cave-story-decompilation 使用IDA反编译的游戏洞窟物語(Cave Story)
  • [11星][2y] [Py] 0xddaa/iddaa idapython scripts
  • [11星][5y] [Py] dshikashio/idarest Expose some basic IDA Pro interactions through a REST API for JSONP
  • [11星][10m] [C++] ecx86/ida7-supportlib IDA-SupportLib library by sirmabus, ported to IDA 7
  • [10星][4y] [C++] revel8n/spu3dbg 调试anergistic SPU emulator
  • [9星][4y] [Py] nfarrar/ida-colorschemes A .clr colorscheme generator for IDA Pro 6.4+.
  • [9星][2m] [C++] nlitsme/idcinternals 研究IDC脚本的内部表现形式
  • [9星][5y] [Ruby] rogwfu/plympton Library to work with yaml exported IDA Pro information and run statistics
  • [9星][9m] [Py] 0xcpu/relieve 逆向/恶意代码分析脚本
    • elfie display (basic) info about an ELF, similar to readelf.
    • elforensics check ELF for entry point hooks, RWX sections, CTORS & GOT & PLT hooks, function prologue trampolines.
    • dololi unfinished, the idea is to automatically generate an executable that calls exports from DLL(s).
  • [8星][5y] [Py] daniel_plohmann/idapatchwork Stitching against malware families with IDA Pro
  • [8星][2y] [C++] ecx86/ida7-segmentselect IDA-SegmentSelect library by sirmabus, ported to IDA 7
  • [8星][2y] [Py] fireundubh/ida7-alleycat Alleycat plugin by devttys0, ported to IDA 7
  • [8星][2m] [Py] lanhikari22/gba-ida-pseudo-terminal IDAPython tools to aid with analysis, disassembly and data extraction using IDA python commands, tailored for the GBA architecture at some parts
  • [8星][3y] [Py] pwnslinger/ibt IDA Pro Back Tracer - Initial project toward automatic customized protocols structure extraction
  • [8星][2y] [C++] shazar14/idadump An IDA Pro script to verify binaries found in a sample and write them to disk
  • [7星][2y] [Py] swackhamer/ida_scripts IDAPython脚本(无文档)
  • [7星][10m] [Py] techbliss/ida_pro_http_ip_geolocator IDA 插件,查找网址并解析为 ip,通过Google 地图查看
  • [7星][5y] [Py] techbliss/processor-changer 修改处理器(需重新打开IDA)
  • [7星][1y] [C++] tenable/mida 提取RPC接口,重新创建关联的IDL文件
  • [7星][1y] [C++] ecx86/ida7-hexrays-invertif Hex-Rays Invert if statement plugin for IDA 7.0
  • [6星][2y] [CMake] elemecca/cmake-ida 使用CMake构建IDA Pro模块
  • [6星][9m] [Py] geosn0w/dumpanywhere64 An IDA (Interactive Disassembler) script that can save a chunk of binary from an address.
  • [5星][3y] [Py] andreafioraldi/idavshelp 在IDA中集成VS的帮助查看器
  • [5星][5m] [Py] fdiskyou/ida-plugins IDAPython脚本(无文档)
  • [5星][3y] [Py] gh0st3rs/idassldump IDAPython脚本, 将SSL流量转储到文件
  • [5星][1y] [C++] lab313ru/m68k_fixer IDA Pro plugin fixer for m68k
  • [5星][5y] [C#] npetrovski/ida-smartpatcher IDA apply patch GUI
  • [5星][4y] [Py] tmr232/tarkus Plugin Manager for IDA Pro
  • [5星][2y] abarbatei/ida-utils links, information and helper scripts for IDA Pro
  • [4星][3m] [Py] gitmirar/idaextapi IDA API utlitites
  • [4星][3y] [Py] hustlelabs/joseph IDA Viewer Plugins
  • [4星][1y] savagedd/samp-server-idb
  • [4星][3m] [Py] spigwitmer/golang_struct_builder IDA 7.0+ script that auto-generates structs and interfaces from runtime metadata found in golang binaries
  • [3星][10m] [Py] gdataadvancedanalytics/ida-python Random assembly of IDA Python scripts
    • defineIAT written for the Trickbot sample with sha256 8F590AC32A7C7C0DDFBFA7A70E33EC0EE6EB8D88846DEFBDA6144FADCC23663A
    • stringDecryption written for the Trickbot sample with sha256 8F590AC32A7C7C0DDFBFA7A70E33EC0EE6EB8D88846DEFBDA6144FADCC23663A
  • [3星][5y] [C++] nihilus/ida-x86emu x86模拟执行
  • [3星][2y] [Py] ypcrts/ida-pro-segments It's very hard to load multiple files in the IDA GUI without it exploding. This makes it easy.
  • [2星][2y] [C++] ecx86/ida7-oggplayer IDA-OggPlayer library by sirmabus, ported to IDA 7
  • [2星][2y] [Py] mayl8822/ida 快速执行谷歌/百度/Bing搜索
  • [2星][4y] [Py] nihilus/idapatchwork Stitching against malware families with IDA Pro
  • [2星][2y] [Py] sbouber/idaplugins
  • [2星][2m] [Py] psxvoid/idapython-debugging-dynamic-enrichment
  • [1星][2y] [Py] andreafioraldi/idamsdnhelp 打开MSDN帮助搜索页
  • [1星][1y] [Py] farzonl/idapropluginlab4 An ida pro plugin that tracks def use chains of a given x86 binary.
  • [1星][3m] [Py] voidsec/ida-helpers Collection of IDA helpers
  • [0星][3y] [Py] kcufid/my_ida_python My idapython decode data
  • [0星][1y] [Py] ruipin/idapy Various IDAPython libraries and scripts
  • [0星][9m] [Py] tkmru/idapython-scripts IDAPro scripts

结构体&&类的检测&&创建&&恢复

未分类

C++类&&虚表

收集

外观&&主题

固件&&嵌入式设备

签名(FLIRT等)&&比较(Diff)&&匹配

未分类

FLIRT签名

FLIRT签名收集
FLIRT签名生成

Diff&&Match工具

Yara

IDB操作

协作逆向&&多人操作相同IDB文件

  • [508星][11m] [Py] idarlingteam/idarling 多人协作插件
  • [258星][1y] [C++] dga-mi-ssi/yaco 利用Git版本控制,同步多人对相同二进制文件的修改
  • [88星][5y] [Py] cubicalabs/idasynergy 集成了版本控制系统(svn)的IDA插件
  • [71星][2m] [C++] cseagle/collabreate Hook IDA的事件通知,将事件涉及的修改内容广播到中心服务器,中心服务器转发给其他分析相同文件的用户
  • [4星][2y] [Py] argussecurity/psida IDAPython脚本收集,当前只有协作逆向的脚本

与调试器同步&&通信&&交互

导入导出&与其他工具交互

未分类

Ghidra

BinNavi

BinaryNinja

Radare2

Frida

IntelPin

针对特定分析目标

未分类

Loader&Processor

GoLang

Windows驱动

PS3&&PS4

PDB

Flash&&SWF

特定样本家族

CTF

IDAPython本身

未分类

清单

指令参考&文档

辅助脚本编写

未分类

Qt

控制台&&窗口界面

插件模板

其他语言

古老的

调试&&动态运行&动态数据

未分类

DBI数据

调试数据

  • [607星][3m] [Py] 0xgalz/virtuailor 利用IDA调试获取的信息,自动创建C++的虚表

    • 重复区段: IDA->插件->结构体->C++类 |

      查看详情

      静态部分:

      • 检测非直接调用
      • 利用条件断点, Hook非直接调用的值赋值过程

      动态 部分

      • 创建虚表结构
      • 重命名函数和虚表地址
      • 给反汇编非直接调用添加结构偏移
      • 给非直接调用到虚表之间添加交叉引用

      使用

      • File -> Script File -> Main.py(设置断点) -> IDA调试器执行
  • [386星][5m] [Py] ynvb/die 使用IDA调试器收集动态运行信息, 辅助静态分析

  • [380星][4y] [Py] deresz/funcap 使用IDA调试时记录动态信息, 辅助静态分析

  • [104星][3y] [Py] c0demap/codemap Hook IDA,调试命中断点时将寄存器/内存信息保存到数据库,在web浏览器中查看

反编译器&&AST

反混淆

效率&&导航&&快速访问&&图形&&图像&&可视化

其他

显示增强

图形&&图像

  • [2569星][6m] [Java] google/binnavi 二进制分析IDE, 对反汇编代码的控制流程图和调用图进行探查/导航/编辑/注释.(IDA插件的作用是导出反汇编)
  • [231星][2y] [C++] fireeye/simplifygraph 复杂graphs的简化
  • [40星][9m] [Py] rr-/ida-images 图像预览插件,辅助查找图像解码函数(运行复杂代码,查看内存中是否存在图像)

搜索

Android

Apple&&macOS&&iXxx&&Objective-C&&SWift&&Mach-O

未分类

内核缓存

Mach-O

  • [47星][8m] [C] gdbinit/extractmacho IDA plugin to extract Mach-O binaries located in the disassembly or data
  • [18星][3y] [C] cocoahuke/iosdumpkernelfix This tool will help to fix the Mach-O header of iOS kernel which dump from the memory. So that IDA or function symbol-related tools can loaded function symbols of ios kernel correctly
  • [17星][8y] [C] gdbinit/machoplugin IDA plugin to Display Mach-O headers

Swift

ELF

Microcode

模拟器集成

作为辅助&&构成其他的一环

  • [1542星][28d] [Py] lifting-bits/mcsema 将x86, amd64, aarch64二进制文件转换成LLVM字节码
    • IDA7插件 用于反汇编二进制文件并生成控制流程图
    • IDA插件 用于反汇编二进制文件并生成控制流程图
    • Binja插件 用于反汇编二进制文件并生成控制流程图
    • mcsema
  • [421星][1m] [C] mcgill-dmas/kam1n0-community 汇编代码管理与分析平台(独立工具+IDA插件)
  • [27星][4y] [Scheme] yifanlu/cgen CGEN的Fork,增加了生成IDA IDP模块的支持
  • [23星][2y] [Py] tintinweb/unbox Unbox is a convenient one-click unpack and decompiler tool that wraps existing 3rd party applications like IDA Pro, JD-Cli, Dex2Src, and others to provide a convenient archiver liker command line interfaces to unpack and decompile various types of files

漏洞

未分类

ROP

补丁&&Patch

其他

函数相关

未分类

重命名&&前缀&&标记

导航&&查看&&查找

demangle

污点分析&&符号执行

字符串

加密解密


文章

新添加的

未分类

Tips&&Tricks

系列文章-Labeless插件介绍

系列文章-使用IDA从零开始学逆向

系列文章-IDAPython-让你的生活更美好

原文

译文

系列文章-使用IDA逆向C代码

工具&&插件&&脚本介绍

未分类

Loader&&Processor

与其他工具交互

翻译-TheIDAProBook

翻译-ReverseEngineeringCodeWithIDAPro

IDA本身

逆向实战

未分类

恶意代码分析

漏洞分析&&挖掘

Microcode

IDA对抗

Ghidra


插件&&脚本

Ghidra

新添加的

特定分析目标

未分类

Loader&&Processor

Xbox

与其他工具交互

未分类

Radare2

IDA

DBI

调试器

外观&&主题

脚本编写

其他

编程语言


文章&&视频

新添加的1

新添加的

Ghidra漏洞

实战分析

未分类

漏洞分析&&挖掘

恶意代码

其他

Tips&&Tricks

工具&&插件&&脚本

x64dbg


插件&&脚本

x64dbg

  • [34576星][1m] [C++] x64dbg/x64dbg Windows平台x32/x64调试器

新添加的


文章&&视频

OllyDbg


插件&&脚本

新添加的


文章&&视频

WinDBG


插件&&脚本

新添加的


文章&&视频

Android


工具

新添加的1

新添加的

HotFix

  • [14557星][13d] [Java] tencent/tinker Tinker is a hot-fix solution library for Android, it supports dex, library and resources update without reinstall apk.
  • [6684星][3y] [C++] alibaba/andfix AndFix is a library that offer hot-fix for Android App.
  • [3462星][27d] [Java] meituan-dianping/robust Robust is an Android HotFix solution with high compatibility and high stability. Robust can fix bugs immediately without a reboot.
  • [1117星][6m] [Java] manbanggroup/phantom 唯一零 Hook 稳定占坑类 Android 热更新插件化方案

打包

  • [5080星][2m] [Java] meituan-dianping/walle Android Signature V2 Scheme签名下的新一代渠道包打包神器

收集

各类App

Xposed

  • [8756星][2m] [Java] android-hacker/virtualxposed A simple app to use Xposed without root, unlock the bootloader or modify system image, etc.
  • [2559星][7m] taichi-framework/taichi A framework to use Xposed module with or without Root/Unlock bootloader, supportting Android 5.0 ~ 10.0
  • [2034星][12d] [Java] elderdrivers/edxposed Elder driver Xposed Framework.
  • [1726星][1y] [Java] ac-pm/inspeckage Android Package Inspector - dynamic analysis with api hooks, start unexported activities and more. (Xposed Module)
  • [1655星][2m] [Java] tiann/epic Dynamic java method AOP hook for Android(continution of Dexposed on ART), Supporting 4.0~10.0
  • [1494星][2y] [Kotlin] gh0u1l5/wechatmagician WechatMagician is a Xposed module written in Kotlin, that allows you to completely control your Wechat.
  • [1296星][2m] [Java] android-hacker/exposed A library to use Xposed without root or recovery(or modify system image etc..).
  • [839星][5y] halfkiss/zjdroid 基于Xposed Framewrok的动态逆向分析模块
  • [790星][8m] [Java] blankeer/mdwechat 一个能让微信 Material Design 化的 Xposed 模块
  • [669星][12d] [Java] ganyao114/sandhook Android ART Hook/Native Inline Hook/Single Instruction Hook - support 4.4 - 10.0 32/64 bit - Xposed API Compat
  • [478星][2m] [Java] tornaco/x-apm 应用管理 Xposed
  • [424星][3y] [Makefile] mindmac/androideagleeye An Xposed and adbi based module which is capable of hooking both Java and Native methods targeting Android OS.
  • [322星][1y] [C] smartdone/dexdump 一个用来快速脱一代壳的工具(稍微改下就可以脱类抽取那种壳)(Android)
  • [309星][1m] bigsinger/androididchanger Xposed Module for Changing Android Device Info
  • [309星][13d] [Java] ganyao114/sandvxposed Xposed environment without root (OS 5.0 - 10.0)
  • [283星][2y] [C++] rovo89/android_art Android ART with modifications for the Xposed framework.
  • [214星][1y] [Kotlin] paphonb/androidp-ify [Xposed] Use features introduced in Android P on your O+ Device!
  • [204星][1y] [C] gtoad/android_inline_hook Build an so file to automatically do the android_native_hook work. Supports thumb-2/arm32 and ARM64 ! With this, tools like Xposed can do android native hook.
  • [127星][2y] [Java] bmax121/budhook An Android hook framework written like Xposed,based on YAHFA.
  • [120星][3y] [Java] rastapasta/pokemon-go-xposed
  • [79星][4m] [Go] tillson/git-hound GitHound pinpoints exposed API keys on GitHub using pattern matching, commit history searching, and a unique result scoring system. A batch-catching, pattern-matching, patch-attacking secret snatcher.
  • [71星][1m] [Java] lianglixin/sandvxposed Xposed environment without root (OS 5.0 - 10.0)
  • [64星][10m] [FreeMarker] dvdandroid/xposedmoduletemplate Easily create a Xposed Module with Android Studio
  • [64星][8d] uniking/dingding 免root远程钉钉打卡,支持wifi和gps定位,仅支持android系统。本项目出于学习目的,仅用于学习玩耍,请于24小时后自行删除。xposed, crack,package,dingtalk,remote control
  • [49星][11m] [Py] hrkfdn/deckard Deckard performs static and dynamic binary analysis on Android APKs to extract Xposed hooks
  • [38星][10m] [Java] egguncle/xposednavigationbar Xposed导航栏功能拓展模块
  • [36星][8m] [Py] anantshri/ds_store_crawler_parser a parser + crawler for .DS_Store files exposed publically
  • [34星][5y] [Java] wooyundota/intentmonitor Tool based xposed can monitor the android intents
  • [28星][5y] [Java] mindmac/xposedautomation A demo to show how to install Xposed and enable Xposed based module automatically
  • [26星][5y] [Java] twilightgod/malwarebuster This is a Xposed module. It helps to prevent malwares to register service/receiver which were disabled in My Android Tools before.

加壳&&脱壳

  • [1793星][8m] [C++] wrbug/dumpdex Android脱壳
  • [1620星][3y] [Makefile] drizzlerisk/drizzledumper 是一款基于内存搜索的Android脱壳工具。
  • [1465星][3m] [C++] vaibhavpandeyvpz/apkstudio Open-source, cross platform Qt based IDE for reverse-engineering Android application packages.
  • [1036星][3y] [C++] zyq8709/dexhunter General Automatic Unpacking Tool for Android Dex Files
  • [811星][4m] [C] strazzere/android-unpacker Android Unpacker presented at Defcon 22: Android Hacker Protection Level 0
  • [712星][2m] [YARA] rednaga/apkid Android Application Identifier for Packers, Protectors, Obfuscators and Oddities - PEiD for Android
  • [366星][3m] [Java] patrickfav/uber-apk-signer A cli tool that helps signing and zip aligning single or multiple Android application packages (APKs) with either debug or provided release certificates. It supports v1, v2 and v3 Android signing scheme has an embedded debug keystore and auto verifies after signing.
  • [322星][6m] [Shell] 1n3/reverseapk Quickly analyze and reverse engineer Android packages
  • [298星][2y] [Shell] checkpointsw/android_unpacker A (hopefully) generic unpacker for packed Android apps.
  • [189星][3y] [Py] drizzlerisk/tunpacker TUnpacker是一款Android脱壳工具
  • [187星][3y] [Py] andy10101/apkdetecter Android Apk查壳工具及源代码
  • [148星][3y] [Py] drizzlerisk/bunpacker BUnpacker是一款Android脱壳工具
  • [105星][4y] [Java] liuyufei/sslkiller SSLKiller is used for killing SSL verification functions on Android client side. With SSLKiller, You can intercept app's HTTPS communication packages between the client and server.
  • [104星][3y] [Java] cvvt/apptroy An Online Analysis System for Packed Android Malware
  • [89星][2y] [ObjC] wooyundota/dumpdex Android Unpack tool based on Cydia
  • [68星][5y] [Py] ajinabraham/xenotix-apk-reverser Xenotix APK Reverser is an OpenSource Android Application Package (APK) decompiler and disassembler powered by dex2jar, baksmali and jd-core.
  • [30星][8m] [Java] cristianturetta/mad-spy We developed a malware for educational purposes. In particular, our goal is to provide a PoC of what is known as a Repacking attack, a known technique widely used by malware cybercrooks to trojanize android apps. The answer to solve this particular goal boils down in the simplicity of APK decompiling and smali code injection.
  • [22星][13d] [Py] botherder/snoopdroid Extract packages from an Android device
  • [10星][2y] [Shell] nickdiego/docker-ollvm Easily build and package Obfuscator-LLVM into Android NDK.

HOOK

Emulator&&模拟器

  • [1492星][1y] [C++] f1xpl/openauto AndroidAuto headunit emulator
  • [532星][7m] [Java] limboemu/limbo Limbo is a QEMU-based emulator for Android. It currently supports PC & ARM emulation for Intel x86 and ARM architecture. See our wiki
  • [471星][3m] [Java] strazzere/anti-emulator Android Anti-Emulator
  • [428星][2y] [Py] evilsocket/smali_emulator This software will emulate a smali source file generated by apktool.
  • [202星][3y] [Py] mseclab/nathan Android Emulator for mobile security testing
  • [168星][12m] [Py] mnkgrover08-zz/whatsapp_automation Whatsapp Automation is a collection of APIs that interact with WhatsApp messenger running in an Android emulator, allowing developers to build projects that automate sending and receiving messages, adding new contacts and broadcasting messages multiple contacts.
  • [148星][5y] [C] strazzere/android-lkms Android Loadable Kernel Modules - mostly used for reversing and debugging on controlled systems/emulators
  • [27星][2y] [Shell] gustavosotnas/avd-launcher Front-end to Android Virtual Devices (AVDs) emulator from Google.
  • [16星][1y] [Py] abhi-r3v0/droxes A simple script to turn an Android device/emulator into a test-ready box.

