mrexodia

AI-powered reverse engineering assistant that bridges IDA Pro with language models through MCP.

Hiding kernel-driver for x86/x64.

An easy-to-use library for emulating memory dumps. Useful for malware analysis (config extraction, unpacking) and dynamic analysis in general (sandboxing).

Perfect DLL Proxying using forwards with absolute paths.

Single header version of System Informer's phnt library.

Example of using as a CMake Toolchain for cross compiling.

Global user-mode hooking framework, based on AppInit_DLLs. The goal is to allow you to rapidly develop hooks to inject in an arbitrary process.

Ghetto user mode emulation of Windows kernel drivers.

Small PoC of using a Microsoft signed executable as a lolbin.

Ever wanted to execute PHP in your kernel driver? Look no further!

Simple tool that allows you to have multiple Just-In-Time debuggers at once.

Zero-dependency MCP server implementation.

Armadillo Key Tool

Dataset of reverse engineering tasks done using LLMs.

CMake template for a basic EFI application/bootkit. This library is header-only, there is no EDK2 runtime!).

ArmaG3ddon by CondZero/ARTeam

Some simple go tools to perform a Man-in-the-middle (MITM) attack on your IMAP server in case you forgot your password.

Simple MCP Server to enable a human-in-the-loop workflow in tools like Cline and Cursor.

Boot loader and emulator for real mode written in C/Python.

[deprecated] Simple x64dbg plugin to save a full memory dump