Awesome GitHub RepositoriesBinary Pattern Searching

fq 是一个命令行二进制数据处理器，用于将原始字节流和位级数据解码、转换和分析为结构化格式。它作为一个函数式二进制查询引擎，允许对二进制结构进行过滤和映射，同时也是一个转换器，将复杂的二进制 Blob 和专有文件格式转换为标准的 JSON、YAML 或 XML。 该工具作为低级位操作器，能够对原始文件执行位级切片、位运算和加密哈希。它还作为一个网络协议分析器，能够重组碎片化的 TCP 流并解密 TLS 流量以进行应用级检查。 该项目涵盖了二进制解析和数据转换方面的广泛功能，包括对自定义解码器定义的支持，以及对 Mach-O、ASN1 BER 和 Avro OCF 等多种专业格式的支持。它提供了用于二进制树搜索、结构化文本解码以及二进制与文本格式之间双向序列化的工具。 用户可以通过命令行界面和用于实时查询测试的交互式 REPL 与系统进行交互。

Peda is a security tool suite and exploit development framework designed for binary analysis, debugger automation, and memory inspection. It functions as a set of Python scripts that extend a debugger to automate the analysis of compiled files and the inspection of process memory. The project provides specialized utilities for memory corruption research, including a payload generation utility for creating cyclic patterns to discover buffer overflows and a gadget finder to locate return-oriented programming sequences within binaries. It differentiates itself by offering a visualization tool th

HexFiend is a native macOS hex editor designed for opening and editing binary files of any size without loading them entirely into memory. It uses a 64-bit addressable data model with memory-mapped file access, enabling navigation of multi-gigabyte files while maintaining byte-level undo for insert and delete operations. The editor distinguishes itself through a diff algorithm for binary file comparison that accounts for insertions and deletions, and a template-based structure parsing system that uses user-defined scripts to visualize binary file layouts. It also includes a typed data interpr

UEFITool is a firmware analysis tool and image editor designed for parsing, visualizing, and modifying UEFI firmware images. It functions as a specification parser that converts binary firmware data into structured formats based on standard platform interface specifications. The tool provides a visual interface to analyze the tree structure and internal data elements of UEFI platform images. It allows for the modification of firmware images to adjust system boot environments and includes capabilities to search for specific data patterns within binary images. The software covers a range of fi

MemProcFS 是一个易失性内存分析工具和跨平台内存获取系统。它作为一个内存取证虚拟文件系统，将物理内存和内核对象映射到虚拟目录结构中，允许用户使用标准文件系统工具分析系统工件。 该项目通过提供用于内存取证的虚拟文件系统脱颖而出，能够将物理内存作为只读文件和文件夹进行浏览和查询。它还结合了基于 Yara 的内存扫描器，以识别物理内存中的恶意软件签名和注入代码。 该引擎涵盖了广泛的取证功能，包括进程和线程检查、网络连接列表和 Windows 注册表分析。它支持从实时系统、崩溃转储和虚拟机中摄取数据，同时提供符号解析以将原始内存地址转换为有意义的名称。 集成通过多语言程序化接口和针对 C 和 Java 的原生库包装器，以及用于自动化工作流的无头 Python 脚本提供支持。

Velociraptor is a digital forensics and incident response platform, endpoint detection and response system, and visibility tool. It provides a query engine and remote forensic collector used to hunt for indicators of compromise and perform triage across a fleet of hosts. The system is distinguished by its specialized query language for interrogating host state and parsing binary files. It features a notebook environment that combines markdown documentation with executable query cells to standardize investigative workflows and enable collaborative reporting. The platform covers a wide range o