Projects sharing features with Noriben

A Tool for Automatic Analysis of Malware Behavior

Al-Khaser is a research project focused on the development of anti-analysis and evasion techniques to resist reverse engineering. It provides implementations for detecting and evading virtual machines, sandboxes, and debuggers to prevent software analysis. The project implements control flow obfuscation through anti-disassembly methods and utilizes dynamic API resolution to bypass static import tables. It further hinders forensic analysis by manipulating memory headers to prevent process dumps and utilizing remote code injection to execute logic in external processes. The capability surface

Sandboxed Execution Environment

Automatic deployment of Cuckoo Sandbox malware lab using Packer and Vagrant

Randomly changes Win32/64 PE Files for 'safer' uploading to malware and sandbox sites.

Cutter is a binary analysis platform and graphical user interface for the Rizin reverse engineering framework. It provides an environment for analyzing the internal logic and data structures of compiled binaries through integrated disassembly and visualization. The platform supports a containerized deployment model to provide isolated environments for binary analysis, which is used to examine suspicious binaries without risking the host system. It is an extensible security tool that allows for the addition of custom analysis capabilities and visualizers via native plugins and scripts. The to

PINCE is a dynamic debugger, instruction tracer, and memory scanner designed for the analysis and manipulation of running processes. It functions as a process memory manipulator and editor, allowing for the identification, modification, and monitoring of values within a target application's active memory. The tool distinguishes itself through memory pointer analysis, tracing addresses and offsets to locate static pointers that lead to dynamic data across different sessions. It also enables the execution of internal functions within a running process by manipulating the instruction pointer and

GEF is a Python-based extension for GDB that serves as a framework for binary analysis, exploit development, and low-level debugging. It functions as a dynamic analysis extension designed to assist in reverse engineering workflows and malware analysis by enhancing the debugger's ability to inspect process state and memory. The project is distinguished by its specialized heap analysis tools, which allow for the inspection of glibc heap arenas, bins, and chunks to detect memory corruption. It also provides a dedicated toolkit for exploit development, including cyclic pattern generation for offs

HyperDbg is a hardware-assisted kernel-mode debugging platform that leverages virtualization to monitor and control system execution. By utilizing hypervisor-level primitives, it enables deep system analysis and instrumentation without relying on standard operating system debugging interfaces. The framework provides a comprehensive environment for inspecting both kernel and user-mode processes, allowing for granular control over execution flow and system state. The project distinguishes itself through a transparent debugging layer designed to remain invisible to the target environment. It emp

libui is a native C GUI library and cross-platform framework used to build desktop applications. It provides a unified C abstraction layer and a native widget toolkit that maps directly to the host operating system's original controls, windows, and menu bars. The project functions as a portable UI wrapper, employing platform-specific backends and a native-API wrapper to maintain visual and behavioral fidelity across different operating systems. It utilizes a C-language binding layer to ensure portability across various compilers and targets. The library covers native interface construction a

This project is an interactive blockchain educational simulator and visualizer. It serves as a tool for demonstrating how blocks are mined and chained through cryptographic hashing and proof of work. The application focuses on the simulation of a distributed ledger, allowing users to visualize the internal structure of an immutable record. It specifically demonstrates the process of block mining, where a valid nonce must be found to meet an adjustable mining difficulty threshold. The system covers the visualization of ledger operations, cryptographic block chaining, and real-time hash update

Command line toolkit for working with Arduino hardware

This project is a Python command-line security tool and malware analysis framework designed for threat intelligence aggregation and incident triage. It functions as an aggregator that orchestrates queries across multiple security services and sandboxes to analyze hashes, IP addresses, and domains. The tool distinguishes itself by incorporating an intelligence layer that uses language models to provide automated risk assessments and framework mappings. It also includes specialized capabilities for extracting indicators of compromise from unstructured text, documents, and web pages, as well as

SDK for connecting to AWS IoT from an Arduino Yún.

ArduinoJson is a C++ library for parsing and manipulating JSON data and MessagePack binary streams on microcontrollers with limited memory and processing power. It provides the core primitives necessary for embedded data serialization and parsing, enabling devices to exchange structured data over serial or network interfaces. The library is distinguished by its focus on microcontroller memory management, employing strategies such as pool-based allocation, string deduplication, and non-owning string views to minimize RAM usage. It further optimizes for constrained environments by allowing cons

Simple .INI file parser in C, good for embedded systems

A self-hosted sandbox for red teams to test payloads against modern detection before deployment. MCP integration lets an LLM agent drive analysis end to end.

Dual-mode Bluetooth stack, with small memory footprint.

Go 1.16.x is required to use this library