Projects sharing features with Kaiju

Angr is a binary analysis framework and static analysis tool used for reverse engineering compiled binaries. It serves as a binary decompiler and a lifting platform that translates machine code into a common intermediate representation to enable cross-architecture analysis. The framework integrates a symbolic execution engine and constraint solvers to determine the inputs required to reach specific program states. It also employs untrusted code sandboxing to isolate guest code from the host environment during analysis. Its capabilities cover control flow and data flow analysis, including the

Retdec is an LLVM-based machine code decompiler and static binary analysis tool designed for binary reverse engineering. It translates binary executable code into high-level representations to facilitate the reconstruction of program logic from compiled machine code. The system utilizes a retargetable frontend architecture and a multi-stage lifting pipeline to convert raw bytes into a common intermediate language. It differentiates custom program logic from known library code through signature-based identification and provides utilities for binary symbol demangling to restore human-readable n

An automatic unpacker and logger for DotNet Framework targeting files

Rogue Assembly Hunter is a utility for discovering 'interesting' .NET CLR modules in running processes.

A proof-of-concept tool that attempts to retrieve the configuration from the memory dump of an F-Secure C3 Relay executable.

ret-sync is a set of plugins that helps to synchronize a debugging session (WinDbg/GDB/LLDB/OllyDbg2/x64dbg) with IDA/Ghidra/Binary Ninja disassemblers.

A dynamic unpacking tool

A static devirtualizer for VMProtect x64 3.x. powered by VTIL.

Binee: binary emulation environment

GhIDA is an IDA Pro plugin that integrates the Ghidra decompiler in IDA.

gdbida - a visual bridge between a GDB session and IDA Pro's disassembler

High Octane Triage Analysis

gdbghidra - a visual bridge between a GDB session and GHIDRA

Binary Analysis Platform

Blackbone is a collection of specialized tools for memory scanning, process injection, and kernel-driver interfaces used to manipulate the Windows execution environment. It provides a framework for executing remote code, mapping portable executable images, and managing threads across different process boundaries. The project includes a kernel memory driver to access kernel memory and modify handle rights to hide allocations from user-mode detection. It also features a library for intercepting function calls in remote processes using software interrupts and hardware breakpoints. The toolkit c

Universal unpacker and fixer for a number of modded ConfuserEx protections

Executable files static analyzer

EMBA - EMBEDDED LINUX ANALYZER

Xori is an automation-ready disassembly and static analysis library for PE32, 32+ and shellcode

.NET runtime inspector

Port of the binary diffing library, diaphora, for radare2 and mariadb

capa is a static analysis tool that scans executable files to identify what a program can do, detecting capabilities such as API calls, byte sequences, and structural patterns without executing the code. It supports multiple file formats including PE, ELF, .NET, and shellcode, and can also process runtime behavior traces from sandbox reports generated by CAPE, DRAKVUF, or VMRay. The tool integrates directly with reverse engineering environments through plugins for IDA Pro and Ghidra, allowing analysts to view capability matches and author detection rules within their disassembler of choice. C

Standard collection of rules for capa: the tool for enumerating the capabilities of programs

This project is a binary static analysis tool designed to recover hidden and non-standard encoded strings from compiled binaries. It functions as a malware analysis utility and string decryptor, extracting obfuscated text to reveal concealed program behavior without executing the code. The tool automates the recovery of embedded strings through a combination of emulated instruction execution and abstract syntax tree evaluation. It utilizes pattern-based heuristic detection to identify obfuscation routines and employs cross-platform binary parsing to process multiple executable formats. The s

Hypervisor based anti anti debug plugin for x64dbg