Projects sharing features with Blackbone

HyperDbg is a hardware-assisted kernel-mode debugging platform that leverages virtualization to monitor and control system execution. By utilizing hypervisor-level primitives, it enables deep system analysis and instrumentation without relying on standard operating system debugging interfaces. The framework provides a comprehensive environment for inspecting both kernel and user-mode processes, allowing for granular control over execution flow and system state. The project distinguishes itself through a transparent debugging layer designed to remain invisible to the target environment. It emp

Steam Achievement Manager is a game achievement editor and specialized API client designed to modify and unlock game achievements and statistics for titles on the Steam platform. It functions as a utility for manually changing the state of earned rewards and milestones while the client is running. The tool provides capabilities for steam profile customization and game statistic manipulation, allowing users to adjust displayed progress and achievement states. It operates by interfacing with the platform backend to update user profile data.

GEF is a Python-based extension for GDB that serves as a framework for binary analysis, exploit development, and low-level debugging. It functions as a dynamic analysis extension designed to assist in reverse engineering workflows and malware analysis by enhancing the debugger's ability to inspect process state and memory. The project is distinguished by its specialized heap analysis tools, which allow for the inspection of glibc heap arenas, bins, and chunks to detect memory corruption. It also provides a dedicated toolkit for exploit development, including cyclic pattern generation for offs

Detours is a library for intercepting Win32 API calls and redirecting function calls at runtime on Windows, enabling binary-level instrumentation without requiring access to the original source code. It functions as an API hooking library and binary instrumentation toolkit, allowing developers to monitor or modify the behavior of compiled Windows binaries by hooking into their function execution paths. The project achieves this through detour-based function interception, where the first few instructions of a target function are replaced with a jump to a user-supplied detour function, while pr

Al-Khaser is a research project focused on the development of anti-analysis and evasion techniques to resist reverse engineering. It provides implementations for detecting and evading virtual machines, sandboxes, and debuggers to prevent software analysis. The project implements control flow obfuscation through anti-disassembly methods and utilizes dynamic API resolution to bypass static import tables. It further hinders forensic analysis by manipulating memory headers to prevent process dumps and utilizing remote code injection to execute logic in external processes. The capability surface

Angr is a binary analysis framework and static analysis tool used for reverse engineering compiled binaries. It serves as a binary decompiler and a lifting platform that translates machine code into a common intermediate representation to enable cross-architecture analysis. The framework integrates a symbolic execution engine and constraint solvers to determine the inputs required to reach specific program states. It also employs untrusted code sandboxing to isolate guest code from the host environment during analysis. Its capabilities cover control flow and data flow analysis, including the

WeChatOpenDevTools-Python is a set of software utilities designed to bypass environment restrictions to enable debugging and element inspection for web and mini program applications. It functions as a developer tool unlocker and web inspector activator to force the activation of integrated inspection tools. The project provides specialized capabilities for debugging and reverse engineering WeChat mini programs. This includes the ability to access hidden developer consoles to analyze the structure, network requests, and behavior of active mini programs and web content. These utilities utilize

The Datadog Agent is an infrastructure monitoring agent and host telemetry collector. It functions as a background process that gathers system metrics and application health data to send to a centralized monitoring platform. The project operates as a plugin-based metric collector, using a modular system of independent check scripts to gather data from various third-party services and applications. It serves as a remote telemetry transmitter, providing a pipeline to stream infrastructure and system information to a remote analysis and alerting backend. Its capabilities cover application perfo

This project is a collection of technical documentation and guides designed as a computer architecture explainer. It provides educational resources on how processors and operating systems execute programs, focusing on the fetch-execute cycle and the fundamental relationship between hardware and the kernel. The documentation covers a wide range of low-level system operations, including detailed guides on the executable and linkable binary format, virtual memory management, and kernel-level operations. It specifically explores the mechanics of CPU scheduling, preemptive multitasking, and the us

