GEF (GDB Enhanced Features) is a production-grade GDB plugin for exploit development, reverse engineering, and binary analysis. It is a single Python script (gef.py) that loads into GDB (>=10.0) and provides over 90 commands covering memory inspection, heap analysis, security mitigation checks (checksec), pattern generation, format string detection, and remote debugging. The architecture is monolithic but well-organized, with a clear separation of concerns via class hierarchies for architectures, memory regions, heap structures, and command registration. The test suite is extensive, using a Docker-based CI matrix that runs on multiple architectures (x86, ARM, AARCH64, etc.) and validates behaviour through RPyC-driven remote GDB sessions. While primarily an application, it also serves as a research tool for heap allocator internals and glibc version-specific behaviour, blending practical utility with deep system understanding.
IntelOwl is a production-grade, open-source threat intelligence platform that automates the analysis of observables (IPs, domains, URLs, hashes) and files (PE, PDF, APK, etc.) through a pluggable plugin system. The backend is built with Django REST Framework, Celery for asynchronous task execution, and Django Channels for real-time WebSocket updates. The frontend is a React single-page application using react-router, react-flow for pipeline visualizations, and Zustand for state management. The system supports multi-tenancy, organizations, role-based access, and integrates with dozens of external threat intelligence APIs and open-source analysis tools via containerized microservices. The architecture is centered around a plugin framework with five plugin types: analyzers (file and observable), connectors (push results to external systems), visualizers (render reports), pivots (create child jobs from analysis results), and ingestors (pull threat feeds). Playbooks bundle these plugins into repeatable analysis workflows. A data model manager normalizes analyzer outputs into structured evaluations with reliability scores, and a user event system allows manual verdict overrides with decay logic. The platform also includes an AI chatbot assistant powered by a local Ollama LLM and LangGraph, enabling natural-language queries and one-click analysis launches. Key operational features include a comprehensive REST API, token-based authentication with optional OAuth/LDAP/RADIUS, Elasticsearch for BI reporting, and Docker-based deployment with separate containers for specialized analyzers. The codebase is actively maintained with extensive unit and integration tests, CI/CD pipelines, and a large community (4695 stars). While the migration system is somewhat repetitive, the overall architecture is clean, modular, and demonstrates strong software engineering practices.
x64dbg is an open-source binary debugger for Windows targeting malware analysis and reverse engineering. The architecture is a three-layer system: a GUI layer (Qt-based Windows application), a bridge layer (C API for communication), and a debugger core layer (TitanEngine/GleeBug/StaticEngine backends). The debugger supports x86 and x64 processes with comprehensive features including conditional breakpoints, memory analysis, symbol handling, and an extensive plugin SDK. The codebase demonstrates strong engineering in several areas. The analysis engine implements multiple analysis passes (linear, recursive, control flow, xrefs) with a clean pass-based architecture. The command system uses a flexible registration pattern with consistent error handling. The bridge layer provides a well-defined C API surface for plugins with careful attention to thread safety and marshaling between GUI and debugger threads. Recent development shows active work on Linux support (ElfBug debugger), cross-platform tools (hex viewer, minidump analyzer, remote table), and a comprehensive test framework with headless testing infrastructure. The test system uses convention-based test discovery with script-driven scenarios and plugin-based assertions. Technical debt includes some outdated documentation (docs reference Python 2.7 for CHM generation), mixed use of Qt versions (5.12+ required but some paths reference older configurations), and the inherent complexity of maintaining both Windows debugger and cross-platform analysis tools in one repository. The dependency on precompiled libraries (TitanEngine, Zydis, XEDParse) creates build complexity but is managed through CMake.