IDA

Debug&&调试

  • [10794星][1m] [Java] konloch/bytecode-viewer A Java 8+ Jar & Android APK Reverse Engineering Suite (Decompiler, Editor, Debugger & More)
  • [6762星][10m] [Java] amitshekhariitbhu/android-debug-database A library for debugging android databases and shared preferences - Make Debugging Great Again
  • [527星][5y] [Py] swdunlop/andbug Android Debugging Library
  • [468星][7y] [Shell] kosborn/p2p-adb Phone to Phone Android Debug Bridge - A project for "debugging" phones... from other phones.
  • [123星][3y] [C++] cheetahsec/avmdbg a lightweight debugger for android virtual machine.
  • [106星][6y] [Java] isecpartners/android-opendebug Make any application debuggable
  • [98星][4y] [Py] cx9527/strongdb gdb plugin for android debugging
  • [65星][6y] [Py] anbc/andbug Android Debugging Library
  • [57星][3y] [C] gnaixx/anti-debug Android detect debugger
  • [56星][5m] [Shell] wuseman/wbruter Crack your non-rooted android device pin code with 100% guarantee aslong as usb debugging has been enable. Wbruter also has support for parallel ssh brute forcing via pssh
  • [22星][1y] [C++] gtoad/android_anti_debug An example of android anti-debug.

Malware&&恶意代码

Obfuscate&&混淆

ReverseEngineering


文章&&视频

Apple&&iOS&&iXxx


Mach-O

工具

  • [2540星][10m] [ObjC] nygard/class-dump Generate Objective-C headers from Mach-O files.
  • [2389星][2y] [Py] secretsquirrel/the-backdoor-factory 为PE, ELF, Mach-O二进制文件添加Shellcode后门
  • [2140星][2m] [Py] jonathansalwan/ropgadget This tool lets you search your gadgets on your binaries to facilitate your ROP exploitation. ROPgadget supports ELF, PE and Mach-O format on x86, x64, ARM, ARM64, PowerPC, SPARC and MIPS architectures.
  • [1471星][3y] [ObjC] polidea/ios-class-guard Simple Objective-C obfuscator for Mach-O executables.
  • [856星][3y] [C++] 0vercl0k/rp rp++ is a full-cpp written tool that aims to find ROP sequences in PE/Elf/Mach-O x86/x64 binaries. It is open-source and has been tested on several OS: Debian / Windows 8.1 / Mac OSX Lion (10.7.3). Moreover, it is x64 compatible and supports Intel syntax. Standalone executables can also be directly downloaded.
  • [399星][2m] [Logos] limneos/classdump-dyld Class-dump any Mach-o file without extracting it from dyld_shared_cache
  • [331星][3y] [C] steakknife/unsign Remove code signatures from OSX Mach-O binaries (note: unsigned binaries cannot currently be re-codesign'ed. Patches welcome!)
  • [269星][5y] [C] conradev/dumpdecrypted Dumps decrypted mach-o files from encrypted iPhone applications from memory to disk. This tool is necessary for security researchers to be able to look under the hood of encryption.
  • [265星][8m] [ObjC] devaukz/macho-kit A C/Objective-C library for parsing Mach-O files.
  • [238星][3y] aidansteele/osx-abi-macho-file-format-reference Mirror of OS X ABI Mach-O File Format Reference
  • [197星][2y] [ObjC] alonemonkey/dumpdecrypted Dumps decrypted mach-o files from encrypted applications、framework or app extensions.
  • [178星][4m] [ObjC] yulingtianxia/apporderfiles The easiest way to generate order files for Mach-O using Clang. Improving App Performance.
  • [150星][2y] [C] alexdenisov/bitcode_retriever Retrieves Bitcode from Mach-O binaries
  • [148星][14d] [Rust] m4b/faerie Magical ELF and Mach-o object file writer backend
  • [137星][2y] [ObjC] bluecocoa/class-dump Generate Objective-C headers from Mach-O files.
  • [124星][8m] [Swift] devaukz/macho-explorer A graphical Mach-O viewer for macOS. Powered by Mach-O Kit.
  • [105星][2y] [C++] tyilo/macho_edit Command line utility for modifying Mach-O binaries in various ways.
  • [100星][4y] [Py] jonathansalwan/abf Abstract Binary Format Manipulation - ELF, PE and Mach-O format
  • [62星][7y] [C] gdbinit/osx_boubou A PoC Mach-O infector via library injection
  • [48星][5m] [ObjC] dcsch/macho-browser Mac browser for Mach-O binaries (macOS, iOS, watchOS, and tvOS)
  • [39星][5y] [C] x43x61x69/codeunsign A Mach-O binary codesign remover.
  • [35星][3y] [Py] airbus-seclab/elfesteem ELF/PE/Mach-O parsing library
  • [31星][1m] [Rust] flier/rust-macho Mach-O File Format Parser for Rust
  • [20星][3y] [Py] njsmith/machomachomangler Tools for mangling Mach-O and PE binaries
  • [20星][11m] [C] geosn0w/machdump A very basic C Mach-O Header Dump tool written for practicing purposes. Works With x86 and x86_64 binaries
  • [17星][4m] [JS] indutny/macho Mach-O parser for node.js
  • [11星][7y] [C] gdbinit/calcspace Small util to calculate available free space in mach-o binaries for code injection
  • [10星][4y] [OCaml] m4b/bin2json Converts ELF, mach-o, or PE binaries to a JSON representation

文章


越狱

工具

文章


LLDB

工具

  • [8031星][3m] [Py] facebook/chisel Chisel is a collection of LLDB commands to assist debugging iOS apps.
  • [784星][3m] [C++] nodejs/llnode An lldb plugin for Node.js and V8, which enables inspection of JavaScript states for insights into Node.js processes and their core dumps.
  • [636星][2m] [C++] apple/swift-lldb This is the version of LLDB that supports the Swift programming language & REPL.
  • [492星][28d] [Rust] vadimcn/vscode-lldb A native debugger extension for VSCode based on LLDB
  • [388星][2m] [C++] llvm-mirror/lldb Mirror of official lldb git repository located at
  • [242星][5y] [C++] meeloo/xspray A front end for lldb on OS X for Mac and iOS targets, with a twist
  • [198星][2y] proteas/native-lldb-for-ios native LLDB(v3.8) for iOS
  • [25星][3y] [Py] bnagy/francis LLDB engine based tool to instrument OSX apps and triage crashes
  • [20星][3y] [Py] critiqjo/lldb.nvim This repository was moved to
  • [16星][2m] [Py] malor/cpython-lldb LLDB script for debugging of CPython processes
  • [12星][3y] [C++] indutny/llnode Node.js C++ lldb plugin

文章


XCode

工具

  • [6203星][3m] [ObjC] johnno1962/injectionforxcode Runtime Code Injection for Objective-C & Swift
  • [2057星][19d] [ObjC] ios-control/ios-deploy Install and debug iPhone apps from the command line, without using Xcode
  • [1606星][2m] [Swift] indragiek/inappviewdebugger A UIView debugger (like Reveal or Xcode) that can be embedded in an app for on-device view debugging
  • [1409星][1m] [Swift] johnno1962/injectioniii Re-write of Injection for Xcode in (mostly) Swift4
  • [572星][1m] [ObjC] hdb-li/lldebugtool LLDebugTool is a debugging tool for developers and testers that can help you analyze and manipulate data in non-xcode situations.
  • [497星][7y] [C] ghughes/fruitstrap Install and debug iPhone apps from the command line, without using Xcode
  • [384星][3m] [JS] johnno1962/xprobeplugin Live Memory Browser for Apps & Xcode
  • [179星][4y] [ObjC] x43x61x69/otx The Mach-O disassembler. Now 64bit and Xcode 6 compatible.
  • [135星][1y] [Swift] danleechina/mixplaintext 可对 Xcode 项目工程所有的 objective-c 文件内包含的明文进行加密混淆,提高逆向分析难度。
  • [135星][1y] [Shell] onmyway133/swiftsnippets A collection of Swift snippets to be used in Xcode
  • [48星][2y] [C++] tonyzesto/pubgprivxcode85 Player ESP 3D Box ESP Nametag ESP Lightweight Code Secure Injection Dedicated Cheat Launcher Secured Against Battleye Chicken Dinner Every Day. Win more matches than ever before with CheatAutomation’s Playerunknown’s Battlegrounds cheat! Our stripped down, ESP only cheat gives you the key features you need to take out your opponents and be eatin…
  • [45星][7m] [Swift] git-kevinchuang/potatso-swift5 Potatso compiled with swift5 xcode 10.2.1 mojave 10.14.5
  • [44星][3y] [Shell] vtky/resign XCode Project to resign .ipa files
  • [28星][1m] [Swift] hdb-li/lldebugtoolswift LLDebugTool is a debugging tool for developers and testers that can help you analyze and manipulate data in non-xcode situations.
  • [28星][2y] [Swift] jeanshuang/potatso 适配Xcode9.3 iOS11.3 Swift3.3编译通过。 (unmaintained) Potatso is an iOS client that implements Shadowsocks proxy with the leverage of NetworkExtension framework in iOS 9.
  • [24星][12m] [Swift] shoheiyokoyama/lldb-debugging The LLDB Debugging in C, Swift, Objective-C, Python and Xcode
  • [17星][2y] maxfong/obfuscatorxcplugin 逻辑混淆XCode插件
  • [1星][2y] [Swift] wdg/webshell-builder A WebShell application builder (no use of Xcode)

