Search awesome repositories

An open-source user mode debugger for Windows. Optimized for reverse engineering and malware analysis.

817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io standard · Works with Claude Code, GitHub Copilot, Codex CLI, Cursor, Gemini CLI & 20+ platforms · 29 security domains · Apache 2.0

UNIX-like reverse engineering framework and command-line toolset

Exploit Development and Reverse Engineering with GDB & LLDB Made Easy

IntelOwl: manage your Threat Intelligence at scale

Android virtual machine and deobfuscator

Malwoverview is a first response tool for threat hunting across VirusTotal, Hybrid Analysis, URLHaus, Polyswarm, Malshare, Alien Vault, Malpedia, Malware Bazaar, ThreatFox, Triage, IPInfo, Shodan, AbuseIPDB, GreyNoise, URLScan.io, Whois/RDAP, NIST, and VulnCheck. Supports LLM enrichment, IOC extraction, YARA scanning, and Android analysis.

State-of-the-art native debugging tools

Android Reverse-Engineering Workbench for VS Code

Pafish is a testing tool that uses different techniques to detect virtual machines and malware analysis environments in the same way that malware families do

Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).

Portable Executable reversing tool with a friendly GUI

Malware Configuration And Payload Extraction

No description.

A bunch of Windows anti-debugging tricks for x86 and x64.

A Binary Genetic Traits Lexer Framework

Linker/Compiler/Tool detector for Windows, Linux and MacOS.

Sanctum is an experimental proof-of-concept EDR, designed to detect modern malware techniques, above and beyond the capabilities of antivirus. Built in Rust.

Kernel-Mode Driver that loads a dll into every new created process that loads kernel32.dll module

Drltrace is a library calls tracer for Windows and Linux applications.

IATelligence is a Python script that will extract the IAT of a PE file and request GPT to get more information about the API and the ATT&CK matrix related

This repo contains IOC, malware and malware analysis associated with Public cloud

Brovan is a user-mode x86_64 binary emulator for your malware analysis & reverse engineering.

MCP server for VirusTotal API — analyze URLs, files, IPs, and domains with comprehensive security reports, relationship analysis, and pagination support.

MCP server for VirusTotal API — analyze URLs, files, IPs, and domains with comprehensive security reports, relationship analysis, and pagination support.

Drive x64dbg with your AI. MCP server: 23 mega-tools / 153 endpoints for breakpoints, memory, disasm, tracing, anti-debug & PE dumping. Claude/Cursor/Windsurf/Cline. All local.

your ai debugger, vibe hacking tool

Workflow-centric function triage and prioritization plugin for IDA Pro

Recover and statically analyze manually-mapped DLLs whose PE headers are wiped at runtime. Pure-stdlib Python, no driver, no debugger required. Includes a Claude Code skill.