Projects sharing features with HyperDbg

ScyllaHide is an anti-debugger bypass plugin and reverse engineering tool designed to hide a debugger from a target application. It functions as a user-mode API hooking library and DLL injection framework that prevents programs from detecting and closing themselves when being analyzed. The project enables malware analysis and the study of protected software by neutralizing security defenses. It achieves this by intercepting and modifying system library responses to deceive applications about their execution environment. The utility employs several technical methods to maintain stealth, inclu

probe-rs is an embedded debugging toolset used for flashing, debugging, and inspecting microcontrollers via hardware debug probes. It functions as an embedded firmware flasher, a memory manager for reading and writing to processor registers, and a server implementing the Debug Adapter Protocol to connect hardware debugging to various code editors. The project includes a CMSIS-Pack target parser to extract device metadata and flash configurations from industry-standard definition files. It provides a driver-based probe abstraction to interact with various hardware debug probes regardless of th

Vimspector is a visual debugger integration for Vim that enables developers to step through code and inspect program state without leaving the editor. It utilizes the Debug Adapter Protocol to provide a unified interface for debugging multiple programming languages through various debug adapters. The project distinguishes itself by supporting low-level analysis and specialized environments, including bare metal hardware debugging for microcontrollers and the ability to perform disassembly analysis and process memory dumping. It also provides remote debugging capabilities by proxying requests

GEF is a Python-based extension for GDB that serves as a framework for binary analysis, exploit development, and low-level debugging. It functions as a dynamic analysis extension designed to assist in reverse engineering workflows and malware analysis by enhancing the debugger's ability to inspect process state and memory. The project is distinguished by its specialized heap analysis tools, which allow for the inspection of glibc heap arenas, bins, and chunks to detect memory corruption. It also provides a dedicated toolkit for exploit development, including cyclic pattern generation for offs

MAME is a vintage hardware emulation platform designed to recreate the circuitry of arcade games, computers, and consoles to run original software on modern devices. It functions as a retro gaming preservation framework for managing, verifying, and archiving ROM sets and disk images to ensure long-term software accessibility. The project features a system debugging tool for inspecting emulated memory, CPU registers, and execution flow via breakpoints and disassembly. It also includes a Lua-based automation layer that exposes core system state and hardware controls for custom behavior and anal

This project is a diagnostic adapter that connects code editors and standalone tools to running runtime processes using the standard Debug Adapter Protocol. It functions as a JavaScript and TypeScript debug implementation that maps compiled code back to original source files using sourcemaps, allowing developers to set breakpoints, inspect variables, and evaluate expressions without manual configuration. The tool handles cross-environment code execution by automatically attaching to child processes, worker threads, service workers, and terminal processes. It supports advanced debugging capabi

This repository is a collection of reference source code and implementation examples for developing drivers using the Windows Driver Kit. It provides hardware device driver samples and development templates for building kernel-mode software that enables communication between the Windows operating system and hardware devices. The library includes examples for creating universal Windows drivers, which utilize a shared set of interfaces to operate across multiple versions of the operating system. It also contains specialized implementation samples for various hardware categories, including netwo

pwru is a tooling implementation for tracing, filtering, and debugging network packet movements and transformations within the Linux kernel. It functions as an eBPF network packet tracer and debugger used to analyze kernel state and identify where network packets are dropped or redirected. The project provides specialized capabilities for monitoring the packet lifecycle, including tracking packets through NAT transformations and tunnel decapsulation. It includes an eBPF traffic filter that reduces noise by restricting traced packets based on namespaces, interfaces, and kernel function names.

