This repository, branded as "The Malware Bible," is a curated educational knowledge base for cybersecurity, malware analysis, reverse engineering, and exploit development. It is not a conventional software application or an operational data pipeline; under the available classifications it is closest to data/research because its core assets are reference documentation, course-style Markdown modules, and research-oriented binaries rather than runnable application code. The content is organized into four learning paths: The Beginning (C, Python, x86 assembly, shellcode, reverse engineering basics), The Journey (PE/ELF structures, Android/iOS package formats), The Rituals (obfuscation, evasion, and writing malware), and The Scriptures (tool cheatsheets for radare2, IDA Pro, WinDbg, YARA, WinAPI, and evasion tactics). In practice, the repository serves as a self-study curriculum and analyst reference, not as a deployable system. It includes a large Windows DLL export catalog in Markdown, example ELF binaries demonstrating heap overflow, use-after-free, ROP chains and format string bugs, and numerous screenshots/diagrams. There is no CI/CD, dependency management, or automated testing; several files are marked "Coming soon" or "WORK IN PROGRESS," and external links or sponsor images may rot over time. The Windows API and DLL reference content is broad but may drift as Windows evolves. The last commit is recent, indicating active maintenance, and the repository benefits from a structured table of contents and consistent formatting across chapters.
This repository is the CTF Wiki, a comprehensive, community-driven knowledge base for Capture The Flag (CTF) security competitions. It is a static documentation site built with MkDocs and the Material theme, supporting multiple languages (Simplified Chinese, Traditional Chinese, English). The content covers a wide range of security topics including binary exploitation (pwn), cryptography, reverse engineering, web security, blockchain, Android security, and miscellaneous challenges. The repository itself is not a software application but a collection of Markdown files, images, and configuration files that are built into a static website. It includes CI/CD pipelines for deployment to Netlify and GitHub Pages, a Dockerfile for production serving, and a build script (scripts/docs.py) for multi-language management. While the documentation is extensive and well-organized, the codebase is primarily configuration and build tooling, with limited reusable software components. The project shows signs of maintenance with recent commits, but many pages are incomplete or outdated, and some dependencies (Python 3.8, pydantic 1.5.1) are lagging behind current versions.
This repository implements BTD, a deep neural network (DNN) executable decompiler for x86 binaries. It recovers model specifications (operator types, topology, dimensions, parameters) from DNN executables compiled by TVM, Glow, and NNFusion frameworks. The system uses dynamic binary instrumentation via Intel Pin to collect execution traces, applies symbolic execution and taint analysis to recover tensor shapes, extracts parameters from memory dumps, and rebuilds models in PyTorch for correctness verification. The architecture consists of interconnected Python scripts and Pin tools organized around a three-phase decompilation pipeline: trace collection and filtering, shape recovery via symbolic execution, and parameter extraction. Key entry points include evaluation shell scripts (decompile_eval.sh, op_infer_eval.sh) and model-specific decompile/rebuild scripts in the evaluation/ directory. The system relies on external dependencies including Intel Pin 3.14, IDA Pro 7.5 (optional), and specific compiler versions (TVM v0.7-v0.9, Glow 2020-2022, NNFusion).
MalumMenu is a BepInEx plugin for Among Us that provides a graphical cheat menu with toggles and player picker menus. It intercepts game functions via Harmony patches to enable features like ESP, teleportation, role manipulation, sabotage control, and network overload (RPC flooding). The code is structured as a monolithic Unity OnGUI interface with static cheat toggle states and dedicated handler classes for arrows, tracers, minimap, and doors. It targets the latest Among Us version (2026.8.18) and uses modern .NET 6.0, but several features (GuestMode, OverloadUI, RolesUI) are commented out or incomplete, indicating partial migration. The architecture is tightly coupled to the game's internal APIs, making it unsuitable for extraction outside its original context, but individual components like ArrowHandler and DoorsHandler demonstrate clean encapsulation patterns that could be reused in similar Among Us modding projects.
This repository serves as the central community hub for the freeRASP mobile security SDK. It does not contain any source code itself; instead, it aggregates platform-specific implementations (Android, iOS, Flutter, React Native, etc.) via Git submodules. The actual security detection logic, integration APIs, and threat monitoring are implemented in the respective submodule repositories. This meta-repo provides documentation, issue tracking, and release coordination across platforms. It is well-maintained with active issue triage and a CI workflow for issue monitoring. The project is licensed under MIT with a fair usage policy.
This repository serves as a comprehensive documentation project that provides deep-dive insights into the architecture, internals, and usage of various AI-powered CLI tools. It documents five specific tools: Claude Agent SDK, Gemini CLI, Codex CLI, OpenCode, and Pi Coding Agent, offering detailed explanations of their internal workings, features, and integration patterns. The content is derived from direct source code analysis and aims to fill the gaps in official documentation. The repository is structured with dedicated directories for each tool, following a standardized numbering convention for topics (e.g., 01-overview, 02-technical-stack). It also includes specialized extraction sections for the Claude Agent SDK, breaking down its subsystems into individually documented 'complete' files. This approach demonstrates a reproducible pattern for knowledge extraction from complex software systems. While the repository excels in organizing and presenting technical information, it relies on external source code for its content and does not include the analysis scripts or raw data used to generate the documentation. This makes reproducing the exact analysis challenging, though the documented versions of each tool are specified. The documentation faces a high risk of becoming outdated due to the rapid evolution of the underlying AI CLI tools.
