gmh5225 Goto Github PK

detect-hook-buster

A compact tool for detecting AV/EDR hooks in default libaries.

detect-hook-knowndlls-wtsrm

WTSRM

detect-hooks

Proof of concept Beacon Object File (BOF) that attempts to detect userland hooks in place by AV/EDR

detect-hypervisor_detect_ring_0

Check hypervisor in ring 0

detect-keattachprocess

Detect-KeAttachProcess by iterating through all processes as well as checking the context of the thread.

detect-magisk-applistdetector

A library to detect suspicious apps like Magisk

detect-magiskkiller

Two ways to detect Magisk v23.0 and older. Magisk v24+ users won't be affected.

detect-mapped-dll-modfinder

Manual-mapped region detector.

detect-mapped-driver-nomad

Uses known methods to find mapped kernel code and suspicious threads

detect-mouseclassservicecallback

mouseclassservicecallback detection via hook

detect-pafish

Pafish is a testing tool that uses different techniques to detect virtual machines and malware analysis environments in the same way that malware families do

detect-queryworkingsetexample

Just an example of a well-known technique to detect memory tampering via Windows Working Sets.

detect-scan-device-control-hooks-scanner

detect-systemthreadfinder

detection-cheatengine

Using ReadDirectoryChangesW to detect CheatEngine

detection-patriot

detection-rules

Rules for Elastic Security's detection engine

detours

Detours is a software package for monitoring and instrumenting API calls on Windows. It is distributed in source code form.

detoursnt

Detours with just single dependency - NTDLL

devauth

Safely authenticate Microsoft and Mojang accounts in development environments.

devi_binja

Binary Ninja Plugin for devi - see https://github.com/murx-/devi/ for devi details

device-driver-nefcon

Windows device driver installation and management tool.

devicemon

VT-based PCI device monitor (SPI)

devour-devourclient

A cheat for the game Devour.

devsecops

Ultimate DevSecOps library

dexcalibur

[Official] Android reverse engineering tool focused on dynamic instrumentation automation leveraging Frida. It disassembles dex, analyzes it statically, generates hooks, discovers reflected methods, stores intercepted data and does new things from it. Its aim is to be an all-in-one Android reverse engineering platform.

dexkit

A high performance dex deobfuscator library.

dexkit-android

A high performance dex deobfuscator library.

dfirtriage

Digital forensic acquisition tool for Windows based incident response.

diablo-2-motoko

motoko is a plugin-based, clientless automation system for Diablo II.