hasherezade

Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).

Portable Executable reversing tool with a friendly GUI

Converts PE into a shellcode

Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).

Materials for Windows Malware Analysis training (volume 1)

A Pin Tool for tracing API calls etc

A library to load, manipulate, dump PE files. See also: https://github.com/hasherezade/libpeconv_tpl

Converts a EXE into DLL

Dynamic unpacker based on PE-sieve

Converts a DLL into EXE

Demos of various injection techniques found in malware

PE-bear (builds only)

Process Ghosting - a PE injection technique, similar to Process Doppelgänging, but using a delete-pending file instead of a transacted file

Portable Executable parsing library (from PE-bear)

My implementation of enSilo's Process Doppelganging (PE injection technique)

Transacted Hollowing - a PE injection technique, hybrid between ProcessHollowing and ProcessDoppelgänging

IFL - Interactive Functions List (plugin for IDA Pro)

Yet another variant of Process Hollowing

Various snippets created during malware analysis

A more stealthy variant of "DLL hollowing"

Process Injection using Thread Name

Waiting Thread Hijacking - injection by overwriting the return address of a waiting thread

Persistent IAT hooking application - based on bearparser

Demos of various (also non standard) persistence methods used by malware

ChimeraPE (a PE injector type - alternative to: RunPE, ReflectiveLoader, etc) - a template for manual loading of EXE, loading imports payload-side

A helper utility for creating shellcodes. Cleans MASM file generated by MSVC, gives refactoring hints.

A simple commandline injector using classic DLL injection

Small tool for disassembling shellcode (using objdump)

Set of antianalysis techniques found in malware

Password scrambler - a deterministic password re-generator (alternative to a password manager)

Small tool to convert beteween the PE alignments (raw and virtual).

A process overwriting its own PEB to make an illusion that it has been loaded from a different path.

Parsers for custom malware formats ("Funky malware formats")

MalUnpack companion driver

Set of my small utils related to cryptography, encoding, decoding etc

ViDi Visual Disassembler (experimental)

Small visualizator for PE files

A decoder for Petya victim keys, using the Janus' masterkey.

An experimental dynamic malware unpacker based on Intel Pin and PE-sieve

Parser for a custom executable formats from Hidden Bee and Rhadamanthys malware

A small library helping to parse commandline parameters (for C/C++)

Application for cracking Red Petya key based on genetic algorithms.

A ready-made template for a project based on libpeconv.

Standalone Metasploit-like XOR encoder for shellcode