C++ application that uses memory and code hooks to detect packers
The main features of bromiumlabs/packerattacker are: Deobfuscation.
Open-source alternatives to bromiumlabs/packerattacker include: 0xd4d/de4dot — de4dot is a .NET deobfuscator, unpacker, and assembly analysis tool. It is designed to remove obfuscation layers,… extremecoders-re/pyinstxtractor — pyinstxtractor is a PyInstaller executable unpacker and Python bytecode recovery tool. It functions as a helper for… fireeye/flare-floss — This project is a binary static analysis tool designed to recover hidden and non-standard encoded strings from… hellman/xortool — A tool to analyze multi-byte xor cipher. hiddenillusion/nomorexor — Tool to help guess a files 256 byte XOR key by using frequency analysis. jnraber/virtualdeobfuscator — Reverse engineering tool for virtualization wrappers.
pyinstxtractor is a PyInstaller executable unpacker and Python bytecode recovery tool. It functions as a helper for decompiling compiled Python binaries by extracting bundled binaries and bytecode from executables created with PyInstaller. The project includes a bytecode decryptor to remove encryption from extracted files and a header repair tool that restores corrupted headers. These capabilities ensure that extracted compiled files are compatible with bytecode decompilation software. The utility covers reverse engineering of Python applications, supporting malware analysis workflows throug
This project is a binary static analysis tool designed to recover hidden and non-standard encoded strings from compiled binaries. It functions as a malware analysis utility and string decryptor, extracting obfuscated text to reveal concealed program behavior without executing the code. The tool automates the recovery of embedded strings through a combination of emulated instruction execution and abstract syntax tree evaluation. It utilizes pattern-based heuristic detection to identify obfuscation routines and employs cross-platform binary parsing to process multiple executable formats. The s
de4dot is a .NET deobfuscator, unpacker, and assembly analysis tool. It is designed to remove obfuscation layers, restore metadata, and simplify bytecode control flow to transform protected binaries back into human-readable code. The project features specialized systems for decrypting strings and constants using both static and dynamic analysis. It identifies specific protection tools through pattern-based detection and strips anti-analysis protections, such as tamper detection and anti-debugging code. The tool provides a suite of reverse engineering capabilities, including binary wrapper un
