goowen Goto Github PK

learning-reverse-engineering

This repository contains sample programs written primarily in C and C++ for learning native code reverse engineering.

lenovo_exec

CVE-2022-3699 with arbitrary kernel code execution capability

libcapcom

Capcom driver exploit wrapper

linux-exploit-suggester

Linux privilege escalation auditing tool

llvm-msvc-build

Build llvm-msvc

llvmanalyzer

笔者在一款基于LLVM编译器架构的retdec开源反编译器工具的基础上,融合了klee符号执行工具,通过符号执行(Symbolic Execution)引擎动态模拟反编译后的llvm的ir(中间指令集)运行源程序的方法,插桩所有的对x86指令集的thiscall类型函数对this指针结构体(也就是rcx寄存器,简称this结构)偏移量引用,经行分析汇总后自动识别this结构体的具体内容,并自动集成导入ida工具辅助分析.

localdllparse

lockdexedemo

A demo of the relevant blog post: https://www.arashparsa.com/hook-heaps-and-live-free/

logic.net

A more advanced free and open .NET obfuscator using dnlib.

lsarelayx

NTLM relaying for Windows made easy

magnuskatz

Research project for understanding how Mimikatz work and become better at C

manual-syscall-detect

A tool for detecting manual/direct syscalls in x86 and x64 processes using Nirvana Hooks.

mass-rat

Basic Multiplatform Remote Administration Tool - Xamarin

masterhide

MasterHide x64 Rootkit

masuit.tools

包含一些常用的操作类，大都是静态类，加密解密，反射操作，动态编译，Excel简单导出，权重随机筛选算法，简繁转换，分布式短id，表达式树，linq扩展，文件压缩，多线程下载和FTP客户端，硬件信息，字符串扩展方法，日期时间扩展操作，**农历，大文件拷贝，图像裁剪，验证码，断点续传，实体映射、集合扩展等常用封装。任何性质的外包公司或996公司需要使用本类库，请联系作者进行商业授权，版权所有，违者必究！

mediatek-fuzzing-workshop

Mediatek Fuzzing Workshop in HITCON 2021

memdllloader_blackbone

Windows memory hacking library

memfuck

A PoC designed to bypass all usermode hooks in a WoW64 environment.

memory-module-loader

An implementation of a Windows loader that can load dynamic-linked libraries (DLLs) directly from memory

memorymodule

Library to load a DLL from memory.

merlin

Merlin is a cross-platform post-exploitation HTTP/2 Command & Control server and agent written in golang.

mhydump

minhook.net

A C# port of the MinHook API hooking library

minidump

C# Lsass parser

minidump-1

Custom implementation of DbgHelp's MiniDumpWriteDump function. Uses static syscalls to replace low-level functions like NtReadVirtualMemory.

minify

Combines. minifies, and serves CSS or Javascript files

misc-powershell-stuff

random powershell goodness

moska

Tiny Windows x86 Assembly Compiler in C++ and Keystone Engine

multipotato

multirdp

MultiRDP is a C# consosle application to make multiple RDP (Remote Desktop) sessions possible by patching termsrv.dll correctly.