Tamas K Lengyel

drakvuf. DRAKVUF Black-box Binary Analysis

xen-uefi. Instructions and tools to boot Xen in UEFI mode with TPM measurements of Xen and dom0

valgrind. Unofficial mirror of git://sourceware.org/git/valgrind.git

honeybrid. Honeybrid is a network application built to 1) administrate network of honeypots, and 2) transparently redirect live network sessions (TCP or UDP) from one primary destination host to a secondary destination host.

tboot. Unofficial mirror of https://sourceforge.net/p/tboot

dionaea. Dionaea is meant to be a nepenthes successor, embedding python as scripting language, using libemu to detect shellcodes, supporting ipv6 and tls

guestrace. Unofficial mirror of

troopers-training. C

xen. C

drakvuf-builds.

VirtualDeobfuscator. Reverse engineering tool for virtualization wrappers

libnetfilter_queue. libnetfilter_queue is a userspace library providing an API to packets that have been queued by the kernel packet filter. It is is part of a system that deprecates the old ip_queue / libipq mechanism.

No_Sandboxes. Test suite for bypassing Malware sandboxes.

libvmi. C

crwatcher. Watch MOV-TO-CR0/CR3/CR4 events on Xen via LibVMI

drakvuf-doppelganging. Shellcode used for Doppelganging with DRAKVUF

xendbg. A feature-complete reference implementation of a modern Xen VMI debugger.

add-to-efi.sh. Script to add boot entries to native EFI loader

HBFA-FL. C

dwarf2json. convert ELF/DWARF symbol and type information into vol3's intermediate JSON

rekall. Rekall Memory Forensic Framework

RE-for-beginners. "Reverse Engineering for Beginners" free book

drakvuf-deployer. C

vchan-aes. Xen vchan based AES client/server implementation

Edk2Code. TypeScript

simulator-bindings. Rust Bindings and tools for the Intel® Simics® Simulator

action-send-mail. :gear: A GitHub Action to send an email to multiple recipients

coverity-scan-results-to-sarif. Converts Coverity results to SARIF standard

luci. LuCI - OpenWrt Configuration Interface

ollama-intel-gpu. Dockerfile

codeql-action. Actions for running CodeQL analysis

bareflank_libvmi_extension. Extension to the Bareflank hypervisor supporting LibVMI

vmsifter. Python

Qubes_Drakvuf. Repository of Qubes How-To Guides

drakpdb. Convert Windows PDB into JSON profile

volatility3. Volatility 3.0 development

oss-fuzz. OSS-Fuzz - continuous fuzzing for open source software.

ccscanner. CMake

BinAbsInspector. BinAbsInspector: Vulnerability Scanner for Binaries

create-or-update-comment. A GitHub action to create or update an issue or pull request comment

AFLplusplus. afl++ is afl 2.56b with community patches, AFLfast power schedules, qemu 3.1 upgrade + laf-intel support, MOpt mutators, InsTrim instrumentation, unicorn_mode and a lot more!

edk2-staging. EDK II new feature staging

edk2. EDK II

xen-privcmd-lkm. An out-of-tree LKM version of the Linux xen-privcmd kernel module

TheWorksOfZeusHammer. Python

cloudflare-blog. Cloudflare Blog code samples

vmtaint. Full-VM taint analysis with Xen, Intel(R) Processor Trace and Triton.

bddisasm. bddisasm is a fast, lightweight, x86/x64 instruction decoder. The project also features a fast, basic, x86/x64 instruction emulator, designed specifically to detect shellcode-like behavior.

drakvuf-ci. Shell

ecr_toolkit. C

gnu-efi. Mirror of gnu-efi from sourceforge.