elsisoft Goto Github PK

3proxy

3proxy - tiny free proxy server

alcatraz

x64 binary obfuscator

apihashes

IDA Pro plugin for recognizing known hashes of API function names

apihashreplace

Repository for API Hashing script detailed in the Huntress Blog

d1rklrd

Shellcode Loader with Indirect Dynamic syscall Implementation , shellcode in MAC format, API resolving from PEB, Syscall calll and syscall instruction address resolving at run time

detectwindowscopyonwriteforapi

Enumerate various traits from Windows processes as an aid to threat hunting

dncil

The FLARE team's open-source library to disassemble Common Intermediate Language (CIL) instructions.

dnfile

Parse .NET executable files.

dnscrypt-proxy

Container that uses Cloudflare's DNS over HTTPS resolution service by utilizing DNSCrypt Proxy

drmemory

Memory Debugger for Windows, Linux, Mac, and Android

filelesspeloader

Loading Remote AES Encrypted PE in memory , Decrypted it and run it

guardian-server

guides

Сборник шпаргалок и инструкций для упрощения жизни студента Нетологии

hidden

Windows driver with usermode interface which can hide processes, file-system and registry objects, protect processes and etc

hijacken

Use it for analysis and attack windows application using dll hijacking vulnerabilities

hookhunter

Analyze patches in a process

ibnet-homeworks

ibos-homeworks

icpin

An Integrity-Check Monitoring Pintool

irpmon

The goal of the tool is to monitor requests received by selected device objects or kernel drivers. The tool is quite similar to IrpTracker but has several enhancements. It supports 64-bit versions of Windows (no inline hooks are used, only moodifications to driver object structures are performed) and monitors IRP, FastIo, AddDevice, DriverUnload and StartIo requests.

kernel-inline-hook

linux kernel inline hook

lief

LIEF - Library to Instrument Executable Formats

malwaresourcecode

Collection of malware source code for a variety of platforms in an array of different programming languages.

memorymodule

Library to load a DLL from memory.

muproxy

Proxy server for the MuOnline protocol, can be used for bypassing C3\C4 encryption with irregular enc\dec keys

ntdllreflection

Bypass Userland EDR hooks by Loading Reflective Ntdll in memory from a remote server based on Windows ReleaseID to avoid opening a handle to ntdll , and trigger exported APIs from the export table

pr0cess

some gadgets about windows process and ready to use :)

process-dump

Windows tool for dumping malware PE files from memory back to disk for analysis.

proxy

C++ TCP Proxy Server https://www.partow.net/programming/tcpproxy/index.html

proxy-1

TCP proxy in ANSI C