文章


工具

新添加的

  • [11025星][2y] [ObjC] bang590/jspatch JSPatch bridge Objective-C and Javascript using the Objective-C runtime. You can call any Objective-C class and method in JavaScript by just including a small engine. JSPatch is generally used to hotfix iOS App.
  • [10966星][10d] [ObjC] flipboard/flex An in-app debugging and exploration tool for iOS
  • [5775星][4m] [ObjC] square/ponydebugger Remote network and data debugging for your native iOS app using Chrome Developer Tools
  • [4663星][1m] [C] google/ios-webkit-debug-proxy A DevTools proxy (Chrome Remote Debugging Protocol) for iOS devices (Safari Remote Web Inspector).
  • [4397星][12d] [Swift] signalapp/signal-ios A private messenger for iOS.
  • [3686星][4m] [C] facebook/fishhook A library that enables dynamically rebinding symbols in Mach-O binaries running on iOS.
  • [3414星][2m] icodesign/potatso Potatso is an iOS client that implements different proxies with the leverage of NetworkExtension framework in iOS 10+.
  • [3327星][3m] [Swift] yagiz/bagel a little native network debugging tool for iOS
  • [3071星][10m] [JS] jipegit/osxauditor OS X Auditor is a free Mac OS X computer forensics tool
  • [2867星][12d] [ObjC] facebook/idb idb is a flexible command line interface for automating iOS simulators and devices
  • [2795星][24d] [Swift] kasketis/netfox A lightweight, one line setup, iOS / OSX network debugging library!
  • [2753星][1m] [Makefile] theos/theos A cross-platform suite of tools for building and deploying software for iOS and other platforms.
  • [2733星][26d] [ObjC] dantheman827/ios-app-signer This is an app for OS X that can (re)sign apps and bundle them into ipa files that are ready to be installed on an iOS device.
  • [2708星][2m] [ObjC] kjcracks/clutch Fast iOS executable dumper
  • [2345星][6y] [C] stefanesser/dumpdecrypted Dumps decrypted mach-o files from encrypted iPhone applications from memory to disk. This tool is necessary for security researchers to be able to look under the hood of encryption.
  • [1801星][1y] aozhimin/ios-monitor-platform
  • [1774星][3y] [ObjC] tapwork/heapinspector-for-ios Find memory issues & leaks in your iOS app without instruments
  • [1695星][6m] [Py] yelp/osxcollector A forensic evidence collection & analysis toolkit for OS X
  • [1683星][2m] [Swift] pmusolino/wormholy iOS network debugging, like a wizard 🧙‍♂️
  • [1642星][7m] [Objective-C++] tencent/oomdetector OOMDetector is a memory monitoring component for iOS which provides you with OOM monitoring, memory allocation monitoring, memory leak detection and other functions.
  • [1630星][1m] ivrodriguezca/re-ios-apps A completely free, open source and online course about Reverse Engineering iOS Applications.
  • [1444星][5y] [C++] gdbinit/machoview MachOView fork
  • [1442星][28d] [ObjC] nabla-c0d3/ssl-kill-switch2 Blackbox tool to disable SSL certificate validation - including certificate pinning - within iOS and OS X Apps
  • [1299星][6m] [JS] feross/spoof Easily spoof your MAC address in macOS, Windows, & Linux!
  • [1291星][1m] [JS] icymind/vrouter 一个基于 VirtualBox 和 openwrt 构建的项目, 旨在实现 macOS / Windows 平台的透明代理.
  • [1253星][2m] [Vue] chaitin/passionfruit iOSapp 黑盒评估工具。功能丰富,自带基于web的 GUI
  • [1252星][17d] michalmalik/osx-re-101 OSX/iOS逆向资源收集
  • [1240星][2y] [ObjC] krausefx/detect.location An easy way to access the user's iOS location data without actually having access
  • [1239星][8d] [C] datatheorem/trustkit Easy SSL pinning validation and reporting for iOS, macOS, tvOS and watchOS.
  • [1215星][16d] [YARA] horsicq/detect-it-easy Program for determining types of files for Windows, Linux and MacOS.
  • [1199星][6y] gdbinit/gdbinit Gdbinit for OS X, iOS and others - x86, x86_64 and ARM
  • [1174星][5y] [Py] hackappcom/ibrute AppleID bruteforce p0c
  • [1113星][1y] [ObjC] neoneggplant/eggshell iOS/macOS/Linux Remote Administration Tool
  • [1026星][2y] [ObjC] zhengmin1989/ios_ice_and_fire iOS冰与火之歌
  • [1001星][2m] [ObjC] lmirosevic/gbdeviceinfo Detects the hardware, software and display of the current iOS or Mac OS X device at runtime.
  • [985星][1y] [Py] fsecurelabs/needle The iOS Security Testing Framework
  • [975星][3y] [Py] synack/knockknock displays persistent items (scripts, commands, binaries, etc.), that are set to execute automatically on OS X
  • [936星][3y] [C] tyilo/insert_dylib Command line utility for inserting a dylib load command into a Mach-O binary
  • [907星][4m] [ObjC] ptoomey3/keychain-dumper A tool to check which keychain items are available to an attacker once an iOS device has been jailbroken
  • [866星][16d] [ObjC] meitu/mthawkeye Profiling / Debugging assist tools for iOS. (Memory Leak, OOM, ANR, Hard Stalling, Network, OpenGL, Time Profile ...)
  • [857星][3y] [Py] hubert3/isniff-gps Passive sniffing tool for capturing and visualising WiFi location data disclosed by iOS devices
  • [847星][2y] [Shell] kpwn/iosre iOS Reverse Engineering
  • [840星][9d] [JS] cypress-io/cypress-example-recipes Various recipes for testing common scenarios with Cypress
  • [812星][5y] [ObjC] isecpartners/ios-ssl-kill-switch Blackbox tool to disable SSL certificate validation - including certificate pinning - within iOS Apps
  • [807星][2y] [Ruby] dmayer/idb iOS 渗透和研究过程中简化一些常见的任务
  • [796星][13d] [Shell] aqzt/kjyw 快捷运维,代号kjyw,项目基于shell、python,运维脚本工具库,收集各类运维常用工具脚本,实现快速安装nginx、mysql、php、redis、nagios、运维经常使用的脚本等等...
  • [782星][3y] [Go] summitroute/osxlockdown [No longer maintained] Apple OS X tool to audit for, and remediate, security configuration settings.
  • [745星][5y] [ObjC] kjcracks/yololib dylib injector for mach-o binaries
  • [662星][1y] [Py] deepzec/bad-pdf create malicious PDF file to steal NTLM(NTLMv1/NTLMv2) Hashes from windows machines
  • [653星][3y] [C] rentzsch/mach_inject interprocess code injection for Mac OS X
  • [651星][9m] [ObjC] chenxiancai/stcobfuscator iOS全局自动化 代码混淆 工具!支持cocoapod组件代码一并 混淆,完美避开hardcode方法、静态库方法和系统库方法!
  • [649星][3y] [ObjC] isecpartners/introspy-ios Security profiling for blackbox iOS
  • [636星][1y] [Swift] phynet/ios-url-schemes a github solution from my gist of iOS list for urls schemes
  • [621星][5y] [PHP] pr0x13/idict iCloud Apple iD BruteForcer
  • [616星][3y] [ObjC] macmade/keychaincracker macOS keychain cracking tool
  • [604星][2m] siguza/ios-resources Useful resources for iOS hacking
  • [583星][3y] [C++] tobefuturer/app2dylib A reverse engineering tool to convert iOS app to dylib
  • [558星][3y] advanced-threat-research/firmware-security-training 固件安全教程:从攻击者和防卫者的角度看BIOS / UEFI系统固件的安全
  • [530星][3y] [ObjC] herzmut/shadowsocks-ios Fork of shadowsocks/shadowsocks-iOS
  • [526星][4y] [Py] hackappcom/iloot OpenSource tool for iCloud backup extraction
  • [522星][2y] [Shell] seemoo-lab/mobisys2018_nexmon_software_defined_radio 将Broadcom的802.11ac Wi-Fi芯片变成软件定义的无线电,可在Wi-Fi频段传输任意信号
  • [517星][3y] [ObjC] pjebs/obfuscator-ios Secure your app by obfuscating all the hard-coded security-sensitive strings.
  • [517星][5y] [Py] project-imas/mdm-server Sample iOS MDM server
  • [500星][27d] [Swift] google/science-journal-ios Use the sensors in your mobile devices to perform science experiments. Science doesn’t just happen in the classroom or lab—tools like Science Journal let you see how the world works with just your phone.
  • [482星][1y] [Swift] icepa/icepa iOS system-wide VPN based Tor client
  • [478星][15d] pixelcyber/thor HTTP Sniffer/Capture on iOS for Network Debug & Inspect.
  • [471星][8m] [C++] everettjf/machoexplorer MachO文件查看器,支持Windows和macOS
  • [462星][15d] [Java] dsheirer/sdrtrunk A cross-platform java application for decoding, monitoring, recording and streaming trunked mobile and related radio protocols using Software Defined Radios (SDR). Website:
  • [432星][7y] [C] juuso/keychaindump A proof-of-concept tool for reading OS X keychain passwords
  • [430星][11m] captainarash/the_holy_book_of_x86 A simple guide to x86 architecture, assembly, memory management, paging, segmentation, SMM, BIOS....
  • [419星][4y] [ObjC] asido/systemmonitor iOS application providing you all information about your device - hardware, operating system, processor, memory, GPU, network interface, storage and battery, including OpenGL powered visual representation in real time.
  • [406星][5y] [ObjC] mp0w/ios-headers iOS 5.0/5.1/6.0/6.1/7.0/7.1/8.0/8.1 Headers of All Frameworks (private and not) + SpringBoard
  • [396星][4m] ansjdnakjdnajkd/ios iOS渗透测试最有用的工具
  • [393星][2y] r0ysue/osg-translationteam 看雪iOS安全小组的翻译团队作品集合,如有勘误,欢迎斧正!
  • [382星][11m] [C] coolstar/electra1131 electra1131: Electra for iOS 11.0 - 11.3.1
  • [375星][2y] [C++] alonemonkey/iosrebook 《iOS应用逆向与安全》随书源码
  • [375星][29d] [Swift] justeat/justlog JustLog brings logging on iOS to the next level. It supports console, file and remote Logstash logging via TCP socket with no effort. Support for logz.io available.
  • [374星][2y] [C++] breenmachine/rottenpotatong New version of RottenPotato as a C++ DLL and standalone C++ binary - no need for meterpreter or other tools.
  • [371星][18d] [Shell] matthewpierson/1033-ota-downgrader First ever tool to downgrade ANY iPhone 5s, ANY iPad Air and (almost any) iPad Mini 2 to 10.3.3 with OTA blobs + checkm8!
  • [349星][19d] [C] jedisct1/swift-sodium Safe and easy to use crypto for iOS and macOS
  • [346星][4m] [TS] bacher09/pwgen-for-bios Password generator for BIOS
  • [340星][3m] [C] trailofbits/cb-multios DARPA Challenges Sets for Linux, Windows, and macOS
  • [332星][3y] [Logos] bishopfox/ispy A reverse engineering framework for iOS
  • [322星][2m] [ObjC] auth0/simplekeychain A Keychain helper for iOS to make it very simple to store/obtain values from iOS Keychain
  • [310星][28d] [Swift] securing/iossecuritysuite iOS platform security & anti-tampering Swift library
  • [298星][2y] krausefx/steal.password Easily get the user's Apple ID password, just by asking
  • [292星][8y] [ObjC] nst/spyphone This project shows the kind of data a rogue iPhone application can collect.
  • [287星][1y] [Py] manwhoami/mmetokendecrypt Decrypts and extracts iCloud and MMe authorization tokens on Apple macOS / OS X. No user authentication needed. 🏅🌩
  • [283星][2y] [Swift] krausefx/watch.user Every iOS app you ever gave permission to use your camera can record you any time it runs - without notice
  • [263星][14d] [ObjC] strongbox-password-safe/strongbox A KeePass/Password Safe Client for iOS and OS X
  • [247星][1m] [C++] s0uthwest/futurerestore iOS upgrade and downgrade tool utilizing SHSH blobs
  • [244星][7m] [JS] we11cheng/wcshadowrocket iOS Shadowrocket(砸壳重签,仅供参考,添加节点存在问题)。另一个fq项目potatso源码参见:
  • [241星][2y] [C] limneos/mobileminer CPU Miner for ARM64 iOS Devices
  • [239星][1y] [ObjC] lmirosevic/gbping Highly accurate ICMP Ping controller for iOS
  • [238星][4m] [Swift] shadowsocksr-live/ishadowsocksr ShadowsocksR for iOS, come from
  • [229星][3y] [Swift] trailofbits/secureenclavecrypto Demonstration library for using the Secure Enclave on iOS
  • [223星][12m] [AppleScript] lifepillar/csvkeychain Import/export between Apple Keychain.app and plain CSV file.
  • [219星][6m] [ObjC] rickyzhang82/tethering Proxy and DNS Server on iOS
  • [213星][8m] [C] owasp/igoat OWASP iGoat - A Learning Tool for iOS App Pentesting and Security by Swaroop Yermalkar
  • [211星][13d] [TS] bevry/getmac Get the mac address of the current machine you are on via Node.js
  • [210星][2y] [C] cheesecakeufo/saigon iOS 10.2.1 - Discontinued version
  • [203星][5m] [Py] googleprojectzero/ios-messaging-tools several tools Project Zero uses to test iPhone messaging
  • [200星][6m] [PS] mkellerman/invoke-commandas Invoke Command As System/Interactive/GMSA/User on Local/Remote machine & returns PSObjects.
  • [199星][1m] [ObjC] everettjf/yolo Scripts or demo projects on iOS development or reverse engineering
  • [198星][27d] [Swift] auth0/lock.swift A Swift & iOS framework to authenticate using Auth0 and with a Native Look & Feel
  • [195星][2m] [Logos] creantan/lookinloader Lookin - iOS UI Debugging Tweak LookinLoader,Compatible with iOS 8~13
  • [190星][13d] [Py] ydkhatri/mac_apt macOS Artifact Parsing Tool
  • [182星][1m] [JS] nowsecure/node-applesign NodeJS module and commandline utility for re-signing iOS applications (IPA files).
  • [181星][4y] [ObjC] iosre/hippocamphairsalon A simple universal memory editor (game trainer) on OSX/iOS
  • [181星][12m] zekesnider/nintendoswitchrestapi Reverse engineered REST API used in the Nintendo Switch app for iOS. Includes documentation on Splatoon 2's API.
  • [180星][4m] [Py] anssi-fr/secuml Machine Learning for Computer Security
  • [180星][8m] [Java] yubico/ykneo-openpgp OpenPGP applet for the YubiKey NEO
  • [174星][1y] [ObjC] macmade/filevaultcracker macOS FileVault cracking tool
  • [172星][23d] [C++] samyk/frisky Instruments to assist in binary application reversing and augmentation, geared towards walled gardens like iOS and macOS
  • [171星][2y] [Py] 3gstudent/worse-pdf Turn a normal PDF file into malicious.Use to steal Net-NTLM Hashes from windows machines.
  • [171星][10m] [Shell] trustedsec/hardcidr hardCIDR is a Linux Bash script, but also functions under macOS. Your mileage may vary on other distros. The script with no specified options will query ARIN and a pool of BGP route servers. The route server is selected at random at runtime.
  • [169星][7m] [C] octomagon/davegrohl A Password Cracker for macOS
  • [166星][8m] proteas/unstripped-ios-kernels Unstripped iOS Kernels
  • [165星][2y] [C++] google/pawn 从基于 Intel 的工作站和笔记本电脑中提取 BIOS 固件
  • [165星][16d] [Swift] ryasnoy/applocker AppLocker - simple lock screen for iOS Application ( Swift 4+, iOS 9.0+) Touch ID / Face ID
  • [163星][6y] [C] gdbinit/readmem A small OS X/iOS userland util to dump processes memory
  • [163星][9m] [C] tboox/itrace Trace objc method call for ios and mac
  • [162星][2y] [C++] encounter/futurerestore (unmaintained) iOS upgrade and downgrade tool utilizing SHSH blobs (unofficial fork supporting iOS 11 and newer devices)
  • [159星][2m] smilezxlee/crackediosapps iOS端破解版App集合,包含破解版QQ、破解版抖音、破解版百度网盘、破解版麻花、钉钉打卡助手、破解版墨墨背单词、破解版网易云音乐、破解版芒果TV
  • [157星][20d] mac4n6/presentations Presentation Archives for my macOS and iOS Related Research
  • [152星][7y] [Py] intrepidusgroup/imdmtools Intrepidus Group's iOS MDM tools
  • [147星][3y] [Py] biosbits/bits BIOS Implementation Test Suite
  • [145星][2y] [Shell] depoon/iosdylibinjectiondemo Using this Repository to demo how to inject dynamic libraries into cracked ipa files for jailed iOS devices
  • [144星][10m] [Py] dlcowen/fseventsparser Parser for OSX/iOS FSEvents Logs
  • [144星][4y] [ObjC] etsy/bughunt-ios
  • [143星][2y] [C] rodionovd/liblorgnette Interprocess dlsym() for OS X & iOS
  • [140星][4m] [Go] greenboxal/dns-heaven 通过/etc/resolv.conf 启用本地 DNS stack 来修复(愚蠢的) macOS DNS stack
  • [139星][3y] [Py] google/tcp_killer 关闭 Linux或 MacOS 的 Tcp 端口
  • [139星][8m] [C++] macmade/dyld_cache_extract A macOS utility to extract dynamic libraries from the dyld_shared_cache of macOS and iOS.
  • [130星][4m] [Py] apperian/ios-checkipa Scans an IPA file and parses its Info.plist and embedded.mobileprovision files. Performs checks of expected key/value relationships and displays the results.
  • [129星][4y] [Go] benjojo/dos_ssh Use BIOS ram hacks to make a SSH server out of any INT 10 13h app (MS-DOS is one of those)
  • [129星][2m] [Py] stratosphereips/stratospherelinuxips an intrusion prevention system that is based on behavioral detections and machine learning algorithms
  • [128星][2y] [Py] unfetter-discover/unfetter-analytic a framework for collecting events (process creation, network connections, Window Event Logs, etc.) from a client machine (Windows 7) and performing CAR analytics to detect potential adversary activity
  • [126星][3m] [Py] platomav/biosutilities Various BIOS Utilities for Modding/Research
  • [126星][4y] [Py] sektioneins/sandbox_toolkit Toolkit for binary iOS / OS X sandbox profiles
  • [125星][16d] [C] projecthorus/radiosonde_auto_rx Automatically Track Radiosonde Launches using RTLSDR
  • [125星][3y] [JS] vtky/swizzler2 Swizzler2 - Hacking iOS applications
  • [121星][2y] [Swift] lxdcn/nepackettunnelvpndemo iOS VPN client implementation demo based on iOS9 NetworkExtension NETunnelProvider APIs
  • [119星][1y] [Py] winheapexplorer/winheap-explorer heap-based bugs detection in x86 machine code for Windows applications.
  • [113星][3y] [Objective-C++] yonsm/ipafine iOS IPA package refine and resign
  • [111星][5m] [C++] danielcardeenas/audiostego Audio file steganography. Hides files or text inside audio files and retrieve them automatically
  • [110星][8m] [C] siguza/imobax iOS Mobile Backup Extractor
  • [106星][7y] intrepidusgroup/trustme Disable certificate trust checks on iOS devices.
  • [99星][2y] antid0tecom/ios-kerneldocs Various files helping to better understand the iOS / WatchOS / tvOS kernels
  • [98星][2y] [Py] google/legilimency A Memory Research Platform for iOS
  • [96星][7m] [Swift] depoon/networkinterceptor iOS URLRequest interception framework
  • [96星][2y] [Swift] liruqi/mume-ios an iOS client that implements custom proxies with the leverage of Network Extension framework introduced by Apple since iOS 9
  • [95星][2y] [ObjC] xslim/mobiledevicemanager Manage iOS devices through iTunes lib
  • [93星][1y] [Jupyter Notebook] positivetechnologies/seq2seq-web-attack-detection The implementation of the Seq2Seq model for web attack detection. The Seq2Seq model is usually used in Neural Machine Translation. The main goal of this project is to demonstrate the relevance of the NLP approach for web security.
  • [90星][2y] [PS] netbiosx/digital-signature-hijack Binaries, PowerShell scripts and information about Digital Signature Hijacking.
  • [90星][5y] [ObjC] project-imas/app-password Custom iOS user authentication mechanism (password with security questions for self reset)
  • [85星][4y] [Swift] deniskr/keychainswiftapi This Keychain Swift API library is a wrapper of iOS C Keychain Framework. It allows easily and securely storing sensitive data in secure keychain store.
  • [85星][2y] [ObjC] siguza/phoenixnonce 64-bit nonce setter for iOS 9.3.4-9.3.5
  • [84星][8m] [Py] aaronst/macholibre Mach-O & Universal Binary Parser
  • [83星][10m] [Shell] trailofbits/ios-integrity-validator Integrity validator for iOS devices
  • [79星][1y] [Swift] aidevjoe/sandboxbrowser A simple iOS sandbox file browser, you can share files through AirDrop
  • [79星][4y] mi3security/su-a-cyder Home-Brewed iOS Malware PoC Generator (BlackHat ASIA 2016)
  • [79星][6y] [C] peterfillmore/removepie removePIE changes the MH_PIE flag of the MACH-O header on iOS applications to disable ASLR on applications
  • [78星][1y] [Shell] iaik/ios-analysis Automated Binary Analysis on iOS
  • [77星][2y] [ObjC] cocoahuke/ioskextdump Dump Kext information from iOS kernel cache. Applicable to the kernel which dump from memory
  • [75星][7m] [Py] tribler/dispersy The elastic database system. A database designed for P2P-like scenarios, where potentially millions of computers send database updates around.
  • [74星][29d] [C] certificate-helper/tls-inspector Easily view and inspect X.509 certificates on your iOS device.
  • [72星][4m] [C++] macmade/unicorn-bios Basic BIOS emulator for Unicorn Engine.
  • [72星][6y] [Py] piccimario/iphone-backup-analyzer-2 iPBA, Qt version
  • [72星][3y] [C++] razzile/liberation A runtime patching library for iOS. Major rework on unfinished branch
  • [72星][30d] [Py] ehco1996/aioshadowsocks 用 asyncio 重写 shadowsocks ~
  • [69星][3m] [C] brandonplank/rootlessjb4 rootlessJB that supports iOS 12.0 - 12.2 & 12.4
  • [67星][22d] [Py] guardianfirewall/grandmaster A simplistic python tool that assists in automating iOS firmware decryption.
  • [65星][4y] zhengmin1989/ios-10-decrypted-kernel-cache iOS 10 Decrypted Kernel Cache
  • [65星][5y] [ObjC] project-imas/memory-security Tools for securely clearing and validating iOS application memory
  • [63星][2y] josephlhall/dc25-votingvillage-report A report to synthesize findings from the Defcon 25 Voting Machine Hacking Village
  • [62星][8m] [C] luoyanbei/testhookzz iOS逆向:使用HookZz框架hook游戏“我的战争”,进入上帝模式
  • [62星][5m] [C++] meitu/mtgldebug An OpenGL debugging tool for iOS.
  • [61星][9y] [C] chronic-dev/bootrom-dumper Utility to Dump iPhone Bootrom
  • [61星][6m] [PS] texhex/biossledgehammer Automated BIOS, ME, TPM firmware update and BIOS settings for HP devices
  • [61星][11m] [ObjC] tihmstar/v3ntex getf tfp0 on iOS 12.0 - 12.1.2
  • [60星][4y] shadowsocks/tun2socks-ios tun2socks as a library for iOS apps
  • [58星][7m] [Perl] dnsmichi/manubulon-snmp Set of Icinga/Nagios plugins to check hosts and hardware wi the SNMP protocol.
  • [58星][4y] [HTML] nccgroup/iodide The Cisco IOS Debugger and Integrated Disassembler Environment
  • [58星][2y] [Shell] tanprathan/fridpa An automated wrapper script for patching iOS applications (IPA files) and work on non-jailbroken device
  • [57星][ObjC] jrock007/tob Free, open-source and ad-less Tor web browser for iOS
  • [56星][11m] [ObjC] geosn0w/chaos Chaos iOS < 12.1.2 PoC by
  • [55星][2y] jkpang/timliu-ios iOS开发常用三方库、插件、知名博客等等
  • [55星][3y] [C++] s-kanev/xiosim A detailed michroarchitectural x86 simulator
  • [55星][3y] [C] synack/chaoticmarch A mechanism for automating input events on iOS
  • [52星][1y] [C] bazad/threadexec A library to execute code in the context of other processes on iOS 11.
  • [52星][2y] rehints/blackhat_2017 Betraying the BIOS: Where the Guardians of the BIOS are Failing
  • [52星][10m] [Logos] zhaochengxiang/ioswechatfakelocation A tweak that can fake location info in WeChat
  • [51星][3y] [HTML] pwnsdx/ios-uri-schemes-abuse-poc A set of URI schemes bugs that lead Safari to crash/freeze.
  • [49星][1y] [Swift] sherlouk/swiftprovisioningprofile Parse iOS mobile provisioning files into Swift models
  • [48星][2y] [Shell] leanvel/iinject Tool to automate the process of embedding dynamic libraries into iOS applications from GNU/Linux
  • [48星][7m] [ObjC] smilezxlee/zxhookutil 【iOS逆向】Tweak工具函数集,基于theos、monkeyDev
  • [47星][2m] [ObjC] ooni/probe-ios OONI Probe iOS
  • [47星][4y] [Py] ostorlab/jniostorlab JNI method enumeration in ELF files
  • [47星][3m] [ObjC] smilezxlee/zxrequestblock 一句话实现iOS应用底层所有网络请求拦截(如ajax请求拦截),包含http-dns解决方法,有效防止DNS劫持,用于分析http,https请求,禁用/允许代理,防抓包等
  • [47星][2m] the-blockchain-bible/readme The Blockchain Bible,a collections for blockchain tech,bitcoin,ethereum,crypto currencies,cryptography,decentralized solutions,business scenarios,hyperledger tech,meetups,区块链,数字货币,加密货币,比特币,以太坊,密码学,去中心化,超级账本
  • [47星][5y] [PHP] cloudsec/aioshell A php webshell run under linux based webservers. v0.05
  • [46星][2y] [C] encounter/tsschecker Check TSS signing status of iOS firmwares and save SHSH blobs
  • [46星][2y] uefitech/resources One-stop shop for UEFI/BIOS specifications/utilities by UEFI.Tech community
  • [46星][1y] [Go] unixpickle/cve-2018-4407 Crash macOS and iOS devices with one packet
  • [44星][4y] [C] samdmarshall/machodiff mach-o diffing tool
  • [43星][5y] [Shell] netspi/heapdump-ios Dump IOS application heap space from memory
  • [42星][1m] [ObjC] dineshshetty/ios-sandbox-dumper SandBox-Dumper makes use of multiple private libraries to provide exact locations of the application sandbox, application bundle and some other interesting information
  • [42星][2y] [Py] klsecservices/ios_mips_gdb Cisco MIPS debugger
  • [40星][15d] [Swift] fonta1n3/fullynoded A Bitcoin Core GUI for iOS devices. Allows you to connect to and control multiple nodes via Tor
  • [39星][3y] [Logos] ahmadhashemi/immortal Prevent expiration of signed iOS applications & bypass 3 free signed applications per device limit
  • [39星][4m] [Py] gh2o/rvi_capture rvictl for Linux and Windows: capture packets sent/received by iOS devices
  • [39星][4y] [Pascal] senjaxus/delphi_remote_access_pc Remote access in Delphi 7 and Delphi XE5 (With sharer files, CHAT and Forms Inheritance) || Acesso Remoto em Delphi 7 e Delphi XE5 (Com Compartilhador de Arquivos, CHAT e Herança de Formulários)
  • [39星][27d] [Shell] userlandkernel/plataoplomo Collection of (at time of release) iOS bugs I found
  • [39星][3m] [Py] meituan-dianping/lyrebird-ios 本程序是Lyrebird插件,您可以在插件中快速查看已连接iOS设备的详细设备信息,截取屏幕快照,以及查看已连接设备的应用信息。
  • [38星][4y] [C] taichisocks/shadowsocks Lightweight shadowsocks client for iOS and Mac OSX base on shadowsocks-libev
  • [38星][1y] [ObjC] xmartlabs/metalperformanceshadersproxy A proxy for MetalPerformanceShaders which takes to a stub on a simulator and to the real implementation on iOS devices.
  • [37星][4m] [Ruby] appspector/ios-sdk AppSpector is a debugging service for mobile apps
  • [36星][4y] [Objective-C++] cyhe/iossecurity-attack APP安全(逆向攻击篇)
  • [36星][3y] [PS] machosec/mystique PowerShell module to play with Kerberos S4U extensions
  • [35星][4y] [Py] curehsu/ez-wave Tools for Evaluating and Exploiting Z-Wave Networks using Software-Defined Radios.
  • [35星][1y] [Swift] vixentael/zka-example Zero Knowledge Application example, iOS, notes sharing, Firebase backend
  • [33星][3y] [ObjC] integrity-sa/introspy-ios Security profiling for blackbox iOS
  • [33星][7y] [C] mubix/fakenetbios See here:
  • [33星][10m] [Swift] vixentael/ios-datasec-basics iOS data security basics: key management, workshop for iOS Con UK
  • [33星][2m] [ObjC] proteas/ios13-sandbox-profile-format Binary Format of iOS 13 Sandbox Profile Collection
  • [31星][3y] [Py] as0ler/r2clutch r2-based tool to decrypt iOS applications
  • [31星][3y] [Assembly] gyje/bios_rootkit 来自Freebuf评论区,一个UEFI马.
  • [31星][2y] proappleos/upgrade-from-10.3.x-to-ios-11.1.2-on-any-64bit-device-with-blobs How to Upgrade any 64Bit Device from 10.3.x to 11.1.2 with Blobs
  • [30星][3y] [ObjC] mtigas/iobfs Building obfs4proxy for Tor-enabled iOS apps.
  • [30星][2y] [Shell] pnptutorials/pnp-portablehackingmachine This script will convert your Raspberry Pi 3 into a portable hacking machine.
  • [30星][8y] [Py] hubert3/isniff SSL man-in-the-middle tool targeting iOS devices < 4.3.5
  • [29星][12m] [Py] antid0tecom/ipad_accessory_research Research into Security of Apple Smart Keyboard and Apple Pencil
  • [29星][4y] [ObjC] quellish/facebook-ios-internal-headers Headers generated by reverse engineering the Facebook iOS binary
  • [29星][8y] sektioneins/.ipa-pie-scanner Scans iPhone/iPad/iPod applications for PIE flags
  • [29星][4y] [C] scallywag/nbtscan NetBIOS scanning tool. Currently segfaults!
  • [28星][2y] [ObjC] dannagle/packetsender-ios Packet Sender for iOS, Send/Receive UDP/TCP
  • [28星][10m] [C] mrmacete/r2-ios-kernelcache Radare2 plugin to parse modern iOS 64-bit kernel caches
  • [28星][3y] [C] salmg/audiospoof Magnetic stripe spoofer implementing audio waves.
  • [28星][4y] [Swift] urinx/device-9 实时监测网速,IP,内存大小,温度等设备信息并显示在通知中心的 iOS App
  • [27星][1y] alonemonkey/iosrebook-issues 《iOS应用逆向与安全》 勘误
  • [27星][27d] [Perl] hknutzen/netspoc A network security policy compiler. Netspoc is targeted at large environments with a large number of firewalls and admins. Firewall rules are derived from a single rule set. Supported are Cisco IOS, NX-OS, ASA and IPTables.
  • [27星][3m] [Rust] marcograss/rust-kernelcache-extractor Extract a decrypted iOS 64-bit kernelcache
  • [27星][8m] [Py] qingxp9/cve-2019-6203-poc PoC for CVE-2019-6203, works on < iOS 12.2, macOS < 10.14.4
  • [27星][5m] [Py] mvelazc0/purplespray PurpleSpray is an adversary simulation tool that executes password spray behavior under different scenarios and conditions with the purpose of generating attack telemetry in properly monitored Windows enterprise environments
  • [26星][2y] [C++] cuitche/code-obfuscation 一款iOS代码混淆工具(A code obfuscation tool for iOS.)
  • [26星][5m] [HTML] devnetsandbox/sbx_multi_ios Sample code, examples, and resources for use with the DevNet Multi-IOS Sandbox
  • [26星][4y] [ObjC] qiuyuzhou/shadowsocks-ios No maintaining. Try this
  • [26星][3y] [ObjC] nabla-c0d3/ios-reversing Some iOS tools and scripts from 2014 for iOS reversing.
  • [26星][5m] [Swift] itsjohnye/lead-ios a featherweight iOS SS proxy client with interactive UI
  • [25星][2y] [C] embedi/tcl_shellcode A template project for creating a shellcode for the Cisco IOS in the C language
  • [25星][1y] [HTML] 649/crash-ios-exploit Repository dedicated to storing a multitude of iOS/macOS/OSX/watchOS crash bugs. Some samples need to be viewed as raw in order to see the Unicode. Please do not intentionally abuse these exploits.
  • [24星][6y] [ObjC] samdmarshall/ios-internals iOS related code
  • [23星][5y] [Ruby] claudijd/bnat "Broken NAT" - A suite of tools focused on detecting and interacting with publicly available BNAT scenerios
  • [23星][1y] [ObjC] rpwnage/warri0r ios 12 Sandbox escape POC
  • [22星][2y] jasklabs/blackhat2017 Data sets and examples for Jask Labs Blackhat 2017 Handout: Top 10 Machine Learning Cyber Security Use Cases
  • [22星][4y] sunkehappy/ios-reverse-engineering-tools-backup Some guys find the old lsof could not be downloaded. But I have it and I want to share it.
  • [22星][1y] [PHP] svelizdonoso/asyrv ASYRV es una aplicación escrita en PHP/MySQL, con Servicios Web mal desarrollados(SOAP/REST/XML), esperando ayudar a los entusiastas de la seguridad informática a comprender esta tecnología tan utilizada hoy en día por las Organizaciones.
  • [21星][2y] troydo42/awesome-pen-test Experiment with penetration testing Guides and Tools for WordPress, iOS, MacOS, Wifi and Car
  • [20星][1y] [C] downwithup/cve-2018-16712 PoC Code for CVE-2018-16712 (exploit by MmMapIoSpace)
  • [20星][1y] [Ruby] martinvigo/ransombile Ransombile is a tool that can be used in different scenarios to compromise someone’s digital life when having physical access to a locked mobile device
  • [19星][3y] [Swift] depoon/injectiblelocationspoofing Location Spoofing codes for iOS Apps via Code Injection
  • [19星][1y] [ObjC] frpccluster/frpc-ios IOS,苹果版frpc.一个快速反向代理,可帮助您将NAT或防火墙后面的本地服务器暴露给Internet。
  • [19星][6y] [Logos] iosre/iosrelottery
  • [18星][12d] [Py] adafruit/adafruit_circuitpython_rfm9x CircuitPython module for the RFM95/6/7/8 LoRa wireless 433/915mhz packet radios.
  • [16星][4y] ashishb/ios-malware iOS malware samples
  • [16星][2y] [ObjC] mikaelbo/updateproxysettings A simple iOS command line tool for updating proxy settings
  • [16星][1y] [Py] r3dxpl0it/cve-2018-4407 IOS/MAC Denial-Of-Service [POC/EXPLOIT FOR MASSIVE ATTACK TO IOS/MAC IN NETWORK]
  • [15星][2y] [Objective-C++] ay-kay/cda iOS command line tool to search for installed apps and list container paths (bundle, data, group)
  • [15星][2y] [Py] mathse/meltdown-spectre-bios-list a list of BIOS/Firmware fixes adressing CVE-2017-5715, CVE-2017-5753, CVE-2017-5754
  • [15星][2y] [Swift] vgmoose/nc-client [iOS] netcat gui app, for using the 10.1.x mach_portal root exploit on device
  • [15星][12m] aliasrobotics/rctf Scenarios of the Robotics CTF (RCTF), a playground to challenge robot security.
  • [14星][2m] refractionpoint/limacharlie Old home of LimaCharlie, open source EDR
  • [14星][7y] [Py] trotsky/insyde-tools (Inactive) Tools for unpacking and modifying an InsydeH2O UEFI BIOS now merged into coreboot
  • [14星][5y] [C] yifanlu/polipo-ios iOS port of Polipo caching HTTP proxy
  • [13星][1y] [ObjC] omerporze/toothfairy CVE-2018-4330 POC for iOS
  • [13星][6y] [Py] yuejd/ios_restriction_passcode_crack---python-version Crack ios Restriction PassCode in Python
  • [13星][2m] [Shell] ewypych/icinga-domain-expiration-plugin Icinga2/Nagios plugin for checking domain expiration
  • [12星][8y] [C] akgood/iosbasicconstraintsworkaround Proof-of-Concept OpenSSL-based workaround for iOS basicConstraints SSL certificate validation vulnerability
  • [12星][10m] [Py] wyatu/cve-2018-4407 CVE-2018-4407 IOS/macOS kernel crash
  • [11星][8m] [Swift] sambadiallob/pubnubchat An anonymous chat iOS app made using PubNub
  • [11星][3y] [ObjC] flankerhqd/descriptor-describes-toctou POCs for IOMemoryDescriptor racing bugs in iOS/OSX kernels
  • [10星][1y] [Py] zteeed/cve-2018-4407-ios POC: Heap buffer overflow in the networking code in the XNU operating system kernel
  • [9星][2y] [Logos] asnowfish/ios-system iOS系统的逆向代码
  • [9星][4y] [C] yigitcanyilmaz/iohideventsystemuserclient iOS Kernel Race Vulnerability (Patched on iOS 9.3.2,OSX 10.11.5,tvOS 9.2.1 by Apple)
  • [9星][2y] [C] syst3ma/cisco_ios_research
  • [9星][2m] nemo-wq/privilege_escalation Lab exercises to practice privilege escalation scenarios in AWS IAM. These exercises and the slides go through the basics behind AWS IAM, common weaknesses in AWS deployments, specific to IAM, and how to exploit them manually. This was run as a workshop at BruCon 2019.
  • [9星][2y] [C] syst3ma/cisco_ios_research
  • [8星][6y] [C] linusyang/sslpatch Patch iOS SSL vulnerability (CVE-2014-1266)
  • [8星][2y] pinczakko/nsa_bios_backdoor_articles PDF files of my articles on NSA BIOS backdoor
  • [8星][2y] [JS] ansjdnakjdnajkd/frinfo Dump files, data, cookies, keychain and etc. from iOS device with one click.
  • [7星][7y] [ObjC] hayaq/recodesign Re-codesigning tool for iOS ipa file
  • [7星][11m] [Py] shawarkhanethicalhacker/cve-2019-8389 [CVE-2019-8389] An exploit code for exploiting a local file read vulnerability in Musicloud v1.6 iOS Application
  • [7星][1y] [C] ukern-developers/xnu-kernel-fuzzer Kernel Fuzzer for Apple's XNU, mainly meant for the iOS operating system
  • [6星][2y] [C] jduncanator/isniff Packet capture and network sniffer for Apple iOS devices (iPhone / iPod). An implementation of iOS 5+ Remote Virtual Interface service and pcapd.
  • [6星][6y] [Shell] rawrly/juicejacking Several script and images used with the juice jacking kiosks
  • [6星][8y] [Ruby] spiderlabs/bnat-suite "Broken NAT" - A suite of tools focused on detecting/exploiting/fixing publicly available BNAT scenerios
  • [4星][12m] anonymouz4/apple-remote-crash-tool-cve-2018-4407 Crashes any macOS High Sierra or iOS 11 device that is on the same WiFi network
  • [4星][2y] [C] chibitronics/ltc-os ChibiOS-based operating system for the Love-to-Code project
  • [4星][2y] [Swift] crazyquark/keysafe A technical demo on how to use KeySecGeneratePair() with the secure enclave in iOS 9+
  • [4星][8y] [ObjC] spiderlabs/twsl2011-007_ios_code_workaround Workaround for the vulnerability identified by TWSL2011-007 or CVE-2008-0228 - iOS x509 Certificate Chain Validation Vulnerability
  • [3星][3y] [ObjC] susnmos/xituhook 逆向分析及修复稀土掘金iOS版客户端闪退bug
  • [3星][4y] [Py] torque59/yso-mobile-security-framework Mobile Security Framework is an intelligent, all-in-one open source mobile application (Android/iOS) automated pen-testing framework capable of performing static and dynamic analysis.
  • [3星][1y] tthtlc/awesome_malware_techniques This will compile a list of Android, iOS, Linux malware techniques for attacking and detection purposes.
  • [3星][4y] [Py] tudorthe1ntruder/rubber-ducky-ios-pincode-bruteforce
  • [2星][3y] [Py] alexplaskett/needle The iOS Security Testing Framework.
  • [2星][5y] [HTML] dhirajongithub/owasp-kalp-mobile-project-ios-app OWASP KALP Mobile Project is an iOS application developed for users to view OWASP Top 10 (WEB and MOBILE) on mobile device.
  • [2星][2y] [C] kigkrazy/hookzz a cute hook framwork for arm/arm64/ios/android
  • [2星][4y] [C] ohdarling/potatso-ios Potatso is an iOS client that implements Shadowsocks proxy with the leverage of NetworkExtension framework in iOS 9.
  • [2星][1y] [Py] zeng9t/cve-2018-4407-ios-exploit CVE-2018-4407,iOS exploit
  • [2星][2y] nrollr/ios Ivan Krstić - Black Hat 2016 presentation
  • [1星][10m] [Ruby] hercules-team/augeasproviders_nagios Augeas-based nagios types and providers for Puppet
  • [1星][4y] [Go] jordan2175/ios-passcode-crack Tool for cracking the iOS restrictions passcode
  • [0星][2y] [ObjC] joedaguy/exploit11.2 Exploit iOS 11.2.x by ZIMPERIUM and semi-completed by me. Sandbox escapes on CVE-2018-4087.
  • [0星][3y] [C] maximehip/extra_recipe Ian Beer's exploit for CVE-2017-2370 (kernel memory r/w on iOS 10.2)
  • [0星][6y] [ObjC] skycure/skycure_news Sample news iOS application
  • [0星][2y] [Py] tsunghowu/diskimagecreator A python utility to process the input raw disk image and sign MBR/partitions with given corresponding keys. This tool is designed to help people attack the machine with a secure chain-of-trust boot process in UEFI BIOS.
  • [0星][3y] [Swift] jencisov/stackview POC project of StackViews on iOS
  • [0星][2m] [HTML] dotnetnicaragua/example-xss-crosssitescripting Ejemplo de vulnerabilidad: A7 - Secuencia de Comandos en Sitios Cruzados (XSS) según OWASP TOP 10 2017

