Alexander Hanel

oh-my-pi. ⌥ AI Coding agent for the terminal — hash-anchored edits, optimized tool harness, LSP, Python, browser, subagents, and more

magic-context. Unbounded context. Memory that manages itself. One session, for life. The hippocampus for coding agents, part of CortexKit.

pyghidra-PAL. A defensive decompilation layer: Ghidra facts, lifted into runnable Python & artifacts aiding analysis.

genai-security-training. Jupyter Notebook

nono. Sandbox any AI agent in seconds - zero setup, zero latency.

LLMVault. An intentionally vulnerable OWASP LLM Top 10 training platform for AI Security, Prompt Injection, RAG Security, Agent Security, and GenAI penetration testing.

marker. Convert PDF to markdown + JSON quickly with high accuracy

crackmes-re-dataset. Labeled reverse-engineering dataset over 4,598 crackmes: flags, verifier scripts, and normalized obfuscation tags.

AI-For-Beginners. 12 Weeks, 24 Lessons, AI for All!

asftriage. LLM Agent Session Forensics Tool

perfetto. Production-grade client-side tracing, profiling, and analysis for complex software systems.

LiveBench. LiveBench: A Challenging, Contamination-Free LLM Benchmark

ds4. DeepSeek 4 Flash and PRO local inference engine for Metal, CUDA and ROCm

ghidra-rpc. A Ghidra agentic reverse engineering skill.

assignment1-basics. Student version of Assignment 1 for Stanford CS336 - Language Modeling From Scratch

argus. Windows network traffic interception tool for malware analysis. Intercepts HTTP/S, DNS, SMTP, POP3 with fake responses, HTTPS MITM, and per-transaction capture.

ghidra-cli. Automate Ghidra reverse engineering from the command line — headless analysis, decompilation, and structured JSON output for AI agents like Claude Code

ghidrasql-skills. Claude Code skills for ghidrasql — live SQL interface for Ghidra analysis and annotation workflows

Glass. Glass - a fast and free IDA Pro alternative

cerberus-re-skill. cerberus-re is a local Apple-focused reverse-engineering workbench for building a repeatable three-headed static/dynamic/instrumentation loop around Ghidra, LLDB, and Frida.

llvm-jutsu. Anti-LLM obfuscation via finger counting

plannotator. Annotate and review coding agent plans and code diffs visually, share with your team, send feedback to agents with one click.

gemma_crackme_tutorial. HTML

tiny-dec. A tiny educational decompiler that helps people understand how decompilation works.

windbg-decompile-ext. WinDbg x64 extension that disassembles live functions and uses an LLM to produce verified pseudocode.

sogen. 🪅 Windows & Linux userspace emulator

pyghidra-mcp. Python Command-Line Ghidra MCP

gamehacking-cheatsheet. Comprehensive Game Hacking Cheat Sheet for security researchers, reverse engineers, and CTF participants. Covers memory analysis, anti-cheat evasion, exploit development, and game engine reverse engineering for authorized security testing and educational purposes

agent. Language Model Agent Instructions for Binary Refinery

CORUNA_TECHNICAL_ANALYSIS. A Complete Technical Teardown of a State-Grade iOS/macOS Watering-Hole Exploit Chain

Assemblage. Python

YesterPlayOS. YesterPlayOS is a tribute to the golden era of personal computing. Minimalistic, fast, and nostalgic.

claude-code-hooks-mastery. Master Claude Code Hooks

maths-cs-ai-compendium. Become a cracked AI/ML researcher/engineer with this unconventional textbook covering maths, computing, and ML with intuition.

Hypervisors-for-Hackers. The materials of the "Hypervisors for Hackers: Security from the Hardware Up" class held at Global Cybersecurity Camp 2026 Vietnam.

swirly. Learn a python package interactively (similar to R's Swirl)

bof-wsl. bof for interacting with WSL

rust-malware-gallery. A collection of malware families and malware samples which use the Rust programming language.

letsbuildacompiler. Re-implementation of the Let's Build a Compiler tutorial in Python, emitting WASM

shellcode. Shellcodes for Windows/Linux/BSD running on x86, AMD64, ARM, ARM64

warbird-research. Find out how to bypass HVCI (or not). My own research on Microsoft Warbird (specifically in clipsp.sys)

ida-cyberchef. A Qt-based CyberChef interface designed for malware analysis workflows, particularly in IDA Pro

rendergit. Render any git repo into a single static HTML page for humans or LLMs

z3_tutorial. Jupyter notebooks for tutorial on the Z3 SMT solver

drakvuf. DRAKVUF Black-box Binary Analysis

cpu_rec. Recognize cpu instructions in an arbitrary binary file

LinuxInExcel. C

libro. A terminal based book tracking tool

StealthAPCDispatcher. Function scheduling stealth method using APC with encrypted shellcode

hacktical-c. A practical hacker's guide to the C programming language.

