Duncan Ogilvie

AI-powered reverse engineering assistant that bridges IDA Pro with language models through MCP.

A plugin that connects IDA Pro, a professional binary analysis tool, to AI assistants like Claude or Cursor, letting the AI help rename variables, add comments, and explain decompiled code.

Hiding kernel-driver for x86/x64.

An easy-to-use library for emulating memory dumps. Useful for malware analysis (config extraction, unpacking) and dynamic analysis in general (sandboxing).

Perfect DLL Proxying using forwards with absolute paths.

Single header version of System Informer's phnt library.

Example of using as a CMake Toolchain for cross compiling.

Global user-mode hooking framework, based on AppInit_DLLs. The goal is to allow you to rapidly develop hooks to inject in an arbitrary process.

Ghetto user mode emulation of Windows kernel drivers.

Small PoC of using a Microsoft signed executable as a lolbin.

Ever wanted to execute PHP in your kernel driver? Look no further!

Simple tool that allows you to have multiple Just-In-Time debuggers at once.

Armadillo Key Tool

Payload Obfuscation for Red Teams workshop materials

Zero-dependency MCP server implementation.

CMake template for a basic EFI application/bootkit. This library is header-only, there is no EDK2 runtime!).

Dataset of reverse engineering tasks done using LLMs.

ArmaG3ddon by CondZero/ARTeam

Some simple go tools to perform a Man-in-the-middle (MITM) attack on your IMAP server in case you forgot your password.

Simple MCP Server to enable a human-in-the-loop workflow in tools like Cline and Cursor.

[deprecated] Simple x64dbg plugin to save a full memory dump

Collaboration platform for reverse engineering tools.

Boot loader and emulator for real mode written in C/Python.

VMProtectTest

Use Rosetta to run amd64 binaries on your M1 with Multipass.

Plugin for x64dbg to generate Yara rules from function basic blocks.

Diff plugin for x64dbg

Tool to automatically make Cheat Engine attach to a process via the command line.

Modern reimplementation of Workrave in Qt. Optimized to look out for you where you don't.

Interactive web dashboard to monitor and analyze your coding agent API costs.

MicroVM is a self-guided path for learning how computers work by building a tiny virtual machine.

Small project to generate fake DLLs based on an executable's import table

Automatically exported from code.google.com/p/portable-executable-library

Injectable DLL that helps with debugging Wibu CodeMeter.

Experiment building lifting-bits dependencies with pure CMake. Migrated to:

Code Page Converter - Convert HTML/Text files to different encoding formats e.g. ANSI to UTF-8 or Unicode. Convert multiple files with 1 click. Works with all encodings.

Standalone API for Binary Ninja's LLIL

DotNetPluginCS based on:

Sample x64dbg plugin to scan the stack during tracing.

Plugin for x64dbg to disable parallel loading of dependencies

Simple CloudFlare Worker to implement a service similar to redirect.name, but with HTTPS support.

List of free software testing resources

Simple AST for reverse engineering, purely meant as an example.

Simple tool to perform AStyle formatting in a git repository.

Experimental imgui app framework for rapid prototyping.

Kilo provider for the Pi coding agent.

Plugin for x64dbg to break on unresolved APIs.

Extension to create a full memory dump using LLDB on Android

Lisp in kernel-mode because it was so seductive

This tool helps you view all in-game text of Dark Souls 3.

Simple MCP for Readeck. Developed for use with Jan Nano 128k locally.

WinDbg-ext-MCP bridges your favorite LLM client (like Cursor, Claude, or VS Code) with WinDbg, enabling real-time, AI assisted kernel debugging. Write prompts in your AI coding assistant and receive instant, context-aware analysis and insights from your live kernel debugging session.

Plugin to assist in reverse engineering programs that use JNI.

Some super old control flow exploration experiments

Simple plugin for x64dbg to decode debug registers

Interactive disassembler and emulator for the SN8F2288.