Frida is a dynamic binary instrumentation toolkit that provides a framework for deep process introspection and live application state manipulation. It enables the injection of custom scripts into running processes to trace function calls, modify memory, and analyze application behavior in real-time across diverse operating systems and processor architectures. The project distinguishes itself by embedding a high-performance JavaScript engine directly within the target process, allowing for the execution of user-defined logic for real-time inspection. It utilizes instruction-level hooking to re

Dexposed is a set of runtime tools and engines designed for dynamic patching, framework interception, and code instrumentation on Android devices. It functions as a hooking framework and instrumentation tool used to load custom code into running processes to alter logic without modifying the original bytecode. The project enables the interception and modification of method behavior within both Android applications and the system framework. It specifically provides capabilities for bypassing operating system limitations by overriding framework calls and applying hot patches to live processes w

Meltdown is a set of software utilities designed to bypass kernel address randomization and dump physical memory to exploit hardware-level security vulnerabilities. It serves as a proof of concept for the Meltdown hardware vulnerability, enabling the reading of protected kernel memory on affected processors. The tool provides capabilities to identify the secret randomization offset of the direct physical map to locate kernel memory. It also includes functionality to export large segments of physical memory into hexdump format for the recovery of sensitive strings and passwords. The project c

frida-dexdump is an Android memory forensics tool that recovers Dalvik Executable (DEX) files from running application processes using the Frida dynamic instrumentation framework. It functions as a Frida-based runtime analyzer and DEX memory dumper, capable of extracting obfuscated or packed DEX files without modifying the Android system. The tool distinguishes itself through its ability to repair corrupted or missing DEX file headers using heuristic analysis and fuzzy matching techniques. It employs fuzzy boundary detection to identify DEX file boundaries in memory even when headers are dama

pe-sieve is a set of diagnostic tools for scanning Windows process memory to identify malicious implants, shellcode, and hooks. It functions as an in-memory implant detector, malware unpacker, and process callstack analyzer designed to locate and dump memory patches and injected code from running processes. The project identifies advanced evasion techniques, such as process hollowing and reflective injection, by verifying portable executable structures in memory. It distinguishes itself by analyzing process callstacks to detect anomalies and redirections and by reconstructing executable heade

MimiPenguin is a Linux memory credential extractor and password recovery tool designed to isolate and retrieve cleartext user login passwords from active process memory. It functions as a post-exploitation utility for extracting sensitive credentials from desktop user sessions during security assessments. The tool performs Linux memory forensics by analyzing system process memory to identify and isolate credentials. It is used for security penetration testing and evaluating risks associated with memory-based attacks, as well as testing for local privilege escalation. The system targets user-

ScyllaHide is an anti-debugger bypass plugin and reverse engineering tool designed to hide a debugger from a target application. It functions as a user-mode API hooking library and DLL injection framework that prevents programs from detecting and closing themselves when being analyzed. The project enables malware analysis and the study of protected software by neutralizing security defenses. It achieves this by intercepting and modifying system library responses to deceive applications about their execution environment. The utility employs several technical methods to maintain stealth, inclu

This project is a red teaming knowledge base and offensive security playbook designed to simulate adversary behavior. It serves as a comprehensive collection of technical guides and tactics for executing red team operations. The repository provides detailed instructions for Active Directory exploitation, including Kerberos abuse and domain privilege escalation. It covers defense evasion through API unhooking and payload obfuscation, as well as Windows internals research involving the manipulation of kernel objects and system memory. The capability surface extends to network penetration testi

pcileech is a toolkit for executing DMA attacks, analyzing PCIe bus traffic, performing kernel patching, and conducting remote volatile memory forensics. It functions as a hardware memory acquisition tool and a PCIe DMA attack framework designed to read and write remote system memory via direct hardware interfaces. The project provides capabilities for capturing and displaying raw transaction layer packets from the PCIe bus and mounting live RAM as local drives for analysis. It enables the modification of system memory signatures and the execution of shellcode or implants within the kernel wi

