C

ESP32Drop is a library that implements AirDrop functionality using the ESP32-S3, enabling file transfers between ESP32 devices and Apple devices without the need for pairing or routers. It supports direct communication to send and receive files, including images and various file types, while maintaining compatibility with the Apple Wireless Direct Link (AWDL) protocol. Notably, it operates exclusively over a secure direct link without requiring additional setup or infrastructure.

The PMD-Red tool is a decompilation project for Pokémon Mystery Dungeon: Red Rescue Team, enabling users to build and modify the game ROM (pmd_red.gba). Notable features include a structured build system and documentation for setup, catering primarily to developers and enthusiasts aiming to explore or alter the game's code.

openaptx is a reverse-engineered library intended for research purposes that provides decoding and encoding capabilities for apt-X and apt-X HD audio formats. It features integration options with FFmpeg and libsndfile, allowing for versatile audio file handling and manipulation, and includes support for configurable build options to customize functionality as needed. Please be aware that usage outside of research could infringe on existing patents, and redistribution in binary form is prohibited.

PaRappa the Rapper 2 Decompilation is an ongoing project aimed at reverse-engineering the PlayStation 2 game *PaRappa the Rapper 2*, with a current focus on the NTSC-J prototype. The tool facilitates the recreation of game assets and code structure, featuring segmented progress tracking across various components such as debug utilities, gameplay code, and menu functionality, thereby enabling contributions from the community for expansion and improvement.

Gauntlet Dark Legacy Decompilation is a work-in-progress project that reconstitutes the codebase of the Nintendo GameCube game "Gauntlet Dark Legacy" using the decomp-toolkit framework. It facilitates building a binary equivalent of the original `main.dol` file from the game disc, which is essential for verifying the decompilation against the retail version. The tool is designed for use on various operating systems, ensuring essential dependencies are easily managed, and it incorporates automatic object diffing for ongoing project revisions.

Fire Emblem: Seima no Kouseki (聖魔の光石) is a project for the decompilation and disassembly of the Japanese version of the game, enabling the reproduction of the original ROM byte-for-byte from committed source code and asset files without reliance on a base ROM. The tool supports robust community contributions and is utilized by various related projects such as fe-maps and FE_GBA_Function_Library, providing extensive documentation, mappings, and debugging resources. Notably, it emphasizes build self-containment and aims for a complete and accurate reproduction of the original game's functionality and assets.

The Xbox Dashboard Recompiled tool statically recompiles the original Xbox Dashboard's executable for native Windows execution, enabling a functional yet minimalist boot process that runs its initialization chain and prepares for rendering. Currently in development, it supports features such as parsing the dashboard's scene graph from `default.xip` and managing interactions with Xbox-specific graphics through a Direct3D layer. Notably, the tool adheres to strict rendering rules to ensure that only the dashboard's own graphics commands are executed, facilitating an authentic representation of the original interface without custom overlays.

Orbiter is an immersive NES emulator and debugger designed for Windows, offering a novel debugging experience with integrated introspection. Its primary use case is for debugging and analyzing NES games, featuring functionalities such as live disassembly, CPU and PPU inspection, execution-flow visualization, and video capture. Notable features include a persistent game library, advanced debugging tools such as profiling and rewind capabilities, as well as various display and audio options.

The Cavium CN6640-SNIC10E is an out-of-tree Linux driver stack designed to enable operation of the Cavium CN6640 smart NIC as a dual 10 GbE host interface. This tool leverages a reverse-engineered shared-memory datapath over PCIe, allowing seamless bidirectional traffic handling with high throughput, while maintaining complete reversibility and no dependency on vendor firmware. Notable features include automated card initialization on boot and zero-copy data transfers for optimized performance.

Twisted Metal: Harbor City is a project aimed at creating a matching decompilation of the unreleased PlayStation 2 game. It is primarily used for analyzing and understanding the game's code structure and assets in a POSIX environment. Notable features include detailed documentation on classes, assets, and networking, as well as integration with various development tools such as GNU GCC and Ninja for building.