BCC is an eBPF development toolkit and tracing framework used for monitoring and analyzing the Linux kernel. It functions as a performance analysis tool and debugging utility to capture system events, measure kernel latency, and provide network observability. The project distinguishes itself by providing a build system that integrates with LLVM to compile C-like code into BPF bytecode at runtime. It utilizes BPF Type Format data for relocations to maintain cross-kernel compatibility and extracts kernel headers to ensure the generated programs match the specific kernel version. The toolkit co

Dobby is a dynamic function hooking framework and binary instrumentation tool designed to intercept and redirect function calls in compiled binaries. It serves as a cross-platform and cross-architecture library that provides a unified interface for modifying program execution flow across different operating systems and CPU architectures. The library enables low-level binary instrumentation and runtime application instrumentation by injecting custom handlers into live processes. It is used for software reverse engineering to observe real-time data flow and logic by hooking internal functions.

Motion is network camera surveillance software and a video motion detection system. It ingests video signals from IP cameras and hardware capture cards to provide real-time security monitoring, automated movement detection, and secure web-based streaming. The system functions as a video activity logger, recording event history and metadata into databases for long-term tracking. It can automatically trigger external scripts or software tools in response to detected motion and save video clips or still images to create a record of events. The software supports concurrent processing of multiple

This project is a Node.js binary distribution repository and Linux package repository. It provides a hosted set of pre-compiled JavaScript runtime binaries for various Linux distributions to simplify installation and version management through native package managers. The project includes a Node.js observability toolset and security policy manager. These components enable the gathering of runtime telemetry to monitor application health and performance via diagnostic dashboards, while providing a resource restriction layer that intercepts system calls to prevent unauthorized modules from acces

Maybe is a command execution simulator and filesystem operation auditor. It provides a dry-run environment that records intended file changes without performing actual write operations to the disk and acts as a security layer to block unauthorized modifications. The tool intercepts system calls to preview and approve filesystem modifications before they are committed. It utilizes a user-approval execution loop that pauses program execution until a user consents to pending system operations. The system covers command execution previews, filesystem operation auditing, and system call filtering

This project is a profiling utility written in Rust that captures, transforms, and visualizes function call stacks to identify system performance bottlenecks. It functions as a sampling profiler wrapper that converts raw profiling data into interactive flamegraphs, which are hierarchical maps of resource consumption. The tool provides specialized integration with the Rust build system to profile binaries and performance benchmarks. It also allows for custom profiling configurations, enabling users to override default system profiling tools or recording flags to control how data is collected.

Fastsocket is a high-performance Linux socket implementation designed for linear scalability on multicore systems. It functions as a TCP throughput optimizer and a multicore packet steering engine that reduces system call overhead and lock contention to increase total network processing capacity. The project distinguishes itself through a network system call interceptor that uses a shared library to redirect standard socket calls to optimized interfaces without requiring changes to application binaries. It employs active connection steering by encoding CPU core IDs into source ports and utili

Positron is a data science integrated development environment and AI-powered code editor designed for polyglot development, specifically supporting Python and R. It functions as a remote compute workspace that separates the user interface from the execution kernel via SSH or container integration. The environment features a deep integration of large language models that provide context-aware suggestions and automated data analysis by accessing real-time interpreter state, in-memory objects, and plot outputs. It distinguishes itself through a polyglot runtime bridge that enables cross-language

Box64 is a cross-architecture runtime and user-mode emulation layer that allows Linux and Windows software to run on non-native hardware. It functions as an x86-64 instruction emulator and binary translator, executing 64-bit binaries on different CPU architectures by translating machine code into native instructions. The project utilizes dynamic recompilation to accelerate execution and maps guest system calls to native host libraries to increase speed and hardware compatibility. It can simulate a 32-bit execution environment to support legacy software and integrates with the operating system

Lilu is a kernel patching engine and runtime code injection framework designed to modify kernel drivers and libraries in memory. It functions as an operating system customization framework that intercepts function calls and redirects execution flow within the kernel to resolve hardware compatibility issues and adjust system stability. The project employs a modular platform that allows for the injection of code and the modification of system libraries during the boot process without altering files on disk. It utilizes a plugin-based extension architecture and a standardized API interface to lo