文章&&视频

新添加

Cuckoo


工具

新添加的


文章&&视频

DBI


DynamoRIO

工具

DynamoRIO

新添加的

与其他工具交互

文章&&视频


IntelPin

工具

新添加的

  • [424星][5y] [C++] jonathansalwan/pintools Pintool example and PoC for dynamic binary analysis
  • [299星][2m] [C] vusec/vuzzer depends heavily on a modeified version of DataTracker, which in turn depends on LibDFT pintool.
  • [148星][5y] [C++] f-secure/sulo Dynamic instrumentation tool for Adobe Flash Player built on Intel Pin
  • [123星][6m] [C++] hasherezade/tiny_tracer A Pin Tool for tracing API calls etc
  • [65星][3y] [C++] m000/dtracker DataTracker: A Pin tool for collecting high-fidelity data provenance from unmodified programs.
  • [60星][2y] [C++] hasherezade/mypintools Tools to run with Intel PIN
  • [48星][9m] [C++] angorafuzzer/libdft64 libdft for Intel Pin 3.x and 64 bit platform. (Dynamic taint tracking, taint analysis)
  • [48星][7y] [C++] cr4sh/code-coverage-analysis-tools Code coverage analysis tools for the PIN Toolkit
  • [39星][4y] [C++] corelan/pin Collection of pin tools
  • [36星][3y] [C++] paulmehta/ablation Augmenting Static Analysis Using Pintool: Ablation
  • [30星][4y] [C++] 0xddaa/pin Use Intel Pin tools to analysis binary.
  • [27星][1y] [C++] fdiskyou/winalloctracer Pintool that logs and tracks calls to RtlAllocateHeap, RtlReAllocateHeap, RtlFreeHeap, VirtualAllocEx, and VirtualFreeEx.
  • [26星][7y] [C++] jingpu/pintools
  • [25星][2m] [C++] boegel/mica a Pin tool for collecting microarchitecture-independent workload characteristics
  • [22星][6y] [C++] jbremer/pyn Awesome Python bindings for Pintool
  • [18星][1y] bash-c/pin-in-ctf 使用intel pin来求解一部分CTF challenge
  • [12星][3y] [C++] netspi/pin Intel pin tools
  • [6星][2y] [C++] spinpx/afl_pin_mode Yet another AFL instrumentation tool implemented by Intel Pin.

与其他工具交互

未分类

文章&&视频


Frida

工具

Frida

  • [4516星][13d] [Makefile] frida/frida Clone this repo to build Frida

新添加的

与其他工具交互

未分类
IDA
BinaryNinja
Radare2

文章&&视频


QBDI

工具

  • [578星][1y] [C++] qbdi/qbdi A Dynamic Binary Instrumentation framework based on LLVM.

文章&&视频


其他

工具

  • [171星][20d] [C] beehive-lab/mambo ARM运行时二进制文件修改工具,低耗版。
  • [73星][3y] [Py] carlosgprado/brundlefuzz BrundleFuzz is a distributed fuzzer for Windows and Linux using dynamic binary instrumentation.
  • [60星][1y] [C] zhechkoz/pwin Security Evaluation of Dynamic Binary Instrumentation Engines
  • [6星][4y] [C++] crackinglandia/exait-plugins Anti-Dynamic binary instrumentation plugins for eXait (

