Projects sharing features with Al Khaser

This project is a JavaScript code protection tool designed to transform source code into a version that is difficult for humans to read. Its primary purpose is to protect intellectual property and prevent reverse engineering by altering the original program logic. The tool employs several advanced techniques to hinder analysis, including control flow flattening and the injection of dead code. It can compile functions into custom bytecode executed by an embedded virtual machine and encrypt string literals to prevent static analysis of text. Additional capabilities include anti-debugging mecha

This project is a security research utility designed to evaluate and test the detection capabilities of antivirus products. It provides a framework for generating custom, memory-resident loaders that execute payloads directly within a process memory space, bypassing standard file-based execution monitoring. The tool distinguishes itself by employing compiler-driven generation to create unique executable binaries, which avoids the predictable patterns associated with pre-compiled security software. It incorporates dynamic control flow obfuscation to hinder static analysis and utilizes payload

This project is a programming satire project and a curated catalog of software anti-patterns designed to demonstrate how to write intentionally unmaintainable and fragile code. It serves as a maintainability educational resource and a study in poor design choices, using extreme examples of obfuscated logic to teach developers how to recognize and avoid technical debt. The project provides a comprehensive guide to code obfuscation, focusing on techniques to hide program logic through deceptive naming, bizarre control flows, and misleading documentation. It distinguishes itself by intentionally

This project is a community-curated repository of YARA rules used to detect malware, webshells, and other malicious patterns in files. It serves as a dataset of signatures for identifying known malware families, software packers, and threat intelligence indicators. The collection provides specialized detection capabilities for identifying exploit kits and anti-analysis evasion techniques, such as anti-debugging and anti-virtualization methods. It also includes signatures for cryptographic algorithm detection and the identification of unauthorized remote administration tools on servers. The r

OffensiveNim is a red teaming framework and post-exploitation toolkit developed in Nim. It provides a collection of low-level primitives and a Windows API wrapper designed for offensive security operations, including malware development and shellcode loading. The project focuses on evasion and obfuscation through techniques such as API unhooking, direct system calls, and anti-debugging mechanisms. It features diverse payload delivery methods, including reflective binary loading, the execution of .NET assemblies via CLR hosting, and various shellcode injection techniques using fibers, COM obje

This project is a post-exploitation framework and command and control platform designed for security research and penetration testing. It functions as a remote access tool consisting of a central command server and encrypted executable payloads that establish reverse shell connections. The system utilizes a web-based dashboard for multi-client administration, allowing for remote host monitoring and direct shell access through an in-browser terminal. It generates cross-platform, encrypted binaries that employ a multi-stage delivery chain and a key exchange mechanism to secure communications.

Blackbone is a collection of specialized tools for memory scanning, process injection, and kernel-driver interfaces used to manipulate the Windows execution environment. It provides a framework for executing remote code, mapping portable executable images, and managing threads across different process boundaries. The project includes a kernel memory driver to access kernel memory and modify handle rights to hide allocations from user-mode detection. It also features a library for intercepting function calls in remote processes using software interrupts and hardware breakpoints. The toolkit c

Identifies the bytes that Microsoft Defender flags on.

Noriben - Portable, Simple, Malware Analysis Sandbox

ConfuserEx is a security toolset for .NET applications that functions as a code obfuscator, binary encryptor, and application protector. Its primary purpose is to prevent reverse engineering by hiding sensitive application logic and data. The project employs specific hardening techniques including symbol renaming to hinder human readability and control-flow mutation to confuse decompilers. It further protects binaries by encrypting constants and resources to stop static analysis and memory dumping, while blocking the use of debuggers and profilers to prevent runtime analysis. Additional capa

LinEnum is a suite of security utilities for auditing Linux systems, scanning for privilege escalation paths, and enumerating local vulnerabilities. It functions as a system security audit tool, a local enumeration utility, and a scanner for identifying misconfigurations that could allow a user to gain root access. The project includes specialized auditing for containerized environments, specifically detecting Docker and LXC signatures to identify potential escape vectors to the host system. Its broader capabilities cover the analysis of kernel versions, the identification of SUID binaries a

This project is a self-hosted bot protection service and CAPTCHA alternative that verifies human identity without relying on third-party tracking. It utilizes a combination of WebAssembly-based proof-of-work puzzles and browser instrumentation to distinguish humans from automated bots. The system is delivered as dockerized security middleware and a privacy-first verification API that operates without the use of cookies or user fingerprinting. The service differentiates itself by using GPU-resistant time-lock algorithms and instrumentation-based detection to identify headless browsers and auto

Chef is a configuration management platform and infrastructure as code framework used to automate the deployment and maintenance of infrastructure state across a fleet of servers. It operates as an idempotent automation engine, ensuring systems converge to a desired state by applying only the necessary changes to resolve differences. The system functions as a multi-platform server orchestrator capable of managing infrastructure across different operating systems, cloud providers, and hardware architectures. It includes a dedicated infrastructure testing framework to verify configuration code

Pyarmor is a toolset for protecting Python software through source code obfuscation, bytecode protection, and binary compilation. It functions as a code obfuscator, bytecode protector, and binary compiler designed to prevent reverse engineering and unauthorized access to Python scripts and packages. The project distinguishes itself by providing a comprehensive software license manager that enables hardware-bound licensing. This allows developers to lock script execution to specific physical devices or virtual machines and enforce strict expiration dates via encrypted runtime keys. Its broade

FreeRTOS is a real-time operating system for embedded devices that provides a kernel for predictable task execution. It utilizes priority-based preemptive scheduling and deterministic timing to manage simultaneous hardware tasks. The project includes a symmetric multiprocessing kernel that distributes processing workloads across multiple CPU cores using a shared memory architecture. It also provides a thread-safe TCP/IP networking stack for managing internet protocol traffic and IPv6 connectivity on embedded processors. The system incorporates an embedded memory manager with fixed-size alloc

Collection of android malware samples

SDK for connecting to AWS IoT from an Arduino Yún.

ArduinoJson is a C++ library for parsing and manipulating JSON data and MessagePack binary streams on microcontrollers with limited memory and processing power. It provides the core primitives necessary for embedded data serialization and parsing, enabling devices to exchange structured data over serial or network interfaces. The library is distinguished by its focus on microcontroller memory management, employing strategies such as pool-based allocation, string deduplication, and non-owning string views to minimize RAM usage. It further optimizes for constrained environments by allowing cons