Grate is an open source reverse-engineering toolset specifically designed for analyzing NVIDIA Tegra 2/34 2D and 3D graphics engines. Its primary use case is to facilitate understanding and documentation of the Tegra architecture through various resources, including command streams and shader instructions. Notable features include comprehensive wiki documentation that details MMIO registers, shader ISAs, and geometry submission methods.

Multiline Ultimate Assembler is a plugin for x64dbg and OllyDbg that serves as a multiline assembler and disassembler. Its primary use case involves modifying and extending the functionality of compiled executables and creating code caves. Notable features include support for multiline assembly input, enhancing the reverse engineering process.

SkyRoads SDL is a cross-platform port of the classic DOS space racing game SkyRoads, rewritten in C using SDL2, enabling native execution on macOS and Linux without the need for emulation. Notable features include a self-contained app bundle with integrated game data, customizable controls, and advanced graphical options such as CRT effects. The tool allows users to build from source easily while providing comprehensive compatibility with various hardware architectures.

Rizin libdemangle is a static library that provides demangling support for various programming languages within the Rizin framework. It can also be utilized independently as a command-line interface (CLI) tool, allowing users to demangle symbols from mangled identifiers, with features that support custom outputs and comprehensive testing options for development. The library is built using the Meson build system, facilitating easy installation and configuration for further development efforts.

SLEEPWALKER is a passive backdoor tool designed for offensive security tasks, featuring a 64-bit Windows DLL that impersonates `dpapi.dll` and loads into ESET's Management Agent. It utilizes a proprietary command language interpreted through a 23-opcode bytecode system, allowing for various operations including data transmission and remote execution of shellcode upon receiving a specific trigger packet. Notably, the tool includes a Python controller for compiling and encrypting commands, alongside a configurable architecture enabling advanced covert command execution and behavior customization.

SR CoD4x is a modified server for Call of Duty 4: Modern Warfare that enhances gameplay by fixing original binary bugs and providing developers with a plugin system for extended server functionality. Key features include administration commands, anti-hacker measures, support for legacy clients, and advanced player movement mechanics, along with enhanced netcode and customizable server settings. This tool aims to improve the multiplayer experience and server reliability while introducing additional gameplay features.

The LHDC V5 Decoder is a real-time software decoder for the proprietary LHDC V5 Bluetooth audio codec, designed for use on the ESP32 platform within a Bluedroid A2DP sink. It supports a range of sample rates and bit depths, and features an optimized pipeline for efficient decoding with no dependencies on the ESP-IDF framework, making it versatile for both embedded and host applications. Notable features include support for various bitrates, interleaved stereo PCM reconstruction, and performance tuning specifically for the Xtensa LX6 architecture.

SkyRoads for macOS is a native port of the classic 1993 DOS space-racing game, allowing it to run seamlessly on both Apple Silicon and Intel Macs without the need for emulation. It features a self-contained application that incorporates game data, customizable controls, and visual enhancements such as CRT effects, while supporting easy installation and building from source. Notable features include a fully rewritten engine in portable C with SDL2, support for AdLib music synthesis, and plans for future enhancements like online leaderboards and improved visual effects.

Blitzping is a high-speed, configurable packet-crafting utility designed for embedded devices, enabling the rapid generation of minimal TCP packets with optimized performance compared to existing tools like hping3 and nping. Its notable features include support for CIDR notations for source IPs, asynchronous raw socket configuration, multithreading, and efficient queuing to minimize system calls, making it particularly suitable for scenarios requiring high packet generation rates. Users can easily specify the number of threads and target IP/port combinations for efficient network testing and analysis.

Desvendando o Elifoot 98 é uma ferramenta de engenharia reversa que analisa o motor do jogo clássico Elifoot 98, utilizando Ghidra e Cheat Engine para explorar algoritmos, fórmulas, e mitos relacionados ao jogo. O repositório documenta as mecânicas internas do código, como a influência das nacionalidades dos jogadores e a estrutura de dados, desmistificando crenças populares que circularam por anos. Notáveis recursos incluem a verificação de mecânicas de jogo e a demonstração de como são calculadas as forças dos times, com uma abordagem técnica para dissecação de um jogo de 16 bits.