Windhawk is a Windows OS modding framework and user-mode code injector designed to customize the behavior of Windows applications and system components. It functions as a process customization tool and API hooking engine that allows for the insertion of custom logic into running programs. The framework enables software behavior modification and user interface tweaking without requiring access to the original source code. This is achieved by intercepting function calls and altering how software interacts with the operating system to implement patches or feature enhancements. The system covers

CppGuide is a curated collection of educational resources and practical guides focused on C++ server development, Linux kernel internals, concurrent programming, network protocols, and security exploitation. It provides structured learning paths for backend developers, covering everything from interview preparation to building high-performance network servers and understanding operating system fundamentals. The guide distinguishes itself by offering in-depth, hands-on tutorials that walk through real-world implementations, including building a Redis-like server from scratch, designing custom

OffensiveNim is a red teaming framework and post-exploitation toolkit developed in Nim. It provides a collection of low-level primitives and a Windows API wrapper designed for offensive security operations, including malware development and shellcode loading. The project focuses on evasion and obfuscation through techniques such as API unhooking, direct system calls, and anti-debugging mechanisms. It features diverse payload delivery methods, including reflective binary loading, the execution of .NET assemblies via CLR hosting, and various shellcode injection techniques using fibers, COM obje

K8tools is a multi-stage attack framework that combines memory-only payload execution, credential testing, port forwarding, privilege escalation, and physical USB-based keystroke injection for comprehensive system compromise. At its core, the Ladon PowerShell module loads a multi-function scanner directly into memory, enabling command execution without writing files to disk, while supporting memory-only payload delivery that downloads and runs obfuscated shellcode or PowerShell commands to evade antivirus detection. The framework distinguishes itself through its breadth of integrated capabili

This project is a comprehensive educational framework designed to guide learners through the complexities of systems engineering and low-level software development. It provides structured learning paths that integrate hardware simulation, source code analysis, and project-based exercises to help developers master the foundational concepts of computer architecture, operating systems, and firmware design. The curriculum distinguishes itself by emphasizing direct interaction with system internals, requiring learners to examine and modify existing open-source kernel and driver implementations. By

Play- is a multi-system game emulator and virtual hardware emulator that simulates various console and arcade hardware to run original game files on modern devices. It functions as a retro game frontend, providing a graphical interface for organizing, launching, and managing libraries of legacy console and arcade titles. The project includes a hardware input mapper that translates modern controllers and mouse movements to simulate specialized legacy input devices, such as light guns and steering wheels. It also features a game state manager capable of capturing and restoring the exact memory

Peda is a security tool suite and exploit development framework designed for binary analysis, debugger automation, and memory inspection. It functions as a set of Python scripts that extend a debugger to automate the analysis of compiled files and the inspection of process memory. The project provides specialized utilities for memory corruption research, including a payload generation utility for creating cyclic patterns to discover buffer overflows and a gadget finder to locate return-oriented programming sequences within binaries. It differentiates itself by offering a visualization tool th

vgpu_unlock is a set of software tools and driver modifications designed to unlock enterprise-grade virtualization features on consumer graphics hardware. It functions as a vGPU unlock tool and hardware device ID spoofer that allows a single graphics card to be shared across multiple virtual machines. The project achieves this by employing driver-level hooking, dynamic memory patching, and kernel-level device spoofing. These techniques intercept hardware identification queries and modify the operational state of the GPU driver at runtime to bypass manufacturer-imposed software restrictions.

This project is a comprehensive educational resource and programming course covering C++ language semantics and features from C++03 through C++26. It provides structured tutorials and technical guides focused on modern C++ development. The material offers specialized instruction on template metaprogramming, including the use of type traits and compile-time computations. It features detailed guides on concurrency and parallelism for multi-core execution, as well as a reference for software design applying SOLID principles and RAII. Additionally, it covers build performance optimization to redu