Radare2 is a modular reverse engineering framework written in C. It provides a comprehensive set of libraries and command-line tools for binary analysis, disassembly, debugging, emulation, and file format parsing. The architecture is plugin-based: every major subsystem (architectures, binary formats, I/O backends, debuggers, filesystems, crypto, scripting languages) is implemented as a plugin registered via a common RLibStruct pattern. The core library (libr/) contains reusable data structures (RBTrees, RBuffer, RStrBuf, RList, etc.), utilities (base64, ASN.1, regex, event system, thread wrappers), and analysis engines (ESIL emulator, search algorithms, type propagation). The framework supports dozens of CPU architectures (x86, ARM, MIPS, RISC-V, etc.) and binary formats (ELF, PE, Mach-O, DEX, etc.), and can be extended via language bindings (JavaScript, Python, Rust, etc.) and a package manager (r2pm). Despite its large codebase and some legacy components, the project is actively maintained with continuous integration, fuzz testing, and a responsive issue tracker.
A comprehensive, actively maintained collection of IDA Pro plugins, scripts, and tooling authored by Willi Ballenthin (Hex-Rays). The repository spans multiple domains: UI enhancement plugins (oplog, bookmark_hints, colorize_calls, navband_visited, tag_func, hint_calls), analysis utilities (flirt-data-pack, vtloader, global_struct_dissector), a CLI binary inspector (idals), and a modern LLM-integrated reverse engineering agent (ida-codemode) consisting of a sandbox, portable API, AI agent, and evaluation framework. The core idawilli package provides reusable syntax and lexing utilities for IDA's tagged-line output. The codebase is well-engineered with modern Python practices: Pydantic models, type hints, uv workspace management, Rich CLI interfaces, and comprehensive pytest suites. While primarily an application for IDA Pro enhancement, it also includes data/research elements in the form of LLM benchmarking evaluations (c2_extraction) and systematic test data. The sandbox isolation pattern, evaluator framework, and tagged-line parsing utilities are especially clean and potentially reusable outside this repository.
IFL (Interactive Functions List) is an IDA Pro plugin that provides an enhanced interface for browsing, analyzing, and navigating functions within binary files. The plugin creates a dockable window displaying a comprehensive table of all functions with their attributes (addresses, names, types, arguments, reference counts) and features tabbed views showing incoming/outgoing references for selected functions. Key capabilities include real-time filtering, double-click navigation to addresses, in-place function renaming, and import/export of function names in CSV, TAG, and .imports.txt formats (compatible with tools like PE-sieve). The architecture follows a model-view pattern using Qt (PyQt5/PySide6 abstraction) integrated with IDA's plugin framework, featuring automatic theme adaptation to match IDA's UI and sophisticated reference tracking logic.
Strelka is a real-time, containerized file scanning system designed for threat hunting, detection, and incident response at enterprise scale. It is built with a Go frontend and manager components that handle gRPC client intake, Redis-based task coordination, and response logging (local, Kafka, S3), while Python backend workers execute over 50 file-format scanners. The system uses YARA rules for initial file classification ('taste'), then dispatches files to specialized scanners for metadata extraction, IOC detection, archive extraction, and malware analysis. It supports multiple client modes: oneshot (CLI), filestream (continuous file monitoring), and a Python client. Deployment is via Docker Compose or Kubernetes, with optional Envoy proxy and OpenTelemetry tracing. The architecture follows a microservices pattern: frontend (gRPC server), coordinator (Redis task queue), gatekeeper (dedup cache), manager (Redis management), and backend (Python scanner workers). Scanners are dynamically loaded and configured via YAML, with positive/negative flavor matching. The codebase includes extensive test fixtures and pytest tests for each scanner, CI/CD pipelines, and pre-commit hooks. While the system is production-ready and well-structured, it exhibits some code duplication across archive scanners, deprecated library usage (pylzma, old protobuf), and brittle subprocess calls for password cracking. Overall, it is a strong, maintainable security analysis platform.
FLARE-VM is a collection of PowerShell and Python scripts for automating the setup of a Windows-based reverse engineering virtual machine. The core installer (`install.ps1`) uses Chocolatey and Boxstarter to deploy a curated set of malware analysis tools, configure environment variables, registry settings, and taskbar layout. It provides both a GUI and CLI mode for package selection. The repository also includes a set of VirtualBox helper scripts (`virtualbox/`) for building, exporting, and cleaning VM snapshots, as well as monitoring network adapter status. These scripts are well-structured and can be reused independently for VirtualBox automation. The project is actively maintained by Mandiant (Google) and serves the malware analysis community.
