Pavel

titan. Titan is a VMProtect devirtualizer

vm_jit. VM devirtualization PoC based on AsmJit and llvm

packman-deobfuscator. Python

ida_names. IDA-names automatically renames pseudocode windows with the current function name.

vdk. vdk is a set of utilities used to help with exploitation of a vulnerable driver.

hypereye. My research WIP bluepill hypervisor

vmpfix. Universal x86/x64 VMProtect 2.0-3.X Import fixer

CTF-Writeups. reverse engninering & pwn writeup

srvhide. Simple tool to dump/hide services in services.exe process.

llvm_stuff. LLVM based devirtualization PoC’s.

api-tracer. api-tracer is a tiny (useless) tracer

Panda. Panda - is a set of utilities used to research how PsExec encrypts its traffic.

libx86. Simple library-wrapper around triton for emulation/disassembly

driver_template. Windows driver template with cmake that I use

remill-helloworld. Simple hello world with remill

windbg_scripts. JavaScript

drakvuf. DRAKVUF Black-box Binary Analysis

custom-GetProcAddress. C++

Challenge-VM. Practice VM

archercreat.github.io. SCSS

nix-channel. Personal Nix channel

PinkyVM. Python

spacezVM. Python

dta-vs-osc. Dynamic Taint Analysis versus Obfuscated Self-Checking

Triton. Triton is a dynamic binary analysis framework. Build your own program analysis tools, automate your reverse engineering, perform software verification or just emulate code.

krabsetw. KrabsETW provides a modern C++ wrapper and a .NET wrapper around the low-level ETW trace consumption functions.

remill. Library for lifting machine code to LLVM bitcode

VMProtectTest. VMProtectTest

llvm-project. The LLVM Project is a collection of modular and reusable compiler and toolchain technologies. Note: the repository does not accept github pull requests at this moment. Please submit your patches at http://reviews.llvm.org.

python_tor_proxy. Python