ror13h Goto Github PK

admmutate

Classic code from 1999+ I am fairly sure this is the first public polymorphic shellcode ever (best IMHO and others http://ids.cs.columbia.edu/sites/default/files/ccs07poly.pdf :) If I ever port this to 64 or implement a few other suggestions (sorry I lost ppc code version contributed) it will be orders of magnitude more difficult to spot, so I hope nobody uses signatures for anything (virus / malware scanners included).

al-khaser

Public malware techniques used in the wild

antidebug

Collection Of Anti-Debugging Tricks

antidebugging

A collection of c++ programs that demonstrates the common Windows API functions to check if a debugger is present.

awesome-honeypots

an awesome list of honeypot resources

awesome-reversing

A curated list of awesome reversing resources

awesome-windows-exploitation

A curated list of awesome Windows Exploitation resources, and shiny things. Inspired by awesom

badusb2-mitm-poc

BadUSB 2.0 USB-HID MiTM POC

bamfdetect

Identifies and extracts information from bots and other malware

bios-disassembly-ninjutsu-uncovered

Copy of the BIOS Disassembly Ninjutsu ("1st Edition") PDF

box-js

A tool for studying JavaScript malware.

captainhook

CaptainHook is x86/x64 hook environment

carberp

cknife

Cknife

cryptowall_v3

A repository of scripts and files related to the CryptoWall version 3 threat

cyber-defence

Information released publicly by NCC Group's Cyber Defence team

ddimon

Monitoring and controlling kernel API calls with stealth hook using EPT

demos

Demos of various techniques found in malware

demovfuscator

A work-in-progress deobfuscator for movfuscated binaries

ebowla

Framework for Making Environmental Keyed Payloads

eopmon

Elevation of privilege detector based on HyperPlatform

fibratus

Tool for exploration and tracing of the Windows kernel

flare-vm

guardmon

Hypervisor based tool for monitoring system register accesses.

hdroot-bootkit-analysis

Supporting Files on my analysis of the malware designated hdroot.

hekate

Winsock inspection/filtering/modifying

hellkitty-in-vc

Ring3 Rootkit Backdoor.

hidden-tear

an open source ransomware-like file crypter kit

hyperplatform

Intel VT-x based hypervisor aiming to provide a thin VM-exit filtering platform on Windows.

loffice

Lazy Office Analyzer