Bjoern Kerler

Inofficial Qualcomm Firehose / Sahara / Streaming / Diag Tools :)

Very vulnerable ARM/AARCH64 application (CTF style exploitation tutorial with 29 vulnerability techniques)

Mediatek Flash and Repair Utility

Oppo .ofp Firmware decrypter and oneplus .ops de-/encrypter

EDL Loaders

Oppo Firmware .ozip decrypter

Universal android boot to root

Mobile Revelator

MD5,SHA1,SHA256,SHA512,HMAC,PBKDF2,SCrypt Bruteforcing tools using OpenCL (GPU, yay!) and Python

Netgear Enable Telnet (New Crypto)

8Bit Nand universal reader for FTDI FT2323H Breakout Board, based on basic code from http://spritesmods.com/?art=ftdinand

Helper scripts to set up OpenJDK 11 and scale Ghidra for 4K on Ubuntu 18.04 / 18.10

IDA Pro RPC for assisted RE-tasks

A sniffer for Bluetooth 5 and 4.x LE

OpenDrone ID sniffer/spoofer for Bluetooth + WIFI

Gnuradio blocks and tools for receiving GSM transmissions

SUC - A tool to dump RAM using Samsung S-Boot Upload Mode

Sierra Wireless OpenMEP Generator

Dump Android Verified Boot Signature

Some tee/trustzone helper stuff

Updated FPGA source code and binaries for UHD B220 Clone with XC7A200T+AD9361

Some stuff for doing insane qc chipset pwning.

Some tools for reversing QDSP hexagon

Here be dragons. Or Slides. Or Papers. Or Nothing :)

Your journey to master Android™ Shell begins here

QC EDL Emulator based on Qiling

A Bluetooth receiver implementation for GNU Radio

Binary Ninja plugin for annotation of arguments for functions

Mediatek BP firmware tools

Autonomous Satellite Tracker with ESP8266-Huzzah

Hexagon processor module for IDA Pro disassembler

Latest firmware for antsdr E310 based on PlutoSDR

Full build script for gnuradio including most oot modules (i386/i686/x86_64/arm) on linux

No description.

Research & Exploitation framework for Qualcomm EDL Firehorse programmers

QC Sahara emulator

No description.

Apple BLE research

Collection of scripts for reversing Qualcomm Hexagon baseband / modem firmware

Some collection of router firmware tools

Standalone Satellite Tracker Project based on ESP32 and Micropython

No description.

No description.

Automatic Information System decoder for shipborne position reporting for the Gnuradio project

QCSuper is a tool communicating with Qualcomm-based phones and modems, allowing to capture raw 2G/3G/4G radio frames, among other things.

GUI for the open print tag standard (openprinttag.org)

Asar package extractor with anti-anti extraction support

A Minimalist Instruction Extender for the ARM architecture and IDA Pro

open-source jailbreaking tool for many iOS devices

World's fastest and most advanced password recovery utility

DumpFlash

NFC signal and protocol analyzer using SDR receiver

Buildroot is a simple, efficient and easy-to-use tool to generate embedded Linux systems through cross-compilation. Forked from https://git.busybox.net/buildroot/

No description.

GNU Radio LTE receiver

No description.

Some example flowgraphs for gnuradio, mostly based on real-world signals, some from grcon22 ctf

A bootrom exploit for MediaTek devices

A gnuradio module containing blocks useful for reverse engineering RF signals.

GNU Radio module and Wireshark dissector for the Nordic Semiconductor nRF24L Enhanced Shockburst protocol.

tshark cross compiled for android arm64 architecture devices

Unlock bootloader of Huawei devices on Kirin 960/950/65x/620

No description.

Android/Linux vmlinux loader

Public library of space documents and tutorials

A tool to recover a fully analyzable .ELF from a raw kernel, through extracting the kernel symbol table (kallsyms)

No description.

Debug messages monitor for Qualcomm cellular modems

EDL exploit for Redmi 3S

Tiny cute emulator plugin for IDA based on unicorn.

Shellcode disasm / asm generator in ONE tool using Capstone/Keystone

GUI um Octopus Energy DE Smartmeter Daten abzufragen

A tiny library for bootloader flashing in VCOM_DOWNLOAD mode on Huawei phones.