ollvm-unflattener. Obfuscator-llvm Control Flow Flattening Deobfuscator

x86-64-playground. An online assembly editor, emulator and debugger for the x86-64 architecture

blink. tiniest x86-64-linux emulator

zydis. Fast and lightweight x86/x86-64 disassembler and code generation library

learning-ai. Notes and exploration code for learning about AI/ML

reconstructing-rust-types-talk-re-verse-2025. Slides and materials for the talk Reconstructing Rust Types: A Practical Guide for Reverse Engineers at RE//verse 2025, presented on February 28, 2025.

agents-course. This repository contains the Hugging Face Agents Course.

ucutils. Convenience routines for working with the Unicorn emulator in Python

blueskyfeedbot. A bot that posts RSS feeds to Bluesky via GitHub Actions

asm-lessons. FFmpeg Assembly Language Lessons

windows_kernel_resources. Papers, blogposts, tutorials etc for learning about Windows kernel exploitation, internals and (r|b)ootkits

dewolf. A research decompiler implemented as a Binary Ninja plugin.

markitdown. Python tool for converting files and office documents to Markdown.

aws-dev-associate. Repo for https://learn.cantrill.io/p/aws-certified-developer-associate

HackSysExtremeVulnerableDriver. HackSys Extreme Vulnerable Driver (HEVD) - Windows & Linux

udmp-parser. A Cross-Platform C++ parser library for Windows user minidumps with Python 3 bindings.

vac-bypass-kernel. Fully working kernel-mode VAC bypass

falcon-operator. Go

PyhidraNotebook. Learn Ghidra through pyhidra

drawmeatree. Tool to visualize the output of the WinDbg "wt" command as customizable graphic trees, to facilitate reverse engineering.

function-graph-overview. Control-Flow Graph (CFG) Visualizer for VSCode

kotaemon. An open-source RAG-based tool for chatting with your documents.

workshops. Malware analysis and Reverse Engineering Workshops from Invoke RE

nyxstone. Nyxstone: assembly / disassembly library based on LLVM, implemented in C++ with Rust and Python bindings, maintained by emproof.com

aidapal. aiDAPal is an IDA Pro plugin that uses a locally running LLM that has been fine-tuned for Hex-Rays pseudocode to assist with code analysis.

business-ctf-2024. Official writeups for Business CTF 2024: The Vault Of Hope

rust-reversing-workshop-northsec-2024. Rust

SourceSync. Set of plugins and library for dynamic pdb generation and synchronisation

ml-basics. Exercise notebooks for Machine Learning modules on Microsoft Learn

SAFACon-Vienna.

operating-system-design-review. Operating System Design Review: A systematic analysis of modern systems architecture

coderex. A tool that automates regex generation for the x86 and x86-64 instruction sets

opentelemetry-ebpf-profiler. The production-scale datacenter profiler (C/C++, Go, Rust, Python, Java, NodeJS, .NET, PHP, Ruby, Perl, ...)

dds. Dr. Disassembler

zydis-go. Pure Go bindings for Zydis.

ipex-llm. Accelerate local LLM inference and finetuning (LLaMA, Mistral, ChatGLM, Qwen, DeepSeek, Mixtral, Gemma, Phi, MiniCPM, Qwen-VL, MiniCPM-V, etc.) on Intel XPU (e.g., local PC with iGPU and NPU, discrete GPU such as Arc, Flex and Max); seamlessly integrate with llama.cpp, Ollama, HuggingFace, LangChain, LlamaIndex, vLLM, DeepSpeed, Axolotl, etc.

ptrtut13. A TUTORIAL ON POINTERS AND ARRAYS IN C

gftrace. A command line Windows API tracing tool for Golang binaries.

xfg_analyzer. A Binary Ninja plugin that uses bruteforced XFG hashes to recover precise function prototypes

lend. Tiny x86 Length Disassembler

mydumbedr. C

QuickAsm. Simple x86/x64 Assembler/Disassembler/Emulator

presentation. Presentation slides, blogs, and videos of my conference presentations.

ghidriff. Python Command-Line Ghidra Binary Diffing Engine

morris-worm. The decompiled Morris Worm source code

declib. A library for writing plugins in any decompiler: includes API lifting, common data formatting, and GUI abstraction!

concealed_code_execution. Tools and technical write-ups describing attacking techniques that rely on concealing code execution on Windows

InsightEngineering. Hardcore Debugging

varbert_api. A Python API to VarBERT, a BERT based model for suggesting variable names in decompiled code.