Raddebugger is a native Windows x64 debugger that also functions as a high-speed PE/COFF linker and a PDB/DWARF debug information converter. It combines these three capabilities into a single development tool aimed at inspecting and controlling native x64 Windows applications, with the ability to attach to multiple processes simultaneously within one session. The debugger is built around a custom binary debug format that converts standard PDB and DWARF symbols into a compact representation for fast loading and minimal memory overhead. It includes a fuzzy symbol search engine for locating func

Lsyncd is an event-driven directory synchronization daemon that monitors local filesystem changes to mirror data to remote servers. It functions as a customizable sync orchestrator, watching for file creations, modifications, and deletions to trigger automated synchronization tasks or user-defined scripts. The tool specifically automates rsync workflows, utilizing secure shell connections to maintain consistent copies of local data on remote targets. It optimizes data transmission by performing remote file management, such as renames and deletions, via secure shells to avoid unnecessary re-tr

Kit is a desktop automation framework and scriptable UI toolkit designed for building personalized productivity tools. It serves as a cross-platform CLI wrapper and macOS system automator, providing an environment to execute scripts that manage operating system tasks, file management, and application workflows. The project distinguishes itself with a dedicated LLM integration layer for structured data extraction and text generation, alongside a specialized UI framework for creating interactive input forms, HTML windows, and floating widgets. It features deep macOS integration through AppleScr

Blackmagic is a GDB server for embedded hardware that translates GDB remote protocol messages into JTAG and SWD commands. It functions as an ARM and RISC-V debugger and hardware debug probe manager, enabling users to inspect memory, control execution, and manage registers on ARM Cortex and RISC-V cores. The project distinguishes itself by acting as a remote hardware debugging bridge that can stream GDB server traffic over TCP/IP to control physical hardware from a remote machine. It also provides a JTAG and SWD interface to connect host computers to target hardware and serves as an embedded f

This project is a red teaming knowledge base and offensive security playbook designed to simulate adversary behavior. It serves as a comprehensive collection of technical guides and tactics for executing red team operations. The repository provides detailed instructions for Active Directory exploitation, including Kerberos abuse and domain privilege escalation. It covers defense evasion through API unhooking and payload obfuscation, as well as Windows internals research involving the manipulation of kernel objects and system memory. The capability surface extends to network penetration testi

LXD is a unified platform for managing both system containers and virtual machines through a single REST API and command-line interface. It provides a programmatic HTTP interface for controlling the full lifecycle of instances, enabling automation and integration with external tools. The system runs unprivileged containers with per-instance UID/GID mappings, seccomp filters, and AppArmor profiles for kernel-level isolation, while supporting multiple storage backends including directory, Btrfs, LVM, ZFS, Ceph, LINSTOR, and TrueNAS through a unified driver interface. The platform distinguishes

Qira is a binary analysis platform and execution tracer that records every instruction and data access during program execution for interactive playback and debugging. It functions as a runtime analysis environment that uses QEMU to trace execution and inspect memory and register states. The system provides a binary static analysis tool that maps program structure and annotates instructions based on captured runtime data. It includes a runtime memory analyzer to monitor reads and writes to specific addresses and an interactive debugger for navigating execution timelines. The platform covers

Auto.js is an Android scripting platform and mobile automation tool that runs JavaScript code directly on the device. It provides an integrated development environment for writing, testing, and debugging automation scripts that control apps and system functions through the Android Accessibility Service. The platform combines a JavaScript runtime with event-driven task scheduling, allowing scripts to be triggered by system events, time conditions, or UI changes. Its mobile IDE includes live preview capabilities for real-time script execution and debugging, while a plugin system extends automat

JPEX Software is a comprehensive reverse engineering suite for SWF binary files, serving as an ActionScript decompiler and editor. It provides a toolkit for decompiling, analyzing, and modifying the internal structure of compiled Flash content, including the extraction of scripts and media assets. The project is distinguished by its ability to perform direct binary modification, allowing users to edit bytecode and replace embedded resources without reverting to high-level source code. It includes a runtime ActionScript bytecode debugger for variable inspection and call stack analysis, as well