A 10KB wrapper over LibUsbDotNet for easy and convenient communication with mobile devices in Fastboot mode.

GNU Radio/Python-based decoder for EOT packets

Tool for decrypting the firmware files for Samsung SSDs

Usb Drivers Development Kit for Windows

LK directly running in EDL mode, Qualcomm Secure Boot exploit on Redmi 3S.

Parse BIOS/Intel ME/UEFI firmware related structures: Volumes, FileSystems, Files, etc

Script to automatically install latest frida and download server binaries needed

rx_fm, rx_power, and rx_sdr tools for receiving data from SDRs, based on rtl_fm, rtl_power, and rtl_sdr from librtlsdr, but using the SoapySDR vendor-neutral SDR support library instead, intended to support a wider range of devices than RTL-SDR

Build a Jekyll blog in minutes, without touching the command line.

BIOS Master Password Generators for Laptops

This is the fully-functional GNU Radio software-defined radio (SDR) implementation of a LoRa transceiver with all the necessary receiver components to operate correctly even at very low SNRs. This work has been conducted at the Telecommunication Circuits Laboratory, EPFL.

OpenCL, SDR, TDD/FDD LTE cell scanner, full stack from A/D samples to SIB ASN1 messages decoded in PDSCH, (optimized for RTL-SDR HACKRF and BladeRF board)

This repo contains both the uhd host driver and firmware for microphase antsdr devices.

Bluetooth Low Energy (BLE) packet sniffer and transmitter for both standard and non standard (raw bit) based on Software Defined Radio (SDR).

Scots Army Knife for electronics

AERoot is a command line tool that allows you to give root rights on-the-fly to any process running on the Android emulator with Google Play flavors AVDs.

A collection of various scripts I've written through the years

Telecom Signaling Exploitation Framework - SS7, GTP, Diameter & SIP

No description.

unpack and pack md1img.img files from MTK processors

A tool which creates a spoofed certificate of any online website and signs an Executable for AV Evasion. Works for both Windows and Linux

My gnuradio ASK decoder project

Detect and avoid IMSI-Catcher attacks!

No description.

nanoMIPS module for Ghidra

Replay USB messages from Wireshark (.cap) files

The RF and reverse engineering framework for everyone

nanoMIPS IDA plugin

A basic PoC leak for CVE-2021-28663 (Internal of the Android kernel backdoor vulnerability)

Exploit for LG Q710ULM (Stylo 4 AMZ variant) for writing arbitrary contents to eMMC and patching aboot via S-EL3 warmboot takeover

A Hex Editor for Reverse Engineers, Programmers and people that value their eye sight when working at 3 AM.

this unpack script for Android O and Android P

Automatic Vulnerability Discovery

A simple zero-config tool to make locally trusted development certificates with any names you'd like.

A list of useful payloads and bypass for Web Application Security and Pentest/CTF

Fully automatic censorship removal for language models

AI-Powered Reverse Engineering Plugin for IDA Pro

GNU Radio – the Free and Open Software Radio Ecosystem

Tool for reconstruction of Samsung XSR3 Flash Transaction Layer

Tools for handling firmwares of DJI products, with focus on quadcopters.

A collection of GNU Radio flow graphs

gnuradio oot module made to spoof a weatherstation I bought in Lidl for $20 :)

No description.

A cross-platform user library providing access to USB devices

No description.

A friendly car security exploration tool for the CAN bus

No description.

IEEE 802.11 a/g/p Transceiver

Allows you to partly emulate an Android native library.

No description.

No description.

An integration for IDA and VS Code which connects both to easily execute and debug IDAPython scripts.

A tool to analyze multi-byte xor cipher

Qiling Advanced Binary Emulation Framework

No description.

Public repository for Cantordust Ghidra plugin.

Open source, multi-user SDR receiver software with a web interface

Unofficial and (hopefully) useful documentation to implement your own Android based rom using a Kirin platform.

No description.

Firmware for the Original Prusa MINI, Original Prusa MK4 and the Original Prusa XL 3D printers by Prusa Research.