文章&&视频

其他


文章-新添加的


工具-新添加的


工具-其他


angr

工具

文章


Debug&&调试

工具

  • [1544星][6y] [Py] google/pyringe Debugger capable of attaching to and injecting code into python processes.
  • [1450星][10d] [Go] google/gapid Graphics API Debugger
  • [1422星][17d] [C++] eteran/edb-debugger edb is a cross platform AArch32/x86/x86-64 debugger.
  • [1413星][19d] [Go] cosmos72/gomacro Interactive Go interpreter and debugger with REPL, Eval, generics and Lisp-like macros
  • [1374星][4y] [C++] valvesoftware/vogl OpenGL capture / playback debugger.
  • [1275星][4m] [Go] solo-io/squash The debugger for microservices
  • [1147星][5m] [C++] cgdb/cgdb Console front-end to the GNU debugger
  • [1128星][20d] [C] blacksphere/blackmagic In application debugger for ARM Cortex microcontrollers.
  • [899星][10d] [Py] derekselander/lldb A collection of LLDB aliases/regexes and Python scripts to aid in your debugging sessions
  • [836星][8d] [C++] tasvideos/bizhawk BizHawk is a multi-system emulator written in C#. BizHawk provides nice features for casual gamers such as full screen, and joypad support in addition to full rerecording and debugging tools for all system cores.
  • [708星][2y] [Go] sidkshatriya/dontbug Dontbug is a reverse debugger for PHP
  • [627星][3y] [C] chokepoint/azazel Azazel is a userland rootkit based off of the original LD_PRELOAD technique from Jynx rootkit. It is more robust and has additional features, and focuses heavily around anti-debugging and anti-detection.
  • [573星][4y] [C++] microsoft/iediagnosticsadapter IE Diagnostics Adapter is a standalone exe that enables tools to debug and diagnose IE11 using the Chrome remote debug protocol.
  • [560星][21d] [C#] microsoft/miengine The Visual Studio MI Debug Engine ("MIEngine") provides an open-source Visual Studio Debugger extension that works with MI-enabled debuggers such as gdb, lldb, and clrdbg.
  • [521星][1y] [C] wubingzheng/memleax debugs memory leak of running process. Not maintained anymore, try libleak please.
  • [462星][5m] [C++] emoon/prodbg Debugging the way it's meant to be done
  • [430星][4y] [C] alonho/pytrace pytrace is a fast python tracer. it records function calls, arguments and return values. can be used for debugging and profiling.
  • [423星][4m] [C++] cobaltfusion/debugviewpp DebugView++, collects, views, filters your application logs, and highlights information that is important to you!
  • [418星][26d] [C++] simonkagstrom/kcov Code coverage tool for compiled programs, Python and Bash which uses debugging information to collect and report data without special compilation options
  • [377星][1m] [Py] pdbpp/pdbpp pdb++, a drop-in replacement for pdb (the Python debugger)
  • [354星][2y] [C++] glsl-debugger/glsl-debugger GLSL source level debugger.
  • [354星][8y] [Py] openrce/pydbg A pure-python win32 debugger interface.
  • [332星][8m] [Py] romanvm/python-web-pdb Web-based remote UI for Python's PDB debugger
  • [306星][21d] [Java] widdix/aws-s3-virusscan Free Antivirus for S3 Buckets
  • [291星][12d] [Py] sosreport/sos A unified tool for collecting system logs and other debug information
  • [289星][3y] [C++] develbranch/tinyantivirus TinyAntivirus is an open source antivirus engine designed for detecting polymorphic virus and disinfecting it.
  • [288星][2y] [Java] cnfree/eclipse-class-decompiler Eclipse Class Decompiler integrates JD, Jad, FernFlower, CFR, Procyon seamlessly with Eclipse and allows Java developers to debug class files without source code directly
  • [285星][2m] [C++] changeofpace/viviennevmm VivienneVMM is a stealthy debugging framework implemented via an Intel VT-x hypervisor.
  • [272星][4m] [Py] mariovilas/winappdbg WinAppDbg Debugger
  • [270星][21d] [Py] ionelmc/python-manhole Debugging manhole for python applications.
  • [267星][4y] [C] blankwall/macdbg Simple easy to use C and python debugging framework for OSX
  • [255星][3y] [Py] airsage/petrel Tools for writing, submitting, debugging, and monitoring Storm topologies in pure Python
  • [250星][2y] [Py] dbgx/lldb.nvim Debugger integration with a focus on ease-of-use.
  • [250星][2m] [Py] quantopian/qdb Quantopian Remote Debugger for Python
  • [240星][6m] [C++] facebook/ds2 Debug server for lldb.
  • [239星][8m] [C++] strivexjun/xantidebug VMProtect 3.x Anti-debug Method Improved
  • [239星][8m] [Py] beeware/bugjar A interactive graphical debugger for Python code.
  • [233星][2m] [Py] gilligan/vim-lldb lldb debugger integration plugin for vim
  • [220星][9m] letoram/senseye Dynamic Visual Debugging / Reverse Engineering Toolsuite
  • [218星][2m] [Py] nteseyes/pylane An python vm injector with debug tools, based on gdb.
  • [213星][12d] [C++] thalium/icebox Virtual Machine Introspection, Tracing & Debugging
  • [209星][2m] [C] joyent/mdb_v8 postmortem debugging for Node.js and other V8-based programs
  • [200星][6m] [C++] rainers/cv2pdb converter of DMD CodeView/DWARF debug information to PDB files
  • [184星][6m] [C] therealsaumil/static-arm-bins 静态编译的arm二进制文件, 用于调试和运行时分析
  • [182星][5y] [C] gdbinit/onyx-the-black-cat Kernel extension to disable anti-debug tricks and other useful XNU "features"
  • [164星][12d] [C++] devinacker/bsnes-plus debug-oriented fork of bsnes
  • [163星][3m] [JS] ant4g0nist/vegvisir 基于浏览器的LLDB 调试器
  • [163星][1m] [C++] jrfonseca/drmingw Postmortem debugging tools for MinGW.
  • [157星][2y] [C] armadito/armadito-av Armadito antivirus main repository
  • [154星][4y] [Py] kbandla/immunitydebugger ImmunityDebugger
  • [152星][5y] [Shell] hellman/fixenv Fix stack addresses (when no ASLR) with and without debugging
  • [151星][2y] [Py] reswitched/cagetheunicorn Debugging/emulating environment for Switch code
  • [146星][1m] [Py] wenzel/pyvmidbg LibVMI-based debug server, implemented in Python. Building a guest aware, stealth and agentless full-system debugger
  • [142星][2y] [C++] honorarybot/pulsedbg Hypervisor-based debugger
  • [137星][9m] [Py] nh2/strace-pipes-presentation 利用strace+管道/socket进行调试
  • [133星][4y] [C] jvoisin/pangu Toolkit to detect/crash/attack GNU debugging-related tools
  • [125星][5m] [Py] igio90/uddbg A gdb like debugger that provide a runtime env to unicorn emulator and additionals features!
  • [124星][3y] [Py] alonemonkey/antiantidebug tweak、 lldb python for anti anti debug
  • [120星][21d] [C++] intel/opencl-intercept-layer Intercept Layer for Debugging and Analyzing OpenCL Applications
  • [117星][4y] [Shell] dholm/dotgdb GDB scripts to add support for low level debugging and reverse engineering
  • [116星][2y] [C++] skylined/edgedbg A simple command line exe to start and debug the Microsoft Edge browser.
  • [109星][3m] [C] david-reguera-garcia-dreg/dbgchild Debug Child Process Tool (auto attach)
  • [108星][1m] [Pascal] fenix01/cheatengine-library Cheat Engine Library is based on CheatEngine a debugger and coding environment particularly aimed at games, but can also be used for other purposes like debugging applications and used in schools for teaching how computers work
  • [105星][2y] [C] formyown/alesense-antivirus 一款拥有完整交互界面与驱动级拦截能力的开源杀毒软件
  • [104星][1m] [C] checkpointsw/scout Instruction based research debugger
  • [103星][18d] stonedreamforest/mirage kernel-mode Anti-Anti-Debug plugin. based on intel vt-x && ept technology
  • [95星][2y] [C] cetfor/antidbg A bunch of Windows anti-debugging tricks.
  • [93星][12d] [JS] microsoftedge/jsdbg Debugging extensions for Microsoft Edge and other Chromium-based browsers
  • [86星][4y] [Py] sogeti-esec-lab/lkd Local Kernel Debugger (LKD) is a python wrapper around dbgengine.dll
  • [86星][2y] [Py] wasiher/chrome_remote_interface_python Chrome Debugging Protocol interface for Python
  • [86星][7y] [Py] stevenseeley/heaper heaper, an advanced heap analysis plugin for Immunity Debugger
  • [85星][21d] [Py] rocky/python2-trepan A gdb-like Python 2.x Debugger in the Trepan family
  • [82星][3m] [C] taviso/cefdebug Minimal code to connect to a CEF debugger.
  • [73星][5m] 0xd4d/dnspy-unity-mono Fork of Unity mono that's used to compile mono.dll with debugging support enabled
  • [70星][7m] [C++] thomasthelen/antidebugging A collection of c++ programs that demonstrate common ways to detect the presence of an attached debugger.
  • [70星][4y] [C++] waleedassar/antidebug Collection Of Anti-Debugging Tricks
  • [65星][5m] [C++] nccgroup/xendbg A feature-complete reference implementation of a modern Xen VMI debugger.
  • [64星][4y] [C#] wintellect/procmondebugoutput See your trace statements in Sysinternals Process Monitor
  • [59星][4y] [JS] auth0-blog/react-flux-debug-actions-sample This repository shows how you can use Flux actions to reproduce your user's issues in your own browser
  • [58星][3m] [Py] quarkslab/lldbagility A tool for debugging macOS virtual machines
  • [57星][6m] [JS] pownjs/pown-cdb Automate common Chrome Debug Protocol tasks to help debug web applications from the command-line and actively monitor and intercept HTTP requests and responses.
  • [54星][3m] [C#] southpolenator/sharpdebug C# debugging automation tool
  • [51星][3m] [C#] smourier/tracespy TraceSpy is a pure .NET, 100% free and open source, alternative to the very popular SysInternals DebugView tool.
  • [49星][1y] [C++] alphaseclab/anti-debug
  • [48星][4m] blackint3/awesome-debugging Why Debugging?(为什么要调试?)
  • [48星][9m] [C++] stoyan-shopov/troll troll:ARM Cortex-M 处理器 C 语言源码调试器
  • [44星][1y] [C#] micli/netcoredebugging A repository maintains the book of ".NET Core application debugging" sample code.
  • [44星][2y] [Py] zedshaw/zadm4py Zed's Awesome Debug Macros for Python
  • [43星][1y] [C++] johnsonjason/rvdbg RVDbg is a debugger/exception handler for Windows processes and has the capability to circumvent anti-debugging techniques. (Cleaner, documented code base being worked on in: core branch)
  • [42星][1m] [SystemVerilog] azonenberg/starshipraider High performance embedded systems debug/reverse engineering platform
  • [42星][5y] [C] cemeyer/msp430-emu-uctf msp430 emulator for uctf (with remote GDB debugging, reverse debugging, and optional symbolic execution)
  • [42星][2m] [Erlang] etnt/edbg edbg:基于 tty 的 Erlang 调试/追踪接口
  • [41星][4y] [Py] crowdstrike/pyspresso The pyspresso package is a Python-based framework for debugging Java.
  • [41星][2y] [C] seemoo-lab/nexmon_debugger Debugger with hardware breakpoints and memory watchpoints for BCM4339 Wi-Fi chips
  • [39星][7y] [C] gdbinit/gimmedebugah A small utility to inject a Info.plist into binaries.
  • [38星][2y] [C] shellbombs/strongod StrongOD(anti anti-debug plugin) driver source code.
  • [37星][3y] [C] 0xbadc0de1/vmp_dbg This is a VmProtect integrated debugger, that will essentially allow you to disasm and debug vmp partially virtualized functions at the vmp bytecode level. It was made using TitanEngine for the debug engine and Qt for the gui. Do not expect much of it and feel free to report any bugs.
  • [36星][3y] [C] adamgreen/mri MRI - Monitor for Remote Inspection. The gdb compatible debug monitor for Cortex-M devices.
  • [35星][2y] [Py] meyer9/ethdasm Tool for auditing Ethereum contracts
  • [35星][2m] [C] gdbinit/efi_dxe_emulator EFI DXE Emulator and Interactive Debugger
  • [34星][2y] [Py] g2p/vido wrap commands in throwaway virtual machines — easy kernel debugging and regression testing
  • [32星][4m] [C++] creaink/ucom A simple Serial-Port/TCP/UDP debugging tool.
  • [32星][4m] [C++] imugee/xdv XDV is disassembler or debugger that works based on the extension plugin.
  • [29星][6m] [C++] marakew/syser syser debugger x32/x64 ring3
  • [29星][3m] [C++] vertextoedge/windowfunctiontracer Window Executable file Function tracer using Debugging API
  • [28星][2y] [PS] enddo/hatdbg Minimal WIN32 Debugger in powershell
  • [28星][7y] [C] jonathansalwan/vmndh-2k12 Emulator, debugger and compiler for the NDH architecture - Emulator for CTF NDH 2k12
  • [27星][8y] [Py] fitblip/pydbg A pure-python win32 debugger interface.
  • [27星][2y] [C] okazakinagisa/vtbaseddebuggerwin7 Simple kernelmode driver.
  • [26星][6y] [Py] fireeye/pycommands PyCommand Scripts for Immunity Debugger
  • [25星][3y] [C] jacktang310/kerneldebugonnexus6p
  • [24星][1y] [Py] cosine0/amphitrite Symbolic debugging tool using JonathanSalwan/Triton
  • [22星][8m] [Py] laanwj/dwarf_to_c Tool to recover C headers (types, function signatures) from DWARF debug data
  • [22星][1y] [C#] malcomvetter/antidebug PoC: Prevent a debugger from attaching to managed .NET processes via a watcher process code pattern.
  • [22星][3y] [Assembly] osandamalith/anti-debug Some of the Anti-Debugging Tricks
  • [20星][5y] [C] tongzeyu/hooksysenter hook sysenter,重载内核,下硬件断点到debugport,防止debugport清零

文章


BAP

工具

文章


BinNavi

工具

文章


Decompiler&&反编译器

工具

文章


Disassemble&&反汇编

工具

文章


GDB

工具

  • [7019星][10d] [JS] cs01/gdbgui Browser-based frontend to gdb (gnu debugger). Add breakpoints, view the stack, visualize data structures, and more in C, C++, Go, Rust, and Fortran. Run gdbgui from the terminal and a new tab will open in your browser.
  • [6052星][13d] [Py] cyrus-and/gdb-dashboard Modular visual interface for GDB in Python
  • [3784星][11m] [Py] longld/peda Python Exploit Development Assistance for GDB
  • [2568星][1m] [Py] hugsy/gef gdb增强工具,使用Python API,用于漏洞开发和逆向分析。
  • [2439星][16d] [Py] pwndbg/pwndbg GDB插件,辅助漏洞开发和逆向
  • [1417星][3m] [Go] hellogcc/100-gdb-tips A collection of gdb tips. 100 maybe just mean many here.
  • [452星][3m] [Py] scwuaptx/pwngdb gdb for pwn
  • [446星][1y] [Py] jfoote/exploitable The 'exploitable' GDB plugin. I don't work at CERT anymore, but here is the original homepage:
  • [244星][2m] [JS] bet4it/hyperpwn A hyper plugin to provide a flexible GDB GUI with the help of GEF, pwndbg or peda
  • [208星][2m] [Py] sakhnik/nvim-gdb Neovim thin wrapper for GDB, LLDB and PDB
  • [196星][2y] [Py] sqlab/symgdb symbolic execution plugin for gdb
  • [186星][4y] [Py] leeyiw/cgdb-manual-in-chinese 《CGDB中文手册》
  • [174星][21d] [Shell] rocky/zshdb gdb-like "trepan" debugger for zsh
  • [152星][1m] [Py] rogerhu/gdb-heap Heap Analyzer for Python
  • [150星][1m] [Py] gdbinit/lldbinit A gdbinit clone for LLDB
  • [137星][2y] kevinsbobo/cheat-sheet 速查表包括了 Vim, Git, Shell, Gcc, Gdb 常用命令及快捷键
  • [132星][4y] [C] espressif/esp-gdbstub
  • [126星][3m] [Py] deroko/lldbinit Similar implementation of .gdbinit from fG
  • [101星][3m] [Py] cs01/pygdbmi A library to parse gdb mi output, as well as control gdb subprocesses
  • [93星][2m] [C] weirdnox/emacs-gdb GDB graphical interface for GNU Emacs
  • [93星][5y] [Py] zachriggle/peda PEDA - Python Exploit Development Assistance for GDB
  • [91星][5m] [Py] vuvova/gdb-tools Various tools to improve the gdb experience
  • [87星][2m] [Py] alset0326/peda-arm GDB plugin peda for arm
  • [85星][2y] [C] javierhonduco/write-a-strace-and-gdb A tiny system call tracer and debugger implementation
  • [79星][3m] [Py] miyagaw61/exgdb Extension for GDB
  • [73星][3m] hugsy/gdb-static Public repository of static GDB and GDBServer
  • [73星][21d] [Py] rocky/python3-trepan A gdb-like Python3 Debugger in the Trepan family
  • [69星][14d] [Py] koutheir/libcxx-pretty-printers GDB Pretty Printers for libc++ of Clang/LLVM
  • [62星][4m] [OCaml] copy/gdbprofiler Rich man's profiler, a profiler for native OCaml and other executables
  • [61星][1y] [Py] hq6/gdbshellpipe Enable piping of internal command output to external commands
  • [56星][5m] [Py] stef/pyrsp python implementation of the GDB Remote Serial Protocol
  • [54星][10m] [Shell] mzpqnxow/embedded-toolkit Prebuilt statically linked gdbserver and gawk executables for Linux on ARMEL, MIPS/MIPSEL and more platforms for use on embedded devices, including for systems with many different ABIs (including more than 20 statically linked gdbserver executables)
  • [52星][8y] [Py] crossbowerbt/gdb-python-utils A library for GDB (with python support), that adds useful functions to the standard 'gdb' library.
  • [52星][2y] [Go] cyrus-and/gdb Go GDB/MI interface
  • [47星][6y] [C] gdbinit/gdb-ng Apple's gdb fork with some fixes and enhancements
  • [46星][11m] [Shell] mzpqnxow/gdb-static-cross Shell scripts, sourceable "activate" scripts and instructions for building a statically linked gdb-7.12 gdbserver using cross-compile toolchains. Includes more than 20 statically linked gdbserver executables for different architectures, byte orders and ABIs
  • [46星][1m] [TeX] zxgio/gdb_gef-cheatsheet GDB + GEF cheatsheet for reversing binaries
  • [44星][2m] [Py] scwuaptx/peda PEDA - Python Exploit Development Assistance for GDB
  • [41星][4m] [Rust] cbourjau/cargo-with A third-party cargo extension to run the build artifacts through tools like gdb
  • [39星][2m] [Py] sharkdp/stack-inspector A gdb command to inspect the size of objects on the stack
  • [38星][10m] [Py] wapiflapi/gxf Gdb Extension Framework is a bunch of python code around the gdb api.
  • [37星][5y] [Py] philwantsfish/gdb_commands GDB commands to aid exploit development
  • [36星][9d] [Ruby] david942j/gdb-ruby It's time for Ruby lovers to use Ruby in gdb, and gdb in Ruby!
  • [36星][2y] [Py] tromey/gdb-gui A gdb gui written in Python, running inside gdb itself.
  • [33星][2m] [Py] akiym/pedal PEDAL - Python Exploit Development Assistance for GDB Lite
  • [33星][1y] [Py] damziobro/gdb-automatic-deadlock-detector Script adds new command to GDB which allows automatically detect C/C++ thread locking and deadlocks in GDB debugger
  • [25星][13d] [C] mborgerson/gdbstub A simple, dependency-free GDB stub that can be easily dropped in to your project.
  • [24星][1m] [Py] daskol/gdb-colour-filter Colourify backtrace output in GDB with Python API
  • [23星][1m] [Perl] occivink/kakoune-gdb gdb integration plugin
  • [23星][2y] [C] tommythorn/yari YARI is a high performance open source FPGA soft-core RISC implementation, binary compatible with MIPS I. The distribution package includes a complete SoC, simulator, GDB stub, scripts, and various examples.
  • [23星][3y] [Py] zachriggle/pwndbg GDB插件,辅助漏洞开发和逆向
  • [22星][3y] [Py] tromey/gdb-helpers GDB helper scripts
  • [21星][23d] [C] yugr/libdebugme Automatically spawn gdb on error.
  • [20星][6m] [Batchfile] cldrn/insecureprogrammingdb Insecure programming functions database
  • [20星][2y] [Py] kelwin/peda PEDA - Python Exploit Development Assistance for GDB
  • [19星][8d] [C#] sysprogs/bsptools Tools for generating VisualGDB BSPs
  • [18星][4y] [C] niklasb/dump-seccomp GDB plugin to dump SECCOMP rules set via prctnl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER)
  • [15星][3y] [C] andyneff/hello-world-gdb Simple hello world program for debugging with gdb
  • [15星][6y] gdbinit/kgmacros Fixed kgmacros to work with VMware kernel gdb stub
  • [15星][2y] [C] rkx1209/bitvisor-gdb gdbserver implementation on BitVisor
  • [15星][1m] [C++] satharus/disass [WIP] FOSS GNU Debugger (GDB) interface for GNU/Linux.
  • [14星][3y] [Py] 0xmitsurugi/gdbscripts Python scripts for gdb, reverse engineering oriented
  • [14星][3y] [JS] ben-ha/gdbface GDB web frontend written in Javascript
  • [14星][11m] [TeX] zxgio/gdb-cheatsheet GDB cheatsheet for reversing binaries
  • [13星][2y] [Py] pageflt/gdb-memstr Generate arbitrary strings out of contents of ELF sections
  • [10星][3y] [JS] gogoprog/atom-gdb Atom plugin to set gdb breakpoints in .gdbinit file and run an external debugger as QtCreator or ddd
  • [10星][2y] [Py] kikimo/pygdb pygdb:Linux 调试器,支持 dwarf-2 调试信息,能调试 x86/x64 程序
  • [10星][26d] [C] resetnow/esp-gdbstub ESP8266 debugging tool
  • [10星][2y] [Py] stephenr/gdb_scripts
  • [8星][5y] [Py] ctu-iig/802.11p-wireless-regdb Wireless regulatory database for CRDA
  • [4星][11m] [C] adapteva/epiphany-binutils-gdb Merged gdb and binutils repository
  • [3星][1y] [Py] grant-h/gdbscripts An assorted collection of GDB scripts.
  • [2星][4m] [Py] artem-nefedov/uefi-gdb UEFI OVMF symbol load script for GDB
  • [2星][9m] [C#] sysprogs/visualgdbextensibilityexamples
  • [2星][2y] [Py] tentpegbob/ropgadget Extends ROPgadget so that it can be used inside of GDB via Python.
  • [1星][3y] elauqsap/vtgdb vulnerability and threat repository using a graph architecture
  • [1星][2y] [Py] monkeyman79/janitor Collection of GDB commands for low-level debugging, aimed at bringing debug.exe flavor into GDB command line interface.
  • [0星][4y] [Py] 0xd3d0/pygdb Automatically exported from code.google.com/p/pygdb
  • [0星][2y] [JS] pgigis/routingdb
  • [None星]sha0coder/gdb_automatization

文章


Monitor&&监控&&Trace&&追踪

工具

Radare2


插件&&脚本

Radare2

  • [11588星][12d] [C] radareorg/radare2 unix-like reverse engineering framework and commandline tools