Speakeasy is a Windows malware emulation framework developed by Mandiant (FireEye). It executes Windows PE executables, DLLs, drivers, and shellcode in a fully emulated Windows environment, intercepting API calls via a large set of stub handlers that model kernel32, ntdll, ws2_32, user32, ntoskrnl, and many other DLLs. The emulation is powered by Unicorn (CPU emulation) and Capstone (disassembly). It provides both a CLI tool (`speakeasy`) and a Python library (`Speakeasy` class) for programmatic use. Key features include: user-mode and kernel-mode emulation, GDB remote debugging support, configurable file system, registry, network, and process models, SEH handling, API hammering detection, and structured JSON reports with profiling events, memory captures, and artifact deduplication. The architecture is a monolithic Python package with a core emulator class, platform-specific emulators (Win32Emulator, WinKernelEmulator), and a large set of API handler modules organized by DLL. Dependencies include unicorn, capstone, pefile, pydantic, rich, and pyelftools. The project is primarily used for automated malware analysis and reverse engineering.
WDExtract is a command-line utility for extracting and analyzing Windows Defender/Virus Definition files. It processes VDM (Virus Definition Module) containers and MRT.exe (Malicious Removal Tool) files to extract embedded data, including PE executables, DLLs, and security signatures. The tool can also merge base VDM files with their delta updates and extract raw RMDX containers without further processing. Built with C++ and Windows API, it uses zlib for decompression and implements custom logic for parsing PE files, applying VCDIFF delta patches, and extracting resources from PE files. The application is actively maintained with recent commits and uses GitHub Actions for Windows-based builds.
de4py is a comprehensive Python deobfuscation and reverse engineering tool designed primarily for Windows environments. It combines a native PySide6 GUI with a CLI interface to analyze, unpack, and clean obfuscated Python scripts and PyInstaller executables. The core functionality relies on a modular engine architecture that supports multiple deobfuscation strategies, including legacy regex-based detection and the newer 'Onyx' engine which utilizes AST manipulation and local LLM integration for semantic recovery. It also features native C++ components for process injection and behavior monitoring, allowing users to hook into running Python processes for dynamic analysis. The architecture is split between high-level Python logic for AST transformation and low-level C++ code for system interaction. The Python side manages the deobfuscation pipeline, UI rendering, and plugin management, while the C++ side handles DLL injection, API hooking via Detours, and named pipe communication. This hybrid approach provides powerful capabilities but introduces significant platform coupling and dependency on specific Windows APIs and Python versions. The tool is licensed under CC BY-NC-4.0, restricting commercial use. While the codebase demonstrates sophisticated engineering in areas like VM lifting and AST optimization, it carries risks associated with external API dependencies (telemetry, updates), brittle regex signatures for obfuscation detection, and heavy reliance on Windows-specific system calls. It is best suited for security researchers and malware analysts working in Windows environments who require a unified static and dynamic analysis platform.
This repository is a manually curated awesome-list/registry of open-source security scanners and offensive/defensive tools. It spans traditional security testing categories (web, mobile, binary, smart-contract, IoT, APT) and an actively expanded section for AI/LLM-agent security. The actual content is a set of near-identical English, Chinese, and Spanish README files containing hundreds of one-line tool entries with shields.io badges for language, last commit, stars, and license. There is no application runtime, no build pipeline, and no test suite; the product is a navigable knowledge base rather than software. The repo is therefore classified as data_research only in the sense that it is a structured, human-maintained metadata registry, not a data pipeline. The primary data lineage is manual: maintainers sample external GitHub projects, annotate each with a one-sentence description and category, and publish the result as markdown. The taxonomy serves as an analytical schema, answering questions such as which open-source scanners exist for a given domain, which are active, and what maturity signals (stars, license, last commit) they carry. It does not provide quantitative benchmarks or automated validation, and the data is not exposed in machine-readable form beyond the markdown itself. Reuse is straightforward for human readers, but automation requires parsing the markdown and accepting that some badges or links may be stale or inconsistent. The repository is actively curated, with recent emphasis on AI security, a documented commit convention, and multilingual READMEs. Its main risks are extrinsic: link rot, renamed or abandoned upstream tools, and the CC BY-NC-ND license, which restricts derivative redistribution. Technical drift is moderate because some older categories and tools are outdated even though the overall list is kept current.