Dump privileged ARM system registers from usermode using variant 3a of Meltdown

HydraFW official firmware for HydraBus/HydraNFC for researcher, hackers, students, embedded software developers or anyone interested in debugging/hacking/developing/penetration testing

The C-based Firmware Patching Framework for Broadcom/Cypress WiFi Chips that enables Monitor Mode, Frame Injection and much more

GNU Radio DAB (digital audio broadcasting) module

GNU Radio J2497 Receiver and Transmitter

A generic satellite data processing software.

Tool developed to fuzz the GATT layer of the Bluetooth Low Energy protocol based on defined attack scenarios.

FT2232H-based USB sniffer/tracer; new home after old 'openvizsla' github project could not be recovered.

ret-sync is a set of plugins that helps to synchronize a debugging session (WinDbg/GDB/LLDB/OllyDbg2/x64dbg) with IDA/Ghidra/Binary Ninja disassemblers.

The official Xilinx u-boot repository

OpenOCD python library

Proof-of-Concept (PoC) script to exploit IPv6 (CVE-2020-16898).

PoC 2019-2215 exploit for S8/S8 active with DAC + SELinux + Knox/RKP bypass

An IDA file loader for Mobicore trustlet and driver binaries

A helper script for unpacking and decompiling EXEs compiled from python code.

RISCV-V disassembler for IDA Pro

PCI Express DIY hacking toolkit for Xilinx SP605

The USB host security assessment tool

Repository of various public white-box cryptographic implementations and their practical attacks.

Misc blocks

A Frida-based utility for dynamically extracting native (.so) libraries from Android applications.

GNU Radio module for Reed Solomon coded CCSDS frames

Android Dynamic Binary Instrumentation tool for tracing Android native layer

Набор инструментов для работы с flash модемов на чипсете qualcom

A keygen for WinRAR.

GDB plug-in that helps exploiting the Linux kernel's SLUB allocator

My KiCad boards. Can't be bothered uploading individually anymore, so here you go.

No description.

A private Lumina server for IDA Pro

Patches to the Nexus 6 (Shamu) kernel source to allow KGDB over serial debug cable

GreatFET firmware and host software

Proof of Concepts (PE, PDF...)

A project that uses Binary Ninja and GRAKN.AI to perform static analysis on binary files with the goal of identifying bugs in software.

a cheat-sheet for mathematical notation in code form

No description.

Scripts for Binary Ninja

Binary Ninja Clipboard Plugin

Package Binary Code as a Python class using Binary Ninja and Unicorn Engine

Unifies ".mdt" and ".bXX" files into a complete Trustlet

ReSwitched's work-in-progress launcher for one of the Tegra X1 bootROM exploits

Repository of small utilities related to key recovery

A tool to perform (higher-order) correlation power analysis attacks (CPA).

A tool to perform differential fault analysis attacks (DFA).

The RHme2 (Riscure Hack me 2) is a low level hardware CTF challenge that comes in the form of an Arduino Nano board. The new edition provides a completely different set of new challenges to test your skills in side channel, fault injection, cryptoanalysis and software exploitation attacks.

a tool designed to help perform and visualize trace-driven cache attacks against software in the secure world of TrustZone-enabled ARMv8 cores

A Frida based tool that traces usage of the JNI API in Android apps.

Sample code and tutorials using the JEB2 APIs

No description.

No description.

Use your PCB itself as a USB C connector! Including 10 and 14 Pin versions

ESP8266 and ESP32 serial bootloader utility

QEMU fork with PYTHON board definitions via SWIG

Dark theme installer for Ghidra

Idapro cpu for OpenRISC arch

No description.

The x86 processor fuzzer

Fuzzing framework written in python

CLKscrew Code and Scripts

Set of Dynamic Binary Instrumentation and visualization tools for execution traces.

A USB-PD sniffer/injector/sink based on Google's Twinkie, re-designed to be manufactured by mere mortals.

Prusa Web interface resources

ESP32 as generic network interface over UART

Set of scripts used during voltage fault injection attacks

TypeScript Frida agent for extracting shared libraries (.so) from Android apps. Part of the soSaver project.

The USRP™ Hardware Driver Repository

Chip support package for Cypress EZ-USB FX2 series microcontrollers

No description.