Personal blog

EDR PoC WIP LLC

Simple C# GUI for BoomPow (banano miner).

Very simple trace plugin example for x64dbg.

Private server for Realm of the Mad God 27.7.X11 (fabiano swagger of doom).

Simple tool for Linux to monitor the CPU/GPU/memory usage of a command.

Simple template for IXWebSocket (websocket and http client/server library for C++) based on CPM.

Binary Refeinery MCP

Plugin for x64dbg to paste a file in memory...

Example plugin for x64dbg to handle mouse click events.

🚧 Structure your AI coding projects to effectively work with agents. 🚧

No description.

No description.

🪅 Windows User Space Emulator

High performance reverse proxy for logging LLM traces (OpenRouter/LiteLLM)

Deobfuscation via optimization with usage of LLVM IR and parsing assembly.

Build your own coding agent workshop materials.

Playground for statically loading files into x64dbg.

Local search and browser for python-github-backup archives.

Simple x64dbg plugin to encode strings as hex.

No description.

Example plugin to print a timestamp in the log.

.NET deobfuscator and unpacker.

BSides Prishtina 2024 Malware Development and Persistence workshop

No description.

A dynamic VMP dumper and import fixer, powered by VTIL.

No description.

Simple MCP server for testing purposes.

Core emulator components for Icicle

Build-Your-Own Ransomware: Python demo implementation (vibe coded)

No description.

Python bindings for LLVM auto-generated from the LLVM-C API

Binary analysis MCPs collections

A curated list of Model Context Protocol (MCP) servers

No description.

C Subset Compiler

An open-source user mode debugger for Windows. Optimized for reverse engineering and malware analysis.

A minimal test implementation of a svm / amd hypervisor

Super simple command line launcher for Sapphire (FFXIV).

No description.

Knowledge base watching and scraping service.

The LLVM Project is a collection of modular and reusable compiler and toolchain technologies.

Python module to detect constructs that confuse beginners and error.

OpenSSL based Authenticode signing for PE/MSI/Java CAB files

bridge between mattermost, IRC, gitter, xmpp, slack, discord, telegram, rocketchat, twitch, ssh-chat, zulip, whatsapp, keybase, matrix, microsoft teams, nextcloud, mumble, vk and more with REST API (mattermost not required!)

Simple proxy for the GDB server protocol.

Reverse engineering framework in Python

Experimental Linux microvm setup with a TypeScript Control Plane as Agent Sandbox

Convert InVivo .inv dental CBCT volumes to Enhanced CT DICOM.

Happy Coder CLI to connect your local Claude Code to mobile device

A free, powerful, multi-purpose tool that helps you monitor system resources, debug software and detect malware. Brought to you by Winsider Seminars & Solutions, Inc. @ http://www.windows-internals.com

No description.

A Ghidra App Bundle for macOS

Convert Nintendo Switch executable files to ELFs

A theme for cgit

Automatically enable Python's faulthandler for development.

Simple web UI for the Pangram AI detection API.

Empty training environment to prepare things locally.

🔊 Awesome list for Whisper — an open-source AI-powered speech recognition system developed by OpenAI

A Windows user minidump C++ parser library.

Ghidra is a software reverse engineering (SRE) framework

A DOS boot sector written in C

Qt Base (Core, Gui, Widgets, Network, ...)

A collection of MCP servers.

See what you can do next in FFXIV!

C++ Helper library containing various types and functions used throughout many of my projects

The Pattern Language used by the ImHex Hex Editor

Vial is an open-source cross-platform (Windows, Linux and Mac) GUI and a QMK fork for configuring your keyboard in real time.

Python IDE for beginners

🚀 A fast WebAssembly interpreter, and the most universal WASM runtime

Prevents your Mac from sleeping while Claude Code is actively working.

My personal Claude Code marketplace.

Vibe coded dashboard for Forza Horizon 6 telemetry.