新添加的

与其他工具交互

未分类

IDA

GUI

GUI

Cutter


文章&&视频

未分类

Cutter

BinaryNinja


插件&&脚本

新添加的

与其他工具交互

未分类

IDA


文章&&视频

Windows


PE

工具

  • [877星][8m] [Py] erocarrera/pefile pefile is a Python module to read and work with PE (Portable Executable) files
  • [634星][10d] [C] thewover/donut Generates x86, x64, or AMD64+x86 position-independent shellcode that loads .NET Assemblies, PE files, and other Windows payloads from memory and runs them with parameters
  • [537星][1y] [C#] ghostpack/safetykatz Mimikatz和 .NET PE Loader的结合
  • [522星][4y] [C] jondonym/peinjector peinjector - MITM PE file infector
  • [426星][2y] [Py] endgameinc/gym-malware 基于OpenAI Gym 实现的恶意代码操作环境,其目标是实现可以学习如何修改 PE 文件以达到特定目的(例如绕过AV)的 agent。(OpenAIGym:开发和通过比较强化学习算法的工具包)
  • [388星][1y] [Assembly] hasherezade/pe_to_shellcode Converts PE into a shellcode
  • [385星][3m] [Jupyter Notebook] endgameinc/ember 110万PE文件的数据集合, 可用于训练相关模型. PE文件信息主要包括: SHA256/histogram(直方图)/byteentropy(字节熵)/字符串/PE头信息/段信息/导入表/导出表
  • [365星][2y] petoolse/petools PE Tools - Portable executable (PE) manipulation toolkit
  • [344星][1y] [Assembly] egebalci/amber 反射式PE加壳器,用于绕过安全产品和缓解措施
  • [337星][5m] [C] merces/pev The PE file analysis toolkit
  • [316星][24d] [C++] trailofbits/pe-parse Principled, lightweight C/C++ PE parser
  • [315星][14d] [VBA] itm4n/vba-runpe A VBA implementation of the RunPE technique or how to bypass application whitelisting.
  • [296星][12d] [C++] hasherezade/libpeconv 用于映射和取消映射PE 文件的库
  • [285星][7m] [Java] katjahahn/portex Java library to analyse Portable Executable files with a special focus on malware analysis and PE malformation robustness
  • [283星][2y] [C++] google/syzygy a suite of tools for the instrumentation of COFF object files and PE binaries
  • [227星][3y] [C++] secrary/infectpe Inject custom code into PE file [This project is not maintained anymore]
  • [189星][5y] [C++] rwfpl/rewolf-x86-virtualizer Simple VM based x86 PE (portable exectuable) protector.
  • [151星][6y] [Py] hiddenillusion/analyzepe Wraps around various tools and provides some additional checks/information to produce a centralized report of a PE file.
  • [146星][5m] [C++] darthton/polychaos PE permutation library
  • [140星][1y] [Py] codypierce/hackers-grep hackers-grep is a utility to search for strings in PE executables including imports, exports, and debug symbols
  • [137星][22d] [Py] rvn0xsy/cooolis-ms Cooolis-ms is a server that supports the Metasploit Framework RPC. It is used to work with the Shellcode and PE loader. To some extent, it bypasses the static killing of anti-virus software, and allows the Cooolis-ms server to communicate with the Metasploit server. Separation.
  • [129星][3m] [C++] nettitude/simplepeloader In-Memory PE Loader
  • [122星][3y] [C] l0n3c0d3r/ceed A tiny x86 compiler with ELF and PE target
  • [111星][2m] [C] hasherezade/chimera_pe ChimeraPE (a PE injector type - alternative to: RunPE, ReflectiveLoader, etc) - a template for manual loading of EXE, loading imports payload-side
  • [111星][2m] [C] hasherezade/chimera_pe ChimeraPE (a PE injector type - alternative to: RunPE, ReflectiveLoader, etc) - a template for manual loading of EXE, loading imports payload-side
  • [110星][7y] [C++] abhisek/pe-loader-sample Proof of concept implementation of in-memory PE Loader based on ReflectiveDLLInjection Technique
  • [105星][6y] [Py] secretsquirrel/recomposer Randomly changes Win32/64 PE Files for 'safer' uploading to malware and sandbox sites.
  • [96星][2y] [C++] hasherezade/pe_recovery_tools Helper tools for recovering dumped PE files
  • [88星][3y] [C++] egebalci/cminer Cminer is a tool for enumerating the code caves in PE files.
  • [83星][2y] [C++] benjaminsoelberg/reflectivepeloader Reflective PE loader for DLL injection
  • [49星][7y] [C++] frankstain/pe-loader library, which help to describe or load and execute PE files.
  • [45星][2m] [C++] avast/pelib PE file manipulation library.
  • [42星][1y] [Py] jpcertcc/impfuzzy Fuzzy Hash calculated from import API of PE files
  • [38星][3y] [Py] cysinfo/pymal PyMal is a python based interactive Malware Analysis Framework. It is built on the top of three pure python programes Pefile, Pydbg and Volatility.
  • [38星][1m] [YARA] te-k/pe CLI tool to analyze PE files
  • [37星][3y] [Py] dungtv543/dutas Analysis PE file or Shellcode
  • [35星][4y] [C] motazreda/malwarefragmentationtool Malware Fragmentation Tool its a tool that simply fragment the PE file and it can disassemble the PE file, etc this tool very useful for people who do malware research or analysis for pe_files
  • [33星][3y] [HTML] wolfram77web/app-peid PEiD detects most common packers, cryptors and compilers for PE files.
  • [32星][1y] [C++] ntraiseharderror/dreadnought PoC for detecting and dumping code injection (built and extended on UnRunPE)
  • [31星][2y] [Py] ihack4falafel/subrosa Basic tool to automate backdooring PE files
  • [30星][1y] [C++] ntraiseharderror/unrunpe PoC for detecting and dumping process hollowing code injection
  • [29星][2y] [Py] ice3man543/malscan A Simple PE File Heuristics Scanners
  • [29星][2y] [C] jnastarot/native_peloader PE(compressed dll) memory loader using nt api
  • [29星][4m] [Py] obscuritylabs/pefixup PE File Blessing - To continue or not to continue
  • [28星][1y] [C++] jiazhang0/seloader Secure EFI Loader designed to authenticate the non-PE files
  • [27星][5y] [Py] matonis/rippe ripPE - section extractor and profiler for PE file analysis
  • [26星][2y] [C++] kernelm0de/runpe-processhollowing RunPE
  • [24星][6y] [C++] edix/malwareresourcescanner Scanning and identifying XOR encrypted PE files in PE resources
  • [24星][2y] [C++] polycone/pe-loader A Windows PE format file loader
  • [21星][3m] [C] jackullrich/trunpe A modified RunPE (process hollowing) technique avoiding the usage of SetThreadContext by appending a TLS section which calls the original entrypoint.
  • [18星][3y] [Py] 0xyg3n/mem64 Run Any Native PE file as a memory ONLY Payload , most likely as a shellcode using hta attack vector which interacts with Powershell.
  • [17星][5y] [C] maldevel/pedumper Dump Windows PE file information in C
  • [16星][2y] [Py] aserper/ahk-dumper Ahk-dumper is a tool to dump AutoHotKey code from the RDATA section of a PE file.
  • [14星][7m] [Assembly] egebalci/iat_api Assembly block for finding and calling the windows API functions inside import address table(IAT) of the running PE file.
  • [14星][2y] [C++] wyexe/peloader
  • [12星][1y] [Go] egebalci/mappe MapPE constructs the memory mapped image of given PE files.
  • [10星][3y] [Py] cloudtracer/pefile.pypy Pypy.js compatible version of pefile.py for use in offline browser implementation
  • [10星][3y] johntroony/pe-codecaving Work files for my blog post "Code Caving in a PE file.
  • [10星][5y] [C++] opensecurityresearch/slacker A prototype file slack space remover
  • [8星][2y] [C] in3o/binclass Recovering Object information from a C++ compiled Binary/Malware (mainly written for PE files) , linked dynamically and completely Stripped.
  • [8星][3y] [C++] thecxx/image PE Loader for win32
  • [5星][2y] [Py] deadbits/pe-static Static file analysis for PE files
  • [5星][2y] [C] jmcph4/peek PEek is a simple PE file viewer.
  • [5星][4y] [C++] waleedassar/timedatestamp Discover TimeDateStamps In PE File
  • [5星][11m] [Go] abdullah2993/go-runpe
  • [3星][2y] [C++] kernelm0de/runpe_detecter RunPE Detecter
  • [2星][4y] [Py] missmalware/importdict An easy way to identify imports of interest in a PE file
  • [0星][9m] [Py] 0xd0cf11e/pefile Anything related to PE Files

文章


DLL

新添加

工具

文章

DLL注入

工具

文章

DLL劫持

工具

文章


UAC

工具

文章


Sysmon

工具

文章


ETW

工具

  • [1228星][10d] [JS] jpcertcc/logontracer 通过可视化和分析Windows事件日志来调查恶意的Windows登录
  • [865星][22d] [C++] google/uiforetw User interface for recording and managing ETW traces
  • [654星][10m] [Roff] palantir/windows-event-forwarding 使用 Windows 事件转发实现网络事件监测和防御
  • [640星][3y] [PS] hlldz/invoke-phant0m Windows Event Log Killer
  • [609星][19d] [PS] sbousseaden/evtx-attack-samples 与特定攻击和利用后渗透技术相关的Windows事件样例
  • [504星][10m] [C#] lowleveldesign/wtrace Command line tracing tool for Windows, based on ETW.
  • [479星][5m] [PS] sans-blue-team/deepbluecli a PowerShell Module for Threat Hunting via Windows Event Logs
  • [446星][9m] [PS] nsacyber/event-forwarding-guidance 帮助管理员使用Windows事件转发(WEF)收集与安全相关的Windows事件日志
  • [393星][10m] [Py] williballenthin/python-evtx 纯Python编写的Windows事件日志解析器
  • [341星][1y] [C++] qax-a-team/eventcleaner A tool mainly to erase specified records from Windows event logs, with additional functionalities.
  • [306星][1m] [C#] zodiacon/procmonx 通过Windows事件日志获取与Process Monitor显示的相同的信息,无需内核驱动
  • [282星][3m] [C#] fireeye/silketw flexible C# wrappers for ETW
  • [282星][10m] [C#] nsacyber/windows-event-log-messages 检索Windows二进制文件中嵌入的Windows事件日志消息的定义,并以discoverable的格式提供它们
  • [261星][3m] [C++] gametechdev/presentmon Tool for collection and processing of ETW events related to DXGI presentation.
  • [249星][3m] [C++] microsoft/krabsetw KrabsETW provides a modern C++ wrapper and a .NET wrapper around the low-level ETW trace consumption functions.
  • [214星][2y] [Py] thiber-org/userline 从Windows安全事件中查询并报告用户登录关系
  • [146星][5m] [Py] fireeye/pywintrace Python 编写的 ETW(Event Tracing for Windows) Wrapper
  • [144星][2y] [PS] jepaynemsft/weffles Build a fast, free, and effective Threat Hunting/Incident Response Console with Windows Event Forwarding and PowerBI
  • [128星][4m] [Py] mvelazc0/oriana Oriana is a threat hunting tool that leverages a subset of Windows events to build relationships, calculate totals and run analytics. The results are presented in a Web layer to help defenders identify outliers and suspicious behavior on corporate environments.
  • [99星][3y] [C#] cyberpoint/ruxcon2016etw Ruxcon2016 POC Code
  • [82星][2y] [C#] zacbrown/powerkrabsetw PowerKrabsEtw is a PowerShell interface for doing real-time ETW tracing.
  • [70星][5m] [Py] dgunter/evtxtoelk A lightweight tool to load Windows Event Log evtx files into Elasticsearch.
  • [54星][6m] [PS] tasox/logrm LogRM is a post exploitation powershell script which it uses windows event logs to gather information about internal network
  • [47星][2y] [Py] devgc/eventmonkey A Windows Event Processing Utility
  • [43星][2y] [C#] zacbrown/hiddentreasure-etw-demo 在内存取证中,使用 ETW(Windows事件追踪) 挖掘宝藏的新方式
  • [30星][2y] [C#] zacbrown/powershellmethodauditor PowerShellMethodAuditor listens to the PowerShell ETW provider and logs PowerShell method invocations.
  • [29星][2y] [C#] aviavni/nativeleakdetector Win32 memory leak detector with ETW
  • [28星][5m] fuzzysecurity/bh-arsenal-2019 SilkETW & SilkService
  • [27星][4y] [Py] williballenthin/python-evt Pure Python parser for classic Windows Event Log files (.evt)
  • [22星][4y] [C#] lallousx86/wepexplorer Windows Events Providers Explorer
  • [12星][1y] [PS] piesecurity/windowseventstocsvtimeline Simple Powershell scripts to collect all Windows Event Logs from a host and parse them into one CSV timeline.
  • [7星][4m] [PS] 1cysw0rdk0/whodunnit A PS forensics tool for Scraping, Filtering and Exporting Windows Event Logs
  • [7星][5y] [R] holisticinfosec/eventviz EventViz Windows event log viewer
  • [4星][3m] [C#] ceramicskate0/swelf Simple Windows Event Log Forwarder (SWELF). Its easy to use/simply works Log Forwarder, EVTX Parser and Reader. Make it your log forwarder through the configuration of the software. Now in early release here at
  • [2星][1y] [C++] randomascii/bigfiles This repo exists for storing large data files such as ETW traces or crash dumps, often associated with blog posts

文章


AppLocker

工具

文章


工具

新添加的

Procmon

  • [9星][3y] [C#] lowleveldesign/send2procmon A command line tool that sends its input data to a running procmon instance.
  • [0星][6y] [Py] ldh0227/pmonparser Process Monitor Log File Parser (Only Input Support csv format)
  • [0星][8m] [Py] xrkk/procmonlogfilter 解析ProcessMonitor生成的日志,过滤有效信息,并导入IDA等工具中查看。(代码编写于2017年,此处仅做备份。)

.NET

  • [12676星][14d] [C#] 0xd4d/dnspy .NET debugger and assembly editor
  • [9261星][11d] [C#] icsharpcode/ilspy .NET Decompiler
  • [3694星][27d] [C#] 0xd4d/de4dot .NET deobfuscator and unpacker.
  • [3263星][7m] [JS] sindresorhus/speed-test Test your internet connection speed and ping using speedtest.net from the CLI
  • [1657星][14d] [C#] jbevain/cecil C#库, 探查/修改/生成 .NET App/库
  • [251星][1y] [C#] brianhama/de4dot .NET deobfuscator and unpacker.
  • [217星][11m] [C#] rainwayapp/warden Warden.NET is an easy to use process management library for keeping track of processes on Windows.
  • [173星][2m] [ASP] lowleveldesign/debug-recipes My notes collected while debugging various .NET and Windows problems.
  • [70星][8m] [C#] fsecurelabs/sharpcliphistory SharpClipHistory is a .NET application written in C# that can be used to read the contents of a user's clipboard history in Windows 10 starting from the 1809 Build.
  • [52星][16d] [C#] 9ee1/capstone.net .NET Core and .NET Framework binding for the Capstone Disassembly Framework

Environment&&环境&&配置

进程注入

代码注入

内存模块

VT&&虚拟化&&Hypbervisor

  • [1348星][22d] [C] intel/haxm Intel 开源的英特尔硬件加速执行管理器,通过硬件辅助的虚拟化引擎,加速 Windows/macOS 主机上的 IA emulation((x86/ x86_64) )
  • [1011星][1y] [C] ionescu007/simplevisor 英特尔VT-x虚拟机管理程序,简单、可移植。支持Windows和UEFI
  • [717星][23d] [C++] tandasat/hyperplatform 基于Intel VT-x的虚拟机管理程序,旨在在Windows上提供精简的VM-exit过滤平台
  • [570星][12m] [C] asamy/ksm 快速、hackable且简单的x64 VT-x虚拟机管理程序,支持Windows和Linux
  • [449星][3y] [POV-Ray SDL] hzqst/syscall-monitor 使用Intel VT-X/EPT实现的系统调用追踪工具,类似于Sysinternal的Process Monitor,支持Win7+
  • [189星][10m] [C++] kelvinhack/khypervisor 适用于Windows的类似于bluepill的轻量级、嵌套VMM,提供并模拟英特尔VT-x的基本功能

