Titan is a VMProtect devirtualizer. Contribute to archercreat/titan development by creating an account on GitHub.

A step-by-step how-to guide to using QEMU in Ubuntu 18.04 to emulate embedded devices.

msdocsviewer is a simple tool that parses Microsoft's win32 API and driver documentation to be used within IDA. - alexander-hanel/msdocsviewer

Explore this post and more from the MalwareAnalysis community

﷽

﷽

Key Takeaways The intrusion began with a successful RDP login using already-compromised credentials, likely obtained via an infostealer, data breach reuse, or an initial access broker. Within minut…

A YARA & Malware Analysis Toolkit written in Rust. - dwmetz/MalChela

Process Injection without R/W target memory and without creating a remote thread - Maff1t/InjectNtdllPOC

By Seth Jenkins, Project ZeroIntroductionIn December 2022, Google’s Threat Analysis Group (TAG) discovered an in-the-wild exploit chain targeting Samsu...

Rusty Bootkit - Windows UEFI Bootkit in Rust (Codename: RedLotus) - memN0ps/redlotus-rs

A list of awesome resources about HyperDbg. Contribute to HyperDbg/awesome development by creating an account on GitHub.

Open Source EDR for Windows. Contribute to 0xrawsec/whids development by creating an account on GitHub.

In this article we will see how Windows drivers work, how to create one and, in the end, we will develope a custom EDR that will rely on kernel callback functions, static analysis and API hooking.

FirmWire is a full-system baseband firmware emulation platform for fuzzing, debugging, and root-cause analysis of smartphone baseband firmwares - FirmWire/FirmWire

This post is an addendum to my journey to discover and verify the internals of ALPC, which I've documented in Offensive Windows IPC Internals 3: ALPC. While preparing this blog I figured a second post, explaining the debugging steps I took to verify and discover…