An ergonomic, featureful, and easy-to-integrate implementation of the GDB Remote Serial Protocol in Rust (with no-compromises #![no_std] support)

AI agent toolkit: coding agent CLI, unified LLM API, TUI & web UI libraries, Slack bot, vLLM pods

LLVM bindings for .NET Standard written in C# using ClangSharp

A library for writing plugins in any decompiler: includes API lifting, common data formatting, and GUI abstraction!

LLM inference in C/C++

Download statistics from the CBS in bulk.

A reversing plugin for cross-decompiler collaboration, built on git.

No description.

Minimal API server for RustDesk.

A reference implementation for the specification that can create and configure a dev container from a devcontainer.json.

Experiment trying to get obsidian-livesync to work headlessly.

An open source, portable, easy to use, readable and flexible TLS library, and reference implementation of the PSA Cryptography API. Releases are on a varying cadence, typically around 3 - 6 months between releases.

No description.

No description.

Automatically load .env variables if auto-dotenv is installed

Dumb service manager with a simple web UI and stdout tracing.

Specification and documentation for Agent Skills

LLVM based static binary analysis framework

User-friendly AI Interface (Supports Ollama, OpenAI API, ...)

An on-premises, OCR-free unstructured data extraction, markdown conversion and benchmarking toolkit. (https://idp-leaderboard.org/)

SoTA open-source TTS

x64dbg typeparsing plugin with Windows types

[Fork] MCP for Language Server Protocol (LSP) though multilspy. This fork has Windows and C++ support.

[AI] Simple LiteLLM trace viewer

An extremely fast Python package and project manager, written in Rust.

Simple text-to-speech (TTS) server for FFXIV based on Piper optimized for low latency.

Chat TTS plugin for Dalamud. Has support for triggers/exclusions, several TTS providers, and more!

No description.

Qutepart. Code editor widget for C++ / Qt5. Syntax highlighting and many more useful features

Open source desktop application to transcribe with Whisper

macOS whisper dictation app

No description.

Model Context Protocol Servers

Code at the speed of thought – Zed is a high-performance, multiplayer code editor from the creators of Atom and Tree-sitter.

open-source CUPS driver for monochrome Brother laser printers

Hardening code obfuscation against automated attacks

Library for lifting machine code to LLVM bitcode

Update GitHub Actions version pins in GitHub workflow files.

xAI Grok OAuth provider extension for Pi.

The Microsoft community Windows Package Manager manifest repository

Standalone static version of Triton's x86/x64 translator

backup a github user or organization

DuckDB extension to read files within zip archives.

Lucebox optimization hub: hand-tuned LLM inference, built for specific consumer hardware.

AGENTS.md — a simple, open format for guiding coding agents

No description.

Simple job queue based on Redis.

Markdown viewer - Total Commander Lister plugin and standalone executable

open source Invivo CBCT scan (.inv file) viewer

A TOML toolkit written in Rust

Implementations of SIMD instruction sets for systems which don't natively support them.

No description.

A collection of C++11 headers useful for reverse engineering

x86 malware emulator

Dumb test project where I kept telling Claude to 'continue'

A Final Fantasy XIV 4.0+ Server Emulator written in C++

Plugin manager for pi — think oh-my-zsh, but for pi. Install themes, agents, commands, and tools with a single command.

[Experiment] Year progress (Gemini 2.5 Pro).

[Experiment] Year progress (Opus 4.5).

[Experiment] Year progress (GLM 4.7).

Automatically rebind Xcode file associations to VSCode.

A nanobind example project

Installs tools

Simple HTTP server to dump data from the Apple Vision framework.

🍻 Default formulae for the missing package manager for macOS (or Linux)

TTS support with GGML

Dalamud plugin manifests

multilspy is a lsp client library in Python intended to be used to build applications around language servers.

Launcher for FFXIV to be used with Sapphire

Chocolatey packages supporting the analysis environment projects FLARE-VM & Commando VM.

Navigation-mesh Toolset for Games

No description.