内核&&驱动

注册表

系统调用

其他

  • [1296星][4y] [C++] microsoft/microsoft-pdb Microsoft提供的有关PDB格式的信息
  • [949星][3m] [C] basil00/divert 用户模式数据包拦截库,适用于Win 7/8/10
  • [863星][14d] [C++] henrypp/simplewall 为Windows 过滤平台提供的配置界面
  • [726星][2m] [Py] diyan/pywinrm Python实现的WinRM客户端
  • [578星][3y] [Pascal] t-d-k/librecrypt Windows的透明、即时磁盘加密,兼容LUKS
  • [570星][1m] [C] hfiref0x/winobjex64 Windows对象浏览器. x64
  • [463星][8m] [C#] microsoft/dbgshell PowerShell编写的Windows调试器引擎前端
  • [418星][15d] [C] samba-team/samba 适用于Linux和Unix的标准Windows interoperability程序套件
  • [405星][3y] [C++] rwfpl/rewolf-wow64ext 在64位Windows系统上的WOW64 layer下运行x86程序
  • [403星][3y] [C#] zenlulz/memorysharp Windows程序内存编辑库,C#编写,可向远程进程注入输入和代码,或读取远程进程内存
  • [389星][2m] [C#] microsoft/binskim 二进制静态分析工具,可为PE和ELF二进制格式提供安全性和正确性分析
  • [387星][19d] [Jupyter Notebook] microsoft/windowsdefenderatp-hunting-queries 在MS Defender ATP中进行高级查询的示例
  • [370星][27d] [Ruby] winrb/winrm 在Windows中使用WinRM的功能调用原生对象的SOAP库。Ruby编写
  • [367星][1y] [PS] netspi/pesecurity 检查PE(EXE/DLL)编译选项是否有:ASLR, DEP, SafeSEH, StrongNaming, Authenticode。PowerShell模块
  • [360星][12d] [C#] digitalruby/ipban 监视Windows/Linux系统的登录失败和不良行为,并封禁对应的IP地址。高度可配置,精简且功能强大。
  • [353星][2y] [C++] zerosum0x0/winrepl 实现了“读取->执行->打印 循环”的Windows汇编代码,x86+x64
  • [318星][3y] [C] sdhand/x11fs 操作X windows
  • [298星][3y] [C++] googleprojectzero/symboliclink-testing-tools 用于测试Windows的各种符号链接类型的一套工具
  • [289星][2y] [C++] godaddy/procfilter Windows 进程过滤系统。可以使用 Yara 规则匹配进程模块,从而阻止匹配的进程启动
  • [281星][1y] [C++] fireeye/flare-wmi 描述Windows管理规范(WMI)技术的各种文档和代码项目
  • [269星][12m] [Py] hakril/pythonforwindows 简化Python与Windows操作系统交互的库
  • [238星][5m] [PS] microsoft/aaronlocker Windows应用程序白名单
  • [233星][10m] [Go] masterzen/winrm Windows远程命令执行,命令行工具+库,Go编写
  • [232星][1y] [C++] ionescu007/simpleator Windows x64用户模式应用程序模拟器
  • [229星][4m] [C] tishion/mmloader 绕过Windows PE Loader,直接从内存中加载DLL模块(x86/x64)
  • [228星][3m] [C] leecher1337/ntvdmx64 在64位版本上执行Windows DOS版的 NTVDM
  • [226星][1y] [C++] rexdf/commandtrayhost 监控Windows systray的命令行工具
  • [222星][2y] [C++] intelpt/windowsintelpt 实现Intel Skylake架构下的Intel处理器追踪功能的Windows驱动
  • [210星][3m] adguardteam/adguardforwindows Windows系统范围的AdBlocker
  • [208星][10m] [C] hzqst/unicorn_pe 模拟Windows PE文件的代码执行,基于Unicorn
  • [206星][3y] [C++] k2/ehtrace 跟踪Windows上二进制文件的执行。
  • [205星][3m] [C] jasonwhite/ducible 使PE和PDB的构建具有可复制性
  • [202星][2y] [Py] euske/pyrexecd 独立的SSH服务器(Windows)
  • [193星][11m] [C] ionescu007/winipt 利用Win10 1809添加的Intel处理器追踪功能进行进程追踪
  • [192星][1m] [C++] blackint3/openark 反Rootkit工具(Windows)
  • [192星][3y] [Ruby] zed-0xff/pedump 转储PE文件,Ruby编写
  • [174星][3y] [C#] gangzhuo/kcptun-gui-windows 隧道工具kcptun的GUI
  • [171星][2m] [Py] gleeda/memtriage 快速查询Windows计算机上的内存。使用Winpmem驱动访问物理内存,使用Volatility分析
  • [164星][3y] [C++] zer0mem0ry/runpe 在与主机进程相同的地址空间中运行另一个Windows PE
  • [163星][2m] [PS] dsccommunity/activedirectorydsc 包含用于部署和配置Active Directory的DSC资源
  • [158星][7m] [C#] wohlstand/destroy-windows-10-spying 禁用/销毁Windows的间谍功能
  • [151星][3y] [C] pustladi/windows-2000 Windows 2000专业版的源码
  • [151星][2y] [Rust] trailofbits/flying-sandbox-monster 如何将 Windows Defender 放到沙箱中运行,以及关于 Windows 系统上 Rust 的若干思考
  • [149星][1y] [C++] justasmasiulis/nt_wrapper 对原生Windows系统API的Wrapper
  • [143星][11d] [C#] microsoft/windowsprotocoltestsuites 针对Windows开放规范的实现提供了互操作性测试
  • [137星][4y] [Py] pentestmonkey/pysecdump 从Windows系统中转储安全相关信息,Python编写
  • [136星][6y] [C++] zer0fl4g/nanomite Windows上用于x64和x86的图形调试器
  • [135星][2m] [C] nomorefood/putty-cac Windows 安全Shell客户端,支持智能卡&证书
  • [134星][2y] [Py] binarydefense/auto-ossec 为Linux和Windows自动配置OSSEC代理
  • [134星][7m] [CMake] pothosware/pothossdr Pothos SDR Windows开发环境
  • [133星][1y] [C++] 3gstudent/eventlogedit-evtx--evolution 从Windows XML事件日志(EVTX)文件中删除个别行
  • [133星][3y] [C++] ioactive/i-know-where-your-page-lives 对的Windows 10内核进行非随机化
  • [129星][2y] [Py] dviros/rat-via-telegram 使用Telegram控制已经攻克的Windows主机
  • [124星][5m] [Py] fireeye/flare-qdb 操纵和修改Windows和Linux的软件行为的调试器,包括命令行工具和Python调试器
  • [116星][3y] [Batchfile] bartblaze/disable-intel-amt Windows系统禁用AMT
  • [115星][8m] [C++] dragonquesthero/pubg-pak-hacker 使用Windows内核驱动隐藏文件及自身,绕过BE
  • [114星][4y] [C++] chengchengcc/ark-tools Windows Ark 工具的工程和一些demo
  • [111星][8m] [C] wbenny/ksocket 在Windows驱动中使用WSK建立网络连接的示例
  • [108星][2m] [PS] powershell/windowscompatibility Module that allows Windows PowerShell Modules to be used from PSCore6
  • [107星][1m] [Py] ernw/windows-insight The content of this repository aims to assist efforts on analysing inner working principles, functionalities, and properties of the Microsoft Windows operating system. This repository stores relevant documentation as well as executable files needed for conducting analysis studies.
  • [107星][5y] [C] malwaretech/tinyxpb Windows XP 32-Bit Bootkit
  • [106星][2y] [C++] zerosum0x0/puppetstrings Hitch a free ride to Ring 0 on Windows
  • [105星][4m] soffensive/windowsblindread A list of files / paths to probe when arbitrary files can be read on a Microsoft Windows operating system
  • [105星][11m] [Py] thelinuxchoice/pyrat Windows远控
  • [104星][2y] [C++] iceb0y/windows-container A lightweight sandbox for Windows application
  • [102星][3m] [C++] giovannidicanio/winreg Convenient high-level C++ wrapper around the Windows Registry API
  • [100星][2y] [C] shellster/dcsyncmonitor Monitors for DCSYNC and DCSHADOW attacks and create custom Windows Events for these events.
  • [100星][2m] [C#] tyranid/windowsrpcclients This respository is a collection of C# class libraries which implement RPC clients for various versions of the Windows Operating System from 7 to Windows 10.
  • [98星][10d] [C] libyal/libevtx Library and tools to access the Windows XML Event Log (EVTX) format
  • [97星][3y] [C++] luctalpe/wmimon Tool to monitor WMI activity on Windows
  • [96星][2y] [PS] australiancybersecuritycentre/windows_event_logging Windows Event Forwarding subscriptions, configuration files and scripts that assist with implementing ACSC's protect publication, Technical Guidance for Windows Event Logging.
  • [96星][4y] [PS] nsacyber/certificate-authority-situational-awareness Identifies unexpected and prohibited certificate authority certificates on Windows systems. #nsacyber
  • [94星][11m] [PS] equk/windows tweaks for Windows
  • [93星][2y] [C++] kentonv/dvorak-qwerty "Dvorak-Qwerty ⌘" (DQ) keyboard layout for Windows and Unix/Linux/X
  • [89星][2y] [PS] realparisi/wmi_monitor Log newly created WMI consumers and processes to the Windows Application event log
  • [89星][17d] [C++] sinakarvandi/process-magics This is a collection of interesting codes about Windows Process creation.
  • [89星][22d] [C] vigem/hidguardian Windows kernel-mode driver for controlling access to various input devices.
  • [87星][1y] [PS] deepzec/win-portfwd Powershell script to setup windows port forwarding using native netsh client
  • [87星][8y] [C] zoloziak/winnt4 Windows NT4 Kernel Source code
  • [86星][1y] [C++] malwaretech/appcontainersandbox An example sandbox using AppContainer (Windows 8+)
  • [86星][4y] [JS] nsacyber/locklevel A prototype that demonstrates a method for scoring how well Windows systems have implemented some of the top 10 Information Assurance mitigation strategies. #nsacyber
  • [84星][3y] [C++] outflanknl/netshhelperbeacon Example DLL to load from Windows NetShell
  • [83星][1y] [Py] silascutler/lnkparse Windows Shortcut file (LNK) parser
  • [82星][2m] [C] 0xcpu/winaltsyscallhandler Some research on AltSystemCallHandlers functionality in Windows 10 20H1 18999
  • [82星][5y] [C] nukem9/virtualdbghide Windows kernel mode driver to prevent detection of debuggers.
  • [82星][2y] [Go] snail007/autostart autostart tools to set your application auto startup after desktop login,only for desktop version of linux , windows , mac.
  • [81星][13d] [C] andreybazhan/symstore The history of Windows Internals via symbols.
  • [80星][3y] [C++] cbayet/poolsprayer Simple library to spray the Windows Kernel Pool
  • [80星][3y] [C++] wpo-foundation/win-shaper Windows traffic-shaping packet filter
  • [75星][1m] [C++] sidyhe/dxx Windows Kernel Driver with C++ runtime
  • [74星][2y] [C++] eyeofra/winconmon Windows Console Monitoring
  • [72星][5y] [C#] khr0x40sh/whitelistevasion Collection of scripts, binaries and the like to aid in WhiteList Evasion on a Microsoft Windows Network.
  • [71星][10m] [PS] iamrootsh3ll/anchorwatch A Rogue Device Detection Script with Email Alerts Functionality for Windows Subsystem
  • [70星][4y] [C++] nccgroup/windowsdaclenumproject A collection of tools to enumerate and analyse Windows DACLs
  • [69星][11m] [PS] itskindred/winportpush A simple PowerShell utility used for pivoting into internal networks via a compromised Windows host.
  • [68星][20d] [C++] nmgwddj/learn-windows-drivers Windows drivers 开发的各个基础示例,包含进程、内存、注册表、回调等管理
  • [68星][1m] [PS] dsccommunity/certificatedsc This DSC Resource module can be used to simplify administration of certificates on a Windows Server.
  • [67星][4m] [Go] 0xrawsec/gene Signature Engine for Windows Event Logs
  • [66星][2y] [C#] parsingteam/teleshadow2 TeleShadow - Telegram Desktop Session Stealer (Windows)
  • [66星][5y] [C++] rwfpl/rewolf-dllpackager Simple tool to bundle windows DLLs with PE executable
  • [65星][8m] [C] xiao70/x70fsd Windows file system filter drivers(minifilter) to encrypt, compress, or otherwise modify file-based data require some of the most complex kernel software developed for Windows.
  • [63星][6m] [PS] rgl/windows-domain-controller-vagrant Example Windows Domain Controller
  • [62星][3y] [C] arvanaghi/windows-dll-injector A basic Windows DLL injector in C using CreateRemoteThread and LoadLibrary. Implemented for educational purposes.
  • [62星][4y] [Py] poorbillionaire/windows-prefetch-parser Parse Windows Prefetch files: Supports XP - Windows 10 Prefetch files
  • [62星][1y] tyranid/windows-attacksurface-workshop Workshop material for a Windows Attack Surface Analysis Workshop
  • [61星][5y] [C] evilsocket/libpe A C/C++ library to parse Windows portable executables written with speed and stability in mind.
  • [61星][3y] [C++] maldevel/driver-loader Windows驱动加载器
  • [61星][1y] [Py] srounet/pymem A python library for windows, providing the needed functions to start working on your own with memory editing.
  • [61星][1y] [C++] tandasat/debuglogger A software driver that lets you log kernel-mode debug output into a file on Windows.
  • [60星][3y] [PS] kevin-robertson/conveigh Conveigh is a Windows PowerShell LLMNR/NBNS spoofer detection tool
  • [60星][2m] [Go] konimarti/opc OPC DA client in Golang for monitoring and analyzing process data based on Windows COM.
  • [59星][8d] [C++] henrypp/errorlookup Simple tool for retrieving information about Windows errors codes.
  • [59星][4y] [Py] psychomario/pyinject A python module to help inject shellcode/DLLs into windows processes
  • [58星][5y] [C] hackedteam/soldier-win RCS Soldier for Windows
  • [57星][7m] [PS] gnieboer/gnuradio_windows_build_scripts A series of Powershell scripts to automatically download, build from source, and install GNURadio and -all- it's dependencies as 64-bit native binaries then package as an msi using Visual Studio 2015
  • [57星][6y] [Assembly] hackedteam/core-win64 RCS Agent for Windows (64bit)
  • [57星][2y] [C#] mch2112/sharp80 TRS80 Emulator for Windows
  • [55星][3y] [C#] nccgroup/mnemosyne mnemosyne:通用Windows内存抓取工具
  • [55星][1y] [C#] tyranid/windowsruntimesecuritydemos Demos for Presentation on Windows Runtime Security
  • [54星][26d] [Go] giuliocomi/backoori Tool aided persistence via Windows URI schemes abuse
  • [53星][2y] [C#] guardicore/azure_password_harvesting Plaintext Password harvesting from Azure Windows VMs
  • [53星][5y] [C++] hackedteam/core-win32 RCS Agent for Windows (32bit)
  • [52星][2m] [TSQL] horsicq/xntsv XNTSV program for detailed viewing of system structures for Windows.
  • [52星][1y] [PS] pldmgg/winadmincenterps Copy of Windows Admin Center (
  • [51星][1y] [C++] tomladder/winlib Windows Manipulation Library (x64, User/Kernelmode)
  • [50星][7m] [C] hfiref0x/mpenum Enumerate Windows Defender threat families and dump their names according category
  • [50星][3y] [Py] matthewdunwoody/block-parser Parser for Windows PowerShell script block logs
  • [49星][3y] [Py] dfirfpi/dpapilab Windows DPAPI laboratory
  • [49星][3y] [PS] enclaveconsulting/crypto-pki Scripts related to Windows cryptography and PKI.
  • [49星][7m] [C++] 0x00-0x00/cve-2019-0841-bypass A fully automatic CVE-2019-0841 bypass targeting all versions of Edge in Windows 10.
  • [48星][2y] [C++] cherrypill/system_info Hardware information tool for Windows
  • [48星][1m] [PS] littl3field/audix Audix is a PowerShell tool to quickly configure the Windows Event Audit Policies for security monitoring
  • [47星][7m] [Go] hectane/go-acl Go library for manipulating ACLs on Windows
  • [47星][1y] [C++] silica/sandbox Application virtualization tool for Windows
  • [46星][6m] [C#] ericzimmerman/prefetch Windows Prefetch parser. Supports all known versions from Windows XP to Windows 10.
  • [46星][2y] [C++] nccgroup/psr Pointer Sequence Reverser - enable you to see how Windows C++ application is accessing a particular data member or object.
  • [46星][2m] [C#] brunull/pace A Remote Access Tool for Windows.
  • [46星][13d] [Assembly] borjamerino/windows-one-way-stagers Windows Stagers to circumvent restrictive network environments
  • [45星][3y] [C] gentilkiwi/basic_rpc Samples about Microsoft RPC and native API calls in Windows C
  • [45星][19d] [TSQL] kacos2000/windowstimeline SQLite query & Powershell scripts to parse the Windows 10 (v1803+) ActivitiesCache.db
  • [45星][3y] [PS] lazywinadmin/winformps PowerShell functions for Windows Forms controls
  • [45星][28d] [C#] damonmohammadbagher/nativepayload_reverseshell This is Simple C# Source code to Bypass almost "all" AVS, (kaspersky v19, Eset v12 v13 ,Trend-Micro v16, Comodo & Windows Defender Bypassed via this method Very Simple)
  • [44星][14d] [Py] technowlogy-pushpender/technowhorse TechNowHorse is a RAT (Remote Administrator Trojan) Generator for Windows/Linux systems written in Python 3.
  • [43星][9m] [C] souhailhammou/drivers Windows Drivers
  • [42星][2y] [C] nixawk/awesome-windows-debug Debug Windows Application / Kernel
  • [42星][7m] [Visual Basic .NET] s1egesystems/ghostsquadhackers-javascript-encrypter-encoder Encrypt/Encode your Javascript code. (Windows Scripting)
  • [42星][1y] [C++] 3gstudent/windows-eventlog-bypass Use subProcessTag Value From TEB to identify Event Log Threads
  • [41星][3y] [PS] sikkandar-sha/sec-audit PowerShell Script for Windows Server Compliance / Security Configuration Audit
  • [40星][1y] [Py] mnrkbys/vss_carver Carves and recreates VSS catalog and store from Windows disk image.
  • [40星][6m] [Py] silv3rhorn/artifactextractor Extract common Windows artifacts from source images and VSCs
  • [39星][3y] [C] scubsrgroup/taint-analyse Windows平台下的细粒度污点分析工具
  • [39星][6m] [HTML] sophoslabs/cve-2019-0888 PoC for CVE-2019-0888 - Use-After-Free in Windows ActiveX Data Objects (ADO)
  • [38星][1y] [C++] 3gstudent/eventlogedit-evt--general Remove individual lines from Windows Event Viewer Log (EVT) files
  • [38星][5m] [C#] nyan-x-cat/disable-windows-defender Changing values to bypass windows defender C#
  • [38星][2y] [Py] roothaxor/pystat Advanced Netstat Using Python For Windows
  • [38星][3y] [C++] yejiansnake/windows-sys-base windows 系统API C++封装库,包含进程间通讯,互斥,内存队列等通用功能
  • [37星][1y] [C++] rokups/reflectiveldr Position-idependent Windows DLL loader based on ReflectiveDLL project.
  • [36星][4y] [PS] 5alt/zerorat ZeroRAT是一款windows上的一句话远控
  • [36星][5y] [C++] kkar/teamviewer-dumper-in-cpp Dumps TeamViewer ID,Password and account settings from a running TeamViewer instance by enumerating child windows.
  • [36星][4y] [C++] n3k/ekoparty2015_windows_smep_bypass Windows SMEP Bypass U=S
  • [36星][1y] [C] realoriginal/alpc-diaghub Utilizing the ALPC Flaw in combiniation with Diagnostics Hub as found in Server 2016 and Windows 10.
  • [35星][12d] [PS] dsccommunity/xfailovercluster This module contains DSC resources for deployment and configuration of Windows Server Failover Cluster.
  • [35星][7m] [PS] swisscom/powergrr PowerGRR is an API client library in PowerShell working on Windows, Linux and macOS for GRR automation and scripting.
  • [35星][6m] [C++] parkovski/wsudo Proof of concept sudo for Windows
  • [34星][5m] [C++] blackint3/none UNONE and KNONE is a couple of open source base library that makes it easy to develop software on Windows.
  • [34星][1m] [C#] ericzimmerman/appcompatcacheparser AppCompatCache (shimcache) parser. Supports Windows 7 (x86 and x64), Windows 8.x, and Windows 10
  • [34星][1y] [PS] ptylenda/kubernetes-for-windows Ansible playbooks and Packer templates for creating hybrid Windows/Linux Kubernetes 1.10+ cluster with experimental Flannel pod network (host-gw backend)
  • [34星][2y] [C++] swwwolf/obderef Decrement Windows Kernel for fun and profit
  • [34星][26d] [C] zfigura/semblance Disassembler for Windows executables. Supports 16-bit NE (New Executable), MZ (DOS), and PE (Portable Executable, i.e. Win32) files.
  • [33星][2y] [Batchfile] 3gstudent/winpcap_install Auto install WinPcap on Windows(command line)
  • [33星][3y] [C++] kingsunc/minidump windows软件崩溃解决方案
  • [32星][3y] [C++] ecologylab/ecotuiodriver Diver to convert tuio touch events into windows touch events. Started as GSoC 2012 project.
  • [32星][3y] [C++] swwwolf/cbtest Windows kernel-mode callbacks tutorial driver
  • [31星][5m] [C] csandker/inmemoryshellcode A Collection of In-Memory Shellcode Execution Techniques for Windows
  • [31星][8y] [C] hackedteam/driver-win64 Windows (64bit) agent driver
  • [31星][2y] [C++] hsluoyz/rmtsvc A web-based remote desktop & control service for Windows.
  • [30星][3y] [CSS] botherder/flexikiller flexikiller:移除FlexiSpy 木马(Windows/Mac)
  • [30星][2y] [C#] modzero/mod0umleitung modzero DNS Masquerading Server for Windows
  • [29星][7y] [Shell] artemdinaburg/optimizevm Make Windows VMs Faster
  • [29星][1y] [Py] skelsec/windows_ad_dos_poc PoC code for crashing windows active directory
  • [29星][3y] [Py] 6e726d/pywiwi Python Windows Wifi
  • [28星][2y] [C] bot-man-jl/wfp-traffic-redirection-driver WFP Traffic Redirection Driver is used to redirect NIC traffic on network layer and framing layer, based on Windows Filtering Platform (WFP).
  • [28星][2y] defcon-russia/shortcut_auto_bind Windows LNK/URL shortcut auto-binding hotkey (not a bug, feature)
  • [28星][8y] [C] hackedteam/driver-win32 Windows (32bit) agent driver
  • [28星][4y] [C] icewall/forcedelete Windows driver including couple different techniques for file removal when regular operation isn't possible.
  • [28星][5y] [C++] michael4338/tdi Windows Kernel Driver - Create a driver device in TDI layer of windows kernel to capture network data packets
  • [28星][10m] [C#] raandree/managedpasswordfilter Windows Password Filter that uses managed code internally
  • [27星][5m] [C#] 717021/pcmgr Windows 任务管理器重制版 A rebulid version for Windows task manager.
  • [27星][3y] [C++] int0/ltmdm64_poc ltmdm64_poc:利用ltmdm64.sys 的漏洞绕过 Windows 7 SP1 x64 的代码完整性检查
  • [27星][7m] [C++] slyd0g/timestomper PoC that manipulates Windows file times using SetFileTime() API
  • [27星][2y] [Py] the404hacking/windows-python-rat A New Microsoft Windows Remote Administrator Tool [RAT] with Python by Sir.4m1R.
  • [26星][7y] [C++] avalon1610/lpc windows LPC library
  • [26星][3y] [Pascal] martindrab/vrtuletree VrtuleTree is a tool that displays information about driver and device objects present in the system and relations between them. Its functionality is very similar to famous DeviceTree, however, VrtuleTree emhasises on stability and support of latest Windows versions
  • [26星][2y] [C++] strikerx3/whvpclient Windows Hypervisor Platform client
  • [26星][4y] [Py] stratosphereips/stratospherewindowsips The Stratosphere IPS is a free software IPS that uses network behavior to detect and block malicious actions.
  • [25星][2y] [C++] apriorit/custom-bootloader A demo tutorial for low-level and kernel developers - developing a custom Windows boot loader
  • [25星][6y] [C++] dominictobias/detourxs A x86/64 library for detouring functions on Windows OS
  • [24星][4y] [C] ltangjian/firewall Based on the research of Windows network architecture and the core packet filtering firewall technology, using NDIS intermediate driver, the article achieved the filter of the core layer, and completed the Windows Personal Firewall Design and Implementation.
  • [24星][5y] [C++] michael4338/ndis Windows Kernel Driver - Create a driver device in intermediate layer of Windows kernel based on NDIS, which communicates with and connect upper layer (user mode applications) and lower layer (miniport driver/network card). Create self-defined protocols for transmitting data and control communications by simulating very simple HTTP, TCP and ARP p…
  • [24星][1y] [Py] rootm0s/casper 👻 Socket based RAT for Windows with evasion techniques and other features for control
  • [24星][4y] [C++] thecybermind/ipredir IP redirection+NAT for Windows
  • [24星][3m] [C] hypersine/windowssudo A linux-like su/sudo on Windows. Transferred from
  • [23星][3y] [C] hedgeh/sewindows 在Windows上建立一个开源的强制访问控制框架及SDK。使Windows平台的应用开发者,可以不用关心操作系统底层技术,只用进行简单的SDK调用或配置就可以保护自己的应用程序。
  • [23星][4y] [JS] kolanich/cleanunwantedupdates A set of scripts to detect updates of Microsoft (TM) Windows (TM) OS which harm users' privacy and uninstall them
  • [22星][1y] [C] codereba/netmon network filter driver that control network send speed, based on windows tdi framework.
  • [21星][4y] [C#] adamcaudill/curvelock Experimental File & Message Encryption for Windows
  • [21星][3y] [Visual Basic .NET] appsecco/winmanipulate A simple tool to manipulate window objects in Windows
  • [21星][2y] [C] microwave89/drvtricks drvtriks kernel driver for Windows 7 SP1 and 8.1 x64, that tricks around in your system.
  • [21星][1y] [JS] mindpointgroup/stig-cli A CLI for perusing DISA STIG content Mac, Linux, and Windows Compatible
  • [20星][3y] [C++] andrewgaspar/km-stl A drop-in replacement for the C++ STL for kernel mode Windows drivers. The goal is to have implementations for things like the standard algorithms that don't require memory allocations or exceptions, and for implementations of type traits and other compile-time related headers. Full implementation of the STL is a non-goal.
  • [20星][7m] [C] mtth-bfft/ntsec Standalone tool to explore the security model of Windows and its NT kernel. Use it to introspect privilege assignments and access right assignments, enumerate attack surfaces from the point of view of a sandboxed process, etc.
  • [20星][1m] [C++] mullvad/libwfp C++ library for interacting with the Windows Filtering Platform (WFP)
  • [20星][3y] [PS] rasta-mouse/invoke-loginprompt Invokes a Windows Security Login Prompt and outputs the clear text password.