This repository is a distribution bundle of third-party reverse engineering and malware analysis tools for Windows, packaged with an installer and updater. The tools are organized into categories such as Analysis, Decompilers, Disassemblers, Hex Editors, Network Monitors, Unpackers, and more. The project provides Inno Setup scripts for building installers, a custom updater executable, and CI/CD workflows (GitHub Actions) for automated builds and signing. The custom code (Python scripts for installer generation, batch files for tool updates) is functional but tightly coupled to this specific packaging project. The repository serves as a convenient, curated collection of tools rather than an original software application, making it valuable for analysts who need a ready-to-use toolkit.
GDA (GJoy Dex Analyzer) is a Windows-native, closed-source Dalvik bytecode decompiler and Android APK reversing tool, written in C++. It provides a GUI for interactive analysis, a CLI for batch operations, and a socket-based server for programmatic access. The open-source components in this repository include Java and Python plugin APIs for scripting analysis tasks (e.g., string decryption, method tracing), example scripts, and skill definitions for LLM-driven automated malware analysis. The core decompiler is not open source, but the plugin interfaces and skill scripts are well-structured and reusable for integrating GDA with other tools or AI agents. The repository also contains color themes, documentation images, and a DEX patching utility.
This repository, branded as "The Malware Bible," is a curated educational knowledge base for cybersecurity, malware analysis, reverse engineering, and exploit development. It is not a conventional software application or an operational data pipeline; under the available classifications it is closest to data/research because its core assets are reference documentation, course-style Markdown modules, and research-oriented binaries rather than runnable application code. The content is organized into four learning paths: The Beginning (C, Python, x86 assembly, shellcode, reverse engineering basics), The Journey (PE/ELF structures, Android/iOS package formats), The Rituals (obfuscation, evasion, and writing malware), and The Scriptures (tool cheatsheets for radare2, IDA Pro, WinDbg, YARA, WinAPI, and evasion tactics). In practice, the repository serves as a self-study curriculum and analyst reference, not as a deployable system. It includes a large Windows DLL export catalog in Markdown, example ELF binaries demonstrating heap overflow, use-after-free, ROP chains and format string bugs, and numerous screenshots/diagrams. There is no CI/CD, dependency management, or automated testing; several files are marked "Coming soon" or "WORK IN PROGRESS," and external links or sponsor images may rot over time. The Windows API and DLL reference content is broad but may drift as Windows evolves. The last commit is recent, indicating active maintenance, and the repository benefits from a structured table of contents and consistent formatting across chapters.
This repository is a collection of blog posts, presentations, Jupyter notebooks, and scripts by John Lambert (@JohnLaTwC), a renowned security engineer from Microsoft. It serves as a knowledge base for security defenders, covering topics such as attack graph theory, the MS08-067 vulnerability story, and the 'Githubification of InfoSec' concept, which advocates for open, community-driven security practices using MITRE ATT&CK, Sigma rules, and Jupyter notebooks. The notebooks focus on malware analysis, shellcode reverse engineering, and threat hunting, often leveraging VirusTotal APIs and custom disassembly tools. The Yara rules provide detection for document-based attacks. The PowerShell scripts are utilities to restore Windows Defender to a secure configuration. While the content is highly educational and demonstrates deep security expertise, the repository does not constitute a structured application or a reusable data pipeline; it is a curated set of resources for learning and reference.
This repository is a curated list (awesome list) of resources related to malware persistence techniques, tools, and references across multiple platforms (Windows, Linux, macOS, Cloud, Firmware, Databases). It does not contain any executable code, application logic, or data pipelines; it is purely a collection of external links and descriptions organized into categories such as Techniques, Persistence Removal, Detection Testing, Prevention, and Collection. The repository is maintained under the 'awesome' standard with a CI workflow that runs awesome-lint to ensure formatting compliance. It serves as a reference knowledge base for cybersecurity professionals researching persistence mechanisms.