hasherezade

Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).

Portable Executable reversing tool with a friendly GUI

Converts PE into a shellcode

Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).

Materials for Windows Malware Analysis training (volume 1)

A Pin Tool for tracing API calls etc

A library to load, manipulate, dump PE files. See also: https://github.com/hasherezade/libpeconv_tpl

Converts a EXE into DLL

Dynamic unpacker based on PE-sieve

Converts a DLL into EXE

Demos of various injection techniques found in malware

PE-bear (builds only)

Process Ghosting - a PE injection technique, similar to Process Doppelgänging, but using a delete-pending file instead of a transacted file

Portable Executable parsing library (from PE-bear)

My implementation of enSilo's Process Doppelganging (PE injection technique)

Transacted Hollowing - a PE injection technique, hybrid between ProcessHollowing and ProcessDoppelgänging

IFL - Interactive Functions List (plugin for IDA Pro)

Yet another variant of Process Hollowing

Various snippets created during malware analysis

A more stealthy variant of "DLL hollowing"

Process Injection using Thread Name

Persistent IAT hooking application - based on bearparser

Waiting Thread Hijacking - injection by overwriting the return address of a waiting thread

ChimeraPE (a PE injector type - alternative to: RunPE, ReflectiveLoader, etc) - a template for manual loading of EXE, loading imports payload-side

Demos of various (also non standard) persistence methods used by malware

A helper utility for creating shellcodes. Cleans MASM file generated by MSVC, gives refactoring hints.

A simple commandline injector using classic DLL injection

Small tool for disassembling shellcode (using objdump)

Set of antianalysis techniques found in malware

Password scrambler - a deterministic password re-generator (alternative to a password manager)

Small tool to convert beteween the PE alignments (raw and virtual).

A process overwriting its own PEB to make an illusion that it has been loaded from a different path.

Parsers for custom malware formats ("Funky malware formats")

MalUnpack companion driver

Set of my small utils related to cryptography, encoding, decoding etc

ViDi Visual Disassembler (experimental)

Small visualizator for PE files

A decoder for Petya victim keys, using the Janus' masterkey.

An experimental dynamic malware unpacker based on Intel Pin and PE-sieve

A small library helping to parse commandline parameters (for C/C++)

Parser for a custom executable formats from Hidden Bee and Rhadamanthys malware

Application for cracking Red Petya key based on genetic algorithms.

A ready-made template for a project based on libpeconv.

Standalone Metasploit-like XOR encoder for shellcode

Golang bindings for PE-sieve

A set of small utilities, helpers for PIN tracers

Signature finder (from PE-bear)

No description.

Various scripts helpful in sorting collections of malware samples.

Python wrappers for mal_unpack

Sample libraries to be used with IAT Patcher

Flare-On solutions

Archive of ransomware decryptors

No description.

Application for random attack on Green Petya's key

No description.

My metasploit modules

No description.

A CMake template for projects using MS Detours

Demo bootloaders - created just for fun

My small projects writen in 16 bit asm (NOTE: those are my practice projects that I wrote when I was 15, I give no warranty for this code!)

Windows process injection methods

A demo implementation of a well-known technique used by some malware to evade userland hooking, using my library: libpeconv.

Small utility to generate complicated passwords - version with GUI

Scripts for communication with Bunitu Trojan C&Cs

Decoders for 7ev3n ransomware

A wrapper for capstone for bearparser

A template for projects using both libPeConv and MS Detours

My projects' homepage

My solutions for random crackmes and other challenges

Some of my drawings

My solutions for HackSys Extreme Vulnerable Driver

https://hasherezade.github.io/passcrambler/

Demo projects and utilities made with the help of libPeConv

An automation plugin for Tiny-Tracer framework to trace and watch functions directly out of the executable's import table or trace logs (.tag) files.

Implementation of Advanced Module Stomping and Heap/Stack Encryption

A placeholder repository

Disassembler Library for x86 and x86-64

My solutions

A ready-made template for a new project based on libPeConv library

GhostWriting Injection Technique.

Process Herpaderping proof of concept, tool, and technical deep dive. Process Herpaderping bypasses security products by obscuring the intentions of a process.

No description.

External tests for bearparser

No description.

View8 - Decompiles serialized V8 objects back into high-level readable code.

PowerLoaderEx - Advanced Code Injection Technique for x32 / x64

Any useful windbg plugins I've written.

External tests for PE-sieve

codes for my blog post: https://secrary.com/Random/InstrumentationCallback/

Titan: A crappy Reflective Loader written in C and assembly for Cobalt Strike. Redirects DNS Beacon over DoH

A template for a project using ParamKit

Source code of my KeygenMe V7 challenge

Set of IDA Pro scripts for parsing GoLang types information stored in compiled binary

Cobalt Strike UDRL for memory scanner evasion.

based on https://github.com/secrary/Hooking-via-InstrumentationCallback

UEFI bootkit for driver manual mapping

Experiment on reproducing Obfuscate & Sleep

DPS' Lightweight Investigation Notebook

Sleep Obfuscation

IDA Pro plugin to manage classes

No description.

A companion to the blog post for C2 comms

A memory scanning evasion technique

Windows x64 Process Scanner to detect application compatability shims

Decrypted content of odd.tar.xz.gpg, swift.tar.xz.gpg and windows.tar.xz.gpg

Get the latest release stats of your project on Github