文章

新添加

DEP

Procmon

Linux


ELF

工具

  • [930星][15d] [Py] eliben/pyelftools Parsing ELF and DWARF in Python
  • [787星][2m] [C] nixos/patchelf A small utility to modify the dynamic linker and RPATH of ELF executables
  • [411星][9m] [Assembly] mewmew/dissection The dissection of a simple "hello world" ELF binary.
  • [337星][9m] [Py] rek7/fireelf Fileless Linux Malware Framework
  • [277星][4m] [Shell] cryptolok/aslray Linux ELF x32/x64 ASLR DEP/NX bypass exploit with stack-spraying
  • [233星][2m] [C] elfmaster/libelfmaster Secure ELF parsing/loading library for forensics reconstruction of malware, and robust reverse engineering tools
  • [181星][4y] [C++] jacob-baines/elfparser Cross Platform ELF analysis
  • [163星][7m] [C++] serge1/elfio ELFIO - ELF (Executable and Linkable Format) reader and producer implemented as a header only C++ library
  • [155星][5y] [C] arisada/midgetpack midgetpack is a multiplatform secure ELF packer
  • [149星][2y] [C] elfmaster/skeksi_virus Devestating and awesome Linux X86_64 ELF Virus
  • [144星][2y] [C] ixty/mandibule 向远程进程注入ELF文件
  • [140星][1y] [C++] aclements/libelfin C++11 ELF/DWARF parser
  • [137星][4m] [Py] tunz/binch A light ELF binary patch tool in python urwid
  • [133星][8m] [Rust] aep/elfkit rust elf parsing, manipulation and (re)linking toolkit
  • [123星][5y] [Py] ucsb-seclab/leakless Function redirection via ELF tricks.
  • [111星][2y] [Go] lloydlabs/elf-strings read an ELF binary's string sections within a given binary. This is meant to be much like the strings UNIX utility, however is purpose built for ELF binaries.
  • [107星][5y] [C] ioactive/melkor_elf_fuzzer Melkor is a very intuitive and easy-to-use ELF file format fuzzer to find functional and security bugs in ELF parsers.
  • [73星][1y] [Ruby] fbkcs/msf-elf-in-memory-execution msf-elf-in-memory-execution: Metasploit模块, 用于在内存中执行ELF文件
  • [64星][5y] [Py] sqall01/zwoelf An ELF parsing and manipulation library for Python
  • [61星][3y] [Assembly] cranklin/cranky-data-virus Educational virus written in Assembly that infects 32-bit ELF executables on Linux using the data segment infection method
  • [61星][2y] [Perl] xlogicx/m2elf Converts Machine Code to x86 (32-bit) Linux executable (auto-wrapping with ELF headers)
  • [57星][7m] [Assembly] guitmz/memrun Small tool to run ELF binaries from memory with a given process name
  • [56星][11m] [Py] genymobile/copydeps Analyze and copy library dependencies of ELF binaries
  • [55星][5y] [C] anestisb/melkor-android An Android port of the melkor ELF fuzzer
  • [52星][1m] [C] termux/termux-elf-cleaner Utility to remove unused ELF sections causing warnings.
  • [50星][4y] [Py] wapiflapi/wsym Adds symbols to a ELF file.
  • [47星][11m] [C] imbushuo/boot-shim Bootstraps ARM32/ARM64 ELF payloads on Qualcomm Windows platforms
  • [46星][8m] [Py] capeleidokos/elf_diff A tool to compare ELF binaries
  • [45星][4m] [Py] aencode/elf_analysis Perform Static and dynamic analysis on 32 bit ELF binary, and automate the process of stack based overflow exploitation.
  • [45星][6m] [C] wangyinuo/fixelfsection
  • [44星][2y] [Py] wizh/rop-chainer static program analysis tool that generates return-oriented exploits for ELF binaries
  • [41星][3y] [Py] devttys0/botox SIGSTOPing ELF binaries since 0x7E1
  • [41星][3y] [C] jmpews/evilelf Malicious use of ELF such as .so inject, func hook and so on.
  • [38星][2y] [C] en14c/pivirus sample linux x86_64 ELF virus
  • [37星][3d] [C] uclinux-dev/elf2flt ELF to bFLT (binary flat) converter for no-mmu Linux targets
  • [36星][3y] [C++] tartanllama/libelfin C++11 ELF/DWARF parser
  • [33星][3m] [Java] fornwall/jelf ELF parsing library in java.
  • [29星][2m] [C] martinribelotta/elfloader ARMv7M ELF loader
  • [27星][2y] [Go] namhyung/elftree ELF library dependency viewer
  • [26星][2m] [Ruby] david942j/rbelftools ELF parser library implemented in pure Ruby!
  • [23星][1m] [Haskell] galoisinc/elf-edit The elf-edit library provides a datatype suitable for reading and writing Elf files.
  • [22星][6y] [C] t00sh/elf-poison Proof Of Concept for inserting code in ELF binaries.
  • [21星][3m] [Go] tunz/binch-go A lightweight command-line ELF binary patch tool written in Go
  • [21星][3y] [C] elemeta/elfloader load so file into current memory space and run function
  • [20星][4m] [C] en14c/erebus Poc for ELF64 runtime infection via GOT poisoning technique by elfmaster
  • [18星][6y] [C] depierre/pts Packer for PE and ELF, 32 and 64bits.
  • [13星][2y] [Go] guitmz/gocave Finding code caves in ELF files with GoLang
  • [12星][8m] [Go] guitmz/ezuri A Simple Linux ELF Runtime Crypter
  • [9星][2y] [Nim] guitmz/nim-cephei Probably the first ELF binary infector ever created in Nim.
  • [9星][4y] [C] sugawaray/efiboot A tool to execute an elf binary in the UEFI shell environment.
  • [7星][2y] [C] mfaerevaag/elfinjector Code injector for ELF binaries (incl. PIE)
  • [7星][29d] [C] colortear/elf-packer Encrypts 64-bit elf files that decrypt at runtime.
  • [5星][8m] [PHP] ircmaxell/php-elf-symbolresolver A linux object file (ELF) parser
  • [4星][2m] [C] adwait1-g/parsemyelf A bunch of tools which help in understanding ELF binaries better
  • [4星][2y] [C] efidroid/modules_elf2efi convert statically linked ELF binaries to PE images for UEFI
  • [2星][9m] [Py] capeleidokos/leidokos-changereport Generates change reports with elf_diff for the Kaleidoscope firmware
  • [2星][2y] [C] youben11/parself Yet another elf parser
  • [2星][1y] [C] tyoma/symreader C++ ELF parser
  • [1星][5y] [c] renorobert/core2elf

文章


工具

新添加

  • [1544星][2y] [C] ezlippi/webbench Webbench是Radim Kolar在1997年写的一个在linux下使用的非常简单的网站压测工具。它使用fork()模拟多个客户端同时访问我们设定的URL,测试网站在压力下工作的性能,最多可以模拟3万个并发连接去测试网站的负载能力。官网地址:
  • [1450星][2m] [C] feralinteractive/gamemode Optimise Linux system performance on demand
  • [1413星][21d] [C++] google/nsjail A light-weight process isolation tool, making use of Linux namespaces and seccomp-bpf syscall filters (with help of the kafel bpf language)
  • [895星][29d] [C] buserror/simavr simavr is a lean, mean and hackable AVR simulator for linux & OSX
  • [759星][1m] [Py] korcankaraokcu/pince A reverse engineering tool that'll supply the place of Cheat Engine for linux
  • [741星][2m] [C] yrp604/rappel A linux-based assembly REPL for x86, amd64, armv7, and armv8
  • [731星][17d] [C] strace/strace strace is a diagnostic, debugging and instructional userspace utility for Linux
  • [585星][3y] [C] ktap/ktap a new scripting dynamic tracing tool for Linux
  • [570星][12m] [C] asamy/ksm 快速、hackable且简单的x64 VT-x虚拟机管理程序,支持Windows和Linux
  • [565星][12d] [C++] intel/linux-sgx Intel SGX for Linux*
  • [560星][2m] [Py] autotest/autotest Fully automated tests on Linux
  • [536星][5m] [C++] nytrorst/shellcodecompiler 将C/C ++样式代码编译成一个小的、与位置无关且无NULL的Shellcode,用于Windows(x86和x64)和Linux(x86和x64)
  • [509星][8m] [C] iovisor/ply Dynamic Tracing in Linux
  • [506星][3y] [C] gaffe23/linux-inject Tool for injecting a shared object into a Linux process
  • [468星][9d] [C] libreswan/libreswan an Internet Key Exchange (IKE) implementation for Linux.
  • [462星][2y] [C++] aimtuxofficial/aimtux A large Linux csgo cheat/hack
  • [441星][12d] [C] facebook/openbmc OpenBMC is an open software framework to build a complete Linux image for a Board Management Controller (BMC).
  • [405星][10m] [Shell] microsoft/linux-vm-tools Hyper-V Linux Guest VM Enhancements
  • [393星][2m] [Shell] yadominjinta/atilo Linux installer for termux
  • [355星][3y] [C] adtac/fssb A filesystem sandbox for Linux using syscall intercepts.
  • [354星][2m] [C] seccomp/libseccomp an easy to use, platform independent, interface to the Linux Kernel's syscall filtering mechanism
  • [331星][5m] [Go] capsule8/capsule8 对云本地,容器和传统的基于 Linux 的服务器执行高级的行为监控
  • [318星][3y] [C] chobits/tapip user-mode TCP/IP stack based on linux tap device
  • [282星][2m] [Py] facebook/fbkutils A variety of utilities built and maintained by Facebook's Linux Kernel Team that we wish to share with the community.
  • [233星][2y] [C] hardenedlinux/grsecurity-101-tutorials 增强 Linux 内核安全的内核补丁集
  • [228星][8m] [C] wkz/ply Light-weight Dynamic Tracer for Linux
  • [203星][3y] [C] google/kasan KernelAddressSanitizer, a fast memory error detector for the Linux kernel
  • [199星][4y] [C] dismantl/linux-injector Utility for injecting executable code into a running process on x86/x64 Linux
  • [192星][7m] [C] andikleen/simple-pt Simple Intel CPU processor tracing on Linux
  • [173星][1m] [C] netoptimizer/network-testing Network Testing Tools for testing the Linux network stack
  • [147星][22d] [Shell] hardenedlinux/debian-gnu-linux-profiles Debian GNU/Linux based Services Profiles
  • [144星][15d] [Shell] sclorg/s2i-python-container Python container images based on Red Hat Software Collections and intended for OpenShift and general usage, that provide a platform for building and running Python applications. Users can choose between Red Hat Enterprise Linux, Fedora, and CentOS based images.
  • [140星][7y] [C] johnath/beep beep is a command line tool for linux that beeps the PC speaker
  • [139星][7m] [C] dzzie/scdbg note: current build is VS_LIBEMU project. This cross platform gcc build is for Linux users but is no longer updated. modification of the libemu sctest project to add basic debugger capabilities and more output useful for manual RE. The newer version will run under WINE
  • [133星][1m] [C] arsv/minibase small static userspace tools for Linux
  • [127星][10y] [C] spotify/linux Spotify's Linux kernel for Debian-based systems
  • [122星][5m] [C] dschanoeh/socketcand A deprecated fork of socketcand. Please got to linux-can for the latest version.
  • [119星][2m] [Py] containers/udica This repository contains a tool for generating SELinux security profiles for containers
  • [116星][1y] [Shell] fox-it/linux-luks-tpm-boot A guide for setting up LUKS boot with a key from TPM in Linux
  • [109星][2m] [Py] vstinner/python-ptrace a debugger using ptrace (Linux, BSD and Darwin system call to trace processes) written in Python
  • [99星][2y] [Shell] aoncyberlabs/cexigua Linux based inter-process code injection without ptrace(2)
  • [97星][7m] [Shell] gavinlyonsrepo/cylon Updates, maintenance, backups and system checks in a TUI menu driven bash shell script for an Arch based Linux distro
  • [93星][6m] [Shell] vincentbernat/eudyptula-boot Boot a Linux kernel in a VM without a dedicated root filesystem.
  • [83星][2y] [C] xobs/novena-linux Linux kernel with Novena patches -- expect frequent rebases!
  • [77星][6m] [Py] cybereason/linux_plumber A python implementation of a grep friendly ftrace wrapper
  • [74星][3y] [Shell] inquisb/unix-privesc-check Shell script that runs on UNIX systems (tested on Solaris 9, HPUX 11, various Linux distributions, FreeBSD 6.2). It detects misconfigurations that could allow local unprivileged user to escalate to other users (e.g. root) or to access local apps (e.g. databases). This is a collaborative rework of version 1.0
  • [72星][7m] [C] hc0d3r/alfheim a linux process hacker tool
  • [70星][14d] [Shell] sclorg/s2i-php-container PHP container images based on Red Hat Software Collections and intended for OpenShift and general usage, that provide a platform for building and running PHP applications. Users can choose between Red Hat Enterprise Linux, Fedora, and CentOS based images.
  • [68星][16d] drduh/pc-engines-apu-router-guide Guide to building a Linux or BSD router on the PC Engines APU platform
  • [68星][10d] [TS] flathub/linux-store-frontend A web application to browse and install applications present in Flatpak repositories. Powers
  • [65星][3m] [Py] archlinux/arch-security-tracker Arch Linux Security Tracker
  • [65星][8d] [Shell] mdrights/liveslak 中文化的隐私加强 GNU/Linux 系统 - Forked from Alien Bob's powerful building script for Slackware Live.
  • [60星][2y] [C] skeeto/ptrace-examples Examples for Linux ptrace(2)
  • [58星][2y] [Go] evilsocket/ftrace Go library to trace Linux syscalls using the FTRACE kernel framework.
  • [58星][3m] [Java] exalab/anlinux-adfree AnLinux, Ad free version.
  • [58星][3y] [CSS] wizardforcel/sploitfun-linux-x86-exp-tut-zh
  • [54星][1y] [Py] k4yt3x/defense-matrix Express security essentials deployment for Linux Servers
  • [53星][10m] [C] marcan/lsirec LSI SAS2008/SAS2108 low-level recovery tool for Linux
  • [52星][1y] [C] pymumu/jail-shell Jail-shell is a linux security tool mainly using chroot, namespaces technologies, limiting users to perform specific commands, and access sepcific directories.
  • [49星][3m] [C] thibault-69/rat-hodin-v2.9 Remote Administration Tool for Linux
  • [49星][2y] [C] cnlohr/wifirxpower Linux-based WiFi RX Power Grapher
  • [49星][3y] [Assembly] t00sh/assembly Collection of Linux shellcodes
  • [45星][2y] [Go] c-bata/systracer Linux/x86 系统调用追踪, Go语言实现
  • [45星][6y] [JS] cyberpython/wifiscanandmap A Linux Python application to create maps of 802.11 networks
  • [45星][4y] [C] shadowsocks/iptables iptables is the userspace command line program used to configure the Linux 2.4.x and later packet filtering ruleset. It is targeted towards system administrators.
  • [44星][7m] [C] junxzm1990/pomp 在 Linux 系统上开发 POMP 系统,分析崩溃后的 artifacts
  • [43星][6m] [Ruby] b1ack0wl/linux_mint_poc
  • [43星][2y] [C] gcwnow/linux Linux kernel for GCW Zero (Ingenic JZ4770)
  • [41星][3y] [Py] fnzv/trsh trsh:使用电报 API 与 Linux 服务器通信,Python编写。
  • [40星][11d] [Dockerfile] ironpeakservices/iron-alpine Hardened alpine linux baseimage for Docker.
  • [39星][2m] [C] stephenrkell/trap-syscalls Monitor, rewrite and/or otherwise trap system calls... on Linux/x86-64 only, for now.
  • [38星][3m] [PHP] cesnet/pakiti-server Pakiti provides a monitoring mechanism to check the patching status of Linux systems.
  • [35星][8y] [C] sduverger/ld-shatner ld-linux code injector
  • [34星][4m] [C] peterbjornx/meloader Linux i386 tool to load and execute ME modules.
  • [34星][3y] screetsec/dracos Dracos Linux (
  • [33星][2y] [C++] cnrig/cnrig Static CryptoNight CPU miner for Linux + automatic updates
  • [33星][3y] [Go] egebalci/the-eye Simple security surveillance script for linux distributions.
  • [33星][12m] [C] p3n3troot0r/socketv2v Mainline Linux Kernel integration of IEEE 802.11p, IEEE 1609.{3,4}, and developmental userspace utility for using J2735 over WAVE
  • [32星][6m] [C] jcsaezal/pmctrack an OS-oriented performance monitoring tool for Linux (
  • [32星][7y] [C] nbareil/net2pcap 类似于tcpdump的数据包捕获工具,只依赖libc
  • [32星][1y] [C] perceptionpoint/suprotect Linux内核模块, 修改任意进程的内存保护属性
  • [32星][4y] [C] a0rtega/bdldr bdldr is an unofficial engine loader for Bitdefender ® for Linux
  • [30星][2y] [PHP] opt-oss/ng-netms NG-NetMS is a new end-to-end network management platform for your Linux servers, Cisco, Juniper, HP and Extreme routers, switches and firewalls.
  • [27星][1m] [Shell] adnanhodzic/anon-hotspot On demand Debian Linux (Tor) Hotspot setup tool
  • [27星][2y] [Py] morphuslabs/distinct Find potential Indicators of Compromise among similar Linux servers
  • [27星][2m] [C] oracle/libdtrace-ctf libdtrace-ctf is the Compact Type Format library used by DTrace on Linux
  • [27星][1y] [Py] thesecondsun/pasm Linux assembler/disassembler based on Rasm2
  • [27星][5y] [Py] bendemott/captiveportal A captive portal that can be used on most linux distributions.
  • [26星][12m] [C] plutonium-dbg/plutonium-dbg Kernel-based debugger for Linux applications
  • [26星][2m] [C] oracle/dtrace-utils DTrace-utils contains the Userspace portion of the DTrace port to Linux
  • [25星][8y] aheadley/logitech-solar-k750-linux Userspace "driver" for the Logitech k750 Solar Keyboard. A fork of the repo from
  • [24星][1y] [Py] m4rktn/jogan Pentest Tools & Packages Installer [Linux/Termux]
  • [23星][5y] [C++] behzad-a/dytan Dytan Taint Analysis Framework on Linux 64-bit
  • [23星][3y] [Py] remnux/distro This repository contains supplementary files for building and using the REMnux Linux distribution. See
  • [23星][5y] [Assembly] zerosum0x0/slae64 x64 Linux Shellcode
  • [22星][3y] [Shell] johntroony/luks-ops A bash script to automate the most basic usage of LUKS volumes in Linux VPS
  • [22星][5y] munmap/linux-kernel-bugs-db
  • [21星][1y] [Py] syno3/babymux pentesting tool for noob hackers.Runs on linux and termux
  • [20星][3y] [C] leixiangwu/cse509-rootkit After attackers manage to gain access to a remote (or local) machine and elevate their privileges to "root", they typically want to maintain their access, while hiding their presence from the normal users and administrators of the system. This basic rootkit works on the Linux operating system and is a loadable kernel module which when loaded int…

文章

新添加

贡献

内容为系统自动导出, 有任何问题请提issue