This repository is a reimplementation of the Deus Ex: Human Revolution Director's Cut (DXHRDC) game engine, created through manual decompilation and cleanup of the original binary, supplemented with debug information from a leaked Tomb Raider (2013) build (same engine family). It is not a matching decompilation and lacks automated resynchronization with the original binary. The engine requires original game assets (BIGFILE.* files) to run and provides core systems for rendering (DirectX 11 abstraction), audio (FMOD-based), animation (animation graph), game logic (object management, AI, player systems), input, UI (Scaleform via ImGui), resource management, and world streaming. The architecture is modular but monolithic, with a central game loop in cdcGameShell/MainG2.cpp. While the code shows evidence of structured design (interfaces, resource management, job system), it contains numerous TODOs, HACKs, and incomplete implementations, indicating ongoing work. Dependencies include DirectX 11 (or dxvk-native for Linux), FMOD, Dear ImGui, and miniz. The project is actively maintained with recent commits.
Dusklight is a reverse-engineered reimplementation of The Legend of Zelda: Twilight Princess for PC, built on the Aurora engine. It replaces the original GameCube/Wii runtime with a modern cross-platform renderer (D3D12, Vulkan, Metal) and adds extensive modding support. The codebase is dominated by decompiled game logic (actor framework, collision, audio) and massive asset resource definitions duplicated across dozens of region variants. A custom modding layer (dusk) provides UI windows, input handling, save editing, autosave, achievements, LiveSplit integration, and a service-oriented mod dependency system. The project is actively developed but carries significant technical debt from its decompilation origins: many functions are marked NONMATCHING, large portions of SDK libraries are stub implementations, and asset headers are copied verbatim across multiple build variant directories, creating maintenance risk. The modding infrastructure shows good engineering practices, but the core game code remains tightly coupled to the original binary layout.
CoCo Downloader is a multi-platform music retrieval and acquisition tool with a web frontend (Next.js/React) and a desktop client (Python/PyQt5). It enables users to search, preview, and download music from multiple Chinese streaming services (QQ Music, NetEase Cloud Music, Kugou, etc.) by reverse-engineering their APIs and scraping their HTML. The architecture follows a monolithic design for each platform, with shared provider abstraction patterns but separate implementations. The web app exposes API routes that proxy requests to music providers, while the desktop client uses a similar pattern with Qt-based UI. Notable features include multi-quality downloads, playback with lyrics display, caching, and theme support. The repository demonstrates moderate engineering craftsmanship with clean provider interfaces but suffers from duplicated code across platforms, hardcoded and potentially brittle API parameters, and security concerns (exposed API keys). It is a functional hobbyist-grade application with a dedicated community (553 stars, 166 forks).
This repository is a template for creating ReVanced patches. It provides a Gradle multi-module project structure with a patches module and an extensions module, along with example code for a bytecode patch and an Android extension. The template includes CI/CD workflows for building, testing, and releasing patches using semantic release, as well as issue templates and contribution guidelines. The actual patch logic is not implemented (the example patch contains a TODO), making this a scaffolding repository intended to be forked and customized. The codebase is minimal and well-organized, but lacks any non-trivial logic or reusable components beyond the template structure itself.
This repository implements a Windows DLL (version.dll) that uses DLL proxy injection to hook into the WeChat desktop client (x64, version 4.1.x). Once injected, it launches a local HTTP server on port 30001 that exposes a REST API for automating WeChat operations: sending text/image/XML messages, forwarding messages, decoding encrypted image caches, querying the user's profile, and executing arbitrary SQL on WeChat's internal SQLite databases (e.g., MicroMsg.db). The architecture is a monolithic DLL with several layers: a proxy DLL loader (version_proxy.cpp), a custom x64 hooking framework (Hook_Method.cpp) using MinHook and assembly trampolines, a set of WeChat interface implementations (wx_send.cpp, wx_send_xml.cpp, etc.) that construct internal WeChat objects using known memory offsets, and an HTTP server (http_server.cpp) built on the vendored cpp-httplib library. The project also includes a database access module (xdb/db_mgr.cpp) that scans WeChat's memory for SQLite3 API routines and executes queries directly, bypassing the need for external database drivers. External dependencies include MinHook (bundled), cpp-httplib (vendored), LZ4 compression library, and nlohmann/json. The code is heavily tied to specific WeChat version offsets and memory layouts, making it fragile across WeChat updates, but the project's update log shows active adaptation to new versions.