YARA_Detection_Engineering. Detection Engineering with YARA

VectorKernel. PoCs for Kernelmode rootkit techniques research.

protobuf-magic. Java

ML-For-Beginners. 12 weeks, 26 lessons, 52 quizzes, classic Machine Learning for all

AlternativeShellcodeExec. Alternative Shellcode Execution Via Callbacks

binja-win-docs. Python

windows-driver-docs-ddi. The official Windows Driver Kit DDI reference documentation sources

IdaClu. IdaClu is a version agnostic IDA Pro plugin for grouping similar functions. Pick an existing grouping algorithm or create your own.

Microsoft-365-Defender-Hunting-Queries. Sample queries for Advanced hunting in Microsoft 365 Defender

JonMon. C++

bindiff. Quickly find differences and similarities in disassembled code

cloudynight. Code and example data repository for Mommert (2020): Cloud Identification from All-sky Camera Data with Machine Learning, Astronomical Journal, 159

Learning-EDR-and-EDR_Evasion. I will be uploading all the codes which I created with the help either opensource projects or blogs. This is a step by step EDR learning path for me.

PIC-Get-Privileges. Building and Executing Position Independent Shellcode from Object Files in Memory

discrete-math-python-scripts. Python code snippets from Discrete Mathematics for Computer Science specialization at Coursera

cff_playground. Control flow flattening toy apps

ida-rust-untangler. An IDA plugin which demangles Rust function names

awesome-WinDbg. collect Windows WinDbg notes

python-mastery. Advanced Python Mastery (course by @dabeaz)

comp128. C

revng. revng: the core repository of the rev.ng project

UnpacMe-IDA-Byte-Search. UnpacMe IDA Byte Search

MalwareMorphology. C++

THE_HIVE. My public notes about offensive security

A5.1. A5/1 GSM stream cipher

comprehensive-rust. This is the Rust course used by the Android team at Google. It provides you the material to quickly teach Rust.

winipt. The Windows Library for Intel Process Trace (WinIPT) is a project that leverages the new Intel Processor Trace functionality exposed by Windows 10 Redstone 5 (1809), through a set of libraries and a command-line tool.

Stealthy-Kernelmode-Injector. Manual mapper that uses PTE manipulation, Virtual Address Descriptor (VAD) manipulation, and forceful memory allocation to hide executable pages. (VAD hide / NX bit swapping)

awesome-llvm-security. awesome llvm security [Welcome to PR]

RebirthGuard. Anti-cheat library for Windows C++

DVRT. How Meltdown and Spectre haunt Anti-Cheat: DVRT details

ebpf-beginners. The beginner's guide to eBPF

openai-cookbook. Examples and guides for using the OpenAI API

rust_type_layout_helper_bn. An extremely experimental Binary Ninja importer for the type layout information emitted by the -Zprint-type-sizes flag of the Rust compiler.

gadget_synthesis. Esorics 2021 - Towards Automating Code-Reuse Attacks Using Synthesized Gadget Chains

docker-mcrit. Dockerized Setup for the MinHash-based Code Recognition & Investigation Toolkit (MCRIT)

mac-monitor. "The missing ProcMon for macOS": Mac Monitor records Endpoint Security events and displays them for analysis.

allthingsida. Repository for the code snippets from the AllThingsIDA video channel

iced. Blazing fast and correct x86/x64 disassembler, assembler, decoder, encoder for Rust, .NET, Java, Python, Lua

DotNextSP2019. DotNext 2019 St. Petersburg Talk Demos

libyara.NET. .NET wrapper for libyara built in C++ CLI used to easily incorporate yara into .NET projects

LOLDrivers. Living Off The Land Drivers

VulnCases. Vulnerability examples.

clr-profiler. A CLR (.NET Runtime) profiler written purely in Rust.

