The Witchcraft Compiler Collection (WCC) is a binary analysis and modification toolkit focused on ELF executables. It provides three primary tools: wld converts executables to shared libraries, wcc 'unlinks' binaries into relocatable objects, and wsh offers an interactive Lua-scriptable shell for runtime binary inspection and modification. The architecture is modular with shared utilities, leveraging BFD for binary format abstraction, Capstone for disassembly, and Lua/JIT for extensibility. Key capabilities include section/header manipulation, symbol table management, relocation processing, and cross-architecture analysis via Qemu user-mode emulation. WCC demonstrates strong craftsmanship in its Lua-C API extension patterns, sophisticated ELF handling, and modular tool design. The wsh tool's Lua integration exposes binary analysis functions (memory access, symbol lookup, section iteration) through a clean C extension interface. The wld tool implements robust ELF section/header manipulation and relocation processing with careful attention to binary format details. The disassembler wrapper in disasm.c provides multi-architecture support while maintaining integration with WCC's data structures. These components show non-obvious skill in binary manipulation and language embedding. The project shows active maintenance with commits up to 2026 and updated copyright notices. Technical drift is low due to recent updates and compatibility with modern dependencies (Lua 5.3, Capstone). While focused on Linux/ELF and primarily x86_64, the code maintains portability through conditional compilation and abstracted binary handling. The build system uses Makefiles with git submodules for dependency management, and the MIT-licensed codebase includes comprehensive documentation and demonstration materials for security research use cases.
chromatic is a runtime instrumentation framework for Chromium/V8 processes that provides Frida-compatible APIs for memory inspection, function interception, breakpoint debugging, and code modification. The architecture consists of a core C++ implementation with TypeScript bindings that expose a JavaScript API. Key capabilities include process/module enumeration, memory read/write/allocation, native function calls, native callbacks, inline hooking via trampolines, software/hardware breakpoints, memory access monitoring, exception handling, and instruction disassembly. The project uses breeze-js (QuickJS) as its JavaScript engine, Capstone for disassembly, asmjit for runtime code generation, libffi for FFI, and TCC for runtime C compilation. Entry points include the chromatic-core library, chromatic-test binary, and chromatic-injectee shared library designed for fripack patching.