The Firmware Modification Kit (FMK) is a CLI-based application toolkit designed for the extraction, analysis, and rebuilding of embedded Linux firmware images, primarily for routers and IoT devices. It functions as a monolithic suite of shell scripts, C/C++ binaries, and Python utilities that orchestrate a workflow: ingest a firmware binary, extract its filesystems (SquashFS, CramFS, YAFFS2), allow modification of contents or web UIs, and rebuild the image. The architecture relies heavily on bundled legacy versions of open-source tools, specifically Binwalk 2.1.1, multiple versions of SquashFS tools (2.0 through 4.2), and the 7-Zip/LZMA SDK. While functionally effective for its niche in embedded security and reverse engineering, the codebase exhibits significant technical debt due to massive code duplication across versioned forks of the same libraries and reliance on outdated dependencies (Python 2, legacy Windows API calls).
This repository is a collection of Proof of Concept (PoC) implementations for various Windows process manipulation and evasion techniques, including process hollowing, DLL injection, spoofing, and memory analysis. Each technique is implemented as a standalone console application with a consistent structure separating command-line handling, core logic, and Windows API interop. The code demonstrates a clear understanding of Windows internals but suffers from significant code duplication (e.g., identical CommandLineParser and HexDump utilities across multiple projects) and relies on undocumented APIs that are prone to breaking with Windows updates. Many techniques are noted in the README as ineffective against modern Windows defenses due to security mitigations. The repository appears to be stale, with no recent updates to address evolving defenses, and exhibits high technical drift due to outdated dependencies and techniques.
This repository serves as a technical deep-dive into Google's reCAPTCHA system, particularly focusing on its obfuscation techniques, fingerprinting mechanisms, and anti-tampering measures. It includes extracted JavaScript snippets that implement specific browser fingerprinting signals (e.g., storage access checks, window opener properties, WebGL data extraction) and JSON files containing example fingerprint data. The repository also contains analysis of the now-removed BotGuard component, including its obfuscated virtual machine implementations. While the subject matter is largely historical due to the removal of BotGuard in April 2026, the repository provides valuable insights into the techniques used by advanced anti-bot systems.
This repository is a community archive of Capture The Flag (CTF) challenges, solutions, and security talks from the SecTalks meetup group across multiple cities (Sydney, London, Berlin, etc.). It contains hundreds of challenge files (binaries, scripts, packet captures, images) and corresponding solution writeups and scripts. The repo is not a unified software application or data pipeline; it is a heterogeneous collection of security-related artifacts spanning many years. The primary value is as a reference for CTF participants and security enthusiasts. The code quality varies widely: some solution scripts are well-crafted cryptographic attack implementations (e.g., RSA common modulus, CTR nonce reuse) that could be reused in other CTF contexts, while many are one-off scripts tightly coupled to specific challenges. The repository lacks centralized dependency management, and many challenges require specific environments or tools. It is actively maintained with recent commits and talks.
This repository is a collection of web scraping and anti-crawler reverse engineering practice scripts targeting over 40 Chinese websites. Each site has a dedicated folder containing a Python script (demo.py) that orchestrates scraping by executing a JavaScript file (demo.js) via execjs. The JavaScript files implement cryptographic algorithms (AES, RSA, MD5, SHA, etc.) extracted from the target websites to generate request signatures, encrypt passwords, or decrypt responses. The project is primarily a learning resource for reverse engineering techniques, not a production scraping framework. It includes documentation for each case, a changelog tracking API changes, and some utility scripts. The code is ad-hoc, tightly coupled to specific sites, and lacks tests or error handling, making it fragile and high-maintenance. While the individual scripts are functional, they are not reusable without significant adaptation due to hardcoded keys and site-specific logic.
This repository is a collection of cron-triggered Node.js and Python scripts that automate JD.com (Jingdong) account activities such as daily check-ins, lottery draws, coupon management, price protection, and bean/point collection. It is designed to run on the Qinglong panel (a self-hosted cron scheduler) and manages multiple JD accounts via environment variables. The scripts rely heavily on reverse-engineered JD internal APIs, custom signature generation (H5st), and slider captcha solving. They also include a multi-channel notification system (Bark, Serverchan, Telegram, DingTalk, etc.) and utilities for converting WSKEY tokens to session cookies. The codebase is notable for its extensive use of obfuscation (jsjiami.com.v7) to protect algorithmic logic, making maintenance and audit difficult. Despite this, the repository is actively maintained and has a large user base, but the technical debt from obfuscation, duplicated code, and reliance on external sign services is significant.
This repository is a curated 'awesome list' of security and hacking resources, aggregating links to other GitHub repositories, tools, and references. It functions as a meta-index rather than a software application or data pipeline. The codebase consists solely of a README.md table, a contributing guide, and a GitHub Actions workflow for thread locking. There is no executable code, no data transformations, and no analytical models. The primary content is a manually maintained list of links organized by topic (e.g., Android Security, Bug Bounty, OSINT). While useful as a navigation aid for security professionals, the repository has zero software craftsmanship or reusability beyond its nature as a link collection. The hybrid classification of 'data_research' reflects its role as a curated dataset of resource metadata, though it lacks any actual data processing or research methodology.