DotNetHooking. Sample use cases of the .NET native code hooking technique

maldev-for-dummies. A workshop about Malware Development

Essentials-of-Compilation. A book about compiling Racket and Python to x86-64 assembly

minhook. The Minimalistic x86/x64 API Hooking Library for Windows

obfuscation_detection. Binary Ninja plugin to identify obfuscated code and other interesting code constructs

UnityHacking. The materials to accompany Unity hacking blogs found on mayer.cool

ClrAnalyzer. .NET library for hooking and dumping Clr

SharpCollection. Nightly builds of common C# offensive tools, fresh from their respective master branches built and released in a CDI fashion using Azure DevOps release pipelines.

SharpAllTheThings. The idea is to collect all the C# projects that are Sharp{Word} that can be used in Cobalt Strike as execute assembly command.

Hypervisor-101-in-Rust. The materials of "Hypervisor 101 in Rust", a one-day long course, to quickly learn hardware-assisted virtualization technology and its application for high-performance fuzzing on Intel/AMD processors.

Sealighter. Sysmon-Like research tool for ETW

Presentations. Presentation material presented by Outflank team members at public events.

mattifestation.

EWS. Emulation Wrapper Solution is a IDA Pro plugin that brings emulator capacities to provide features such as debugging an mocking.

CLRInstrumentationEngine. The CLR Instrumentation Engine is a cooperation profiler that allows running multiple profiling extensions in the same process.

DotDumper. An automatic unpacker and logger for DotNet Framework targeting files

etw-event-dumper. C#

clrmd. Microsoft.Diagnostics.Runtime is a set of APIs for introspecting processes and dumps.

SilkETW. C#

OffensiveDLR. Toolbox containing research notes & PoC code for weaponizing .NET's DLR

defcon_27_windbg_workshop. DEFCON 27 workshop - Modern Debugging with WinDbg Preview

BugChecker. SoftICE-like kernel debugger for Windows 11

Anti-Debug-DB. Anti-Debug encyclopedia contains methods used by malware to verify if they are executed under debugging. It includes the description of various anti-debug tricks, their implementation, and recommendations of how to mitigate the each trick.

Evasions. Evasions encyclopedia gathers methods used by malware to evade detection when run in virtualized environment. Methods are grouped into categories for ease of searching and understanding. Also provided are code samples, signature recommendations and countermeasures within each category for the described techniques.

ipyida. IPython console integration for IDA Pro

sliver. Adversary Emulation Framework

gargoyle. Historical Windows temporal memory-state research artifact for studying time-bound memory observations, validation limits, and defensive visibility.

Lesson-3-Control-Flow. C

dumb-obfuscator. Tutorial on how to write the dumbest obfuscator I could think of.

nampa. Nampa - FLIRT for (binary) ninjas

CSCD70. CSCD70 Compiler Optimization

llvm-deobfuscator. Python

opaque-predicates-detective. An approach to detect opaque predicates by identifying the damage caused by the obfuscation.

lancelot. intel x86(-64) code analysis library that reconstructs control flow

goat. GO Approximation of Typer

Artfuscator. A C compiler targeting an artistically pleasing nightmare for reverse engineers

libscemu. SCEMU The crates.io lib, x86 cpu and systems emulator focused mainly for anti-malware

mcrit. The MinHash-based Code Relationship & Investigation Toolkit (MCRIT) is a framework created to simplify the application of the MinHash algorithm in the context of code similarity.

mux-mongo-api. Go

fgtrace. fgtrace is an experimental profiler/tracer that is capturing wallclock timelines for each goroutine. It's very similar to the Chrome profiler.

.NET-Deobfuscator. Lists of .NET Deobfuscator and Unpacker (Open Source)

ripr. Package Binary Code as a Python class using Binary Ninja and Unicorn Engine

f-ing-around-with-binaryninja. Repository of code I've written during my twitch stream, "F'ing Around with Binary Ninja"

pypcode. Python bindings to Ghidra's SLEIGH library for disassembly and lifting to P-Code IR

golang-internals-resources. A collection of articles and videos to understand Golang internals.

binjascripts. Scripts for Binary Ninja

lensm. Go assembly and source viewer

panda_class. Classes for teaching about PANDA, the Platform for Architecture-Neutral Dynamic Analysis

MBA-Solver. Python

tfg. A copy of my Mathematics and Computer Engineering B.Sc. thesis

file-upload. Go

WinDbg_Scripts. Useful scripts for WinDbg using the debugger data model

rusty-memory-loadlibrary. Load DLLs from memory with rust

SiT. Simple Instruction Tracer

blog-posts. Contain code referred in https://www.securityinbits.com/

manticore. Symbolic execution tool

maat. Open-source symbolic execution framework: https://maat.re