OpenRecet is an open-source C reimplementation of the Win32 engine for Recettear: An Item Shop's Tale, designed as a drop-in replacement for the original executable for users with a legitimate copy. This educational reverse-engineering project focuses on game preservation, ensuring no copyrighted content is included, and implements rigorous verification methods to achieve behavioral parity with the original game engine. While the project is in early stages and not yet playable, it has made significant progress in rendering key components of the game.

wolfSentry is an embedded Intrusion Detection and Prevention System (IDPS) and firewall designed for resource-constrained environments, offering both static and dynamic traffic filtering capabilities. It features flexible configuration through APIs and JSON input, dynamic reconfiguration with atomic transition, and seamless integration with lwIP and wolfSSL for efficient tracking and management of network traffic. Its lightweight design allows for deployment on various embedded platforms while maintaining deterministic performance and minimal memory usage.

Persona 3 FES Decompilation is a work-in-progress project aimed at decompiling the USA version of Shin Megami Tensei: Persona 3 FES. Its primary use case is to provide a complete source code version of the game, facilitating modifications and research into its architecture. Notable features include ongoing efforts towards achieving a fully comprehensive decompilation to enhance accessibility for developers and modders.

Wing Commander II source reconstruction and SDL2 port serves to restore and port the classic space combat game "Wing Commander II" as found in "Wing Commander: The Kilrathi Saga." This project enables cross-platform gameplay through the SDL2 framework, supporting both Kilrathi Saga and partial original DOS game data, while offering significant fidelity in function mapping with 98.06% machine-code similarity to the original executable. Notable features include enhanced graphical rendering options, full mouse and joystick support, and various fixes to improve user experience, such as window resizing and aspect ratio correction.

openevv is a portable implementation of IBM's Embedded ViaVoice text-to-speech engine, reengineered in C for compilation on non-Windows platforms, enabling text-to-speech functionality with byte-for-byte fidelity to IBM's original audio outputs. Its primary use case includes generating audio from text and serving as an add-on for screen readers, with features like multiple voice presets and the ability to produce wave files for playback on Linux systems. The tool is built entirely from scratch without reliance on IBM's SDK, and includes both command-line and graphical interfaces for user interaction.

The HP Laser 1008a on macOS project provides a solution for printing with specific HP Laser printers that lack native macOS support by utilizing a Linux container to run HP's rastertospl driver. This tool enables users to print directly from any application via the standard Cmd-P method without reliance on terminal commands or external scripts, making it user-friendly for Apple Silicon macOS environments. Key features include automatic installation via a single command and seamless integration with the CUPS printing system, circumventing multiple compatibility limitations.

rr-decomp is a decompilation tool for the PlayStation 1 game Ridge Racer, enabling users to reconstruct the game's source code from their legally-owned copy of the original disc. This tool generates assembly listings and a native runtime, facilitating a static recompilation approach that allows for incremental function replacement without breaking the gameplay experience. Notable features include the ability to verify progress in decompilation, ensuring no copyrighted assets are included, and the provision to create a playable version of the game using user-supplied data.

The lm-decomp repository provides a work-in-progress decompilation of the game Luigi's Mansion, enabling users to analyze and understand the game's code without including any proprietary assets. It supports multiple versions of the game across various regions, including USA, Japan, and multiple PAL revisions, allowing for robust examination and potential modification of the code. Notably, the project strictly prohibits AI contributions to maintain code integrity and legal compliance.

Benthic is a comprehensive Windows kernel rootkit designed for educational exploration and practical insights into rootkit development. It features advanced capabilities including process and network stealth, keylogging, and file hiding, all integrated into a modular framework for demonstrating real-world stealth and persistence from kernel mode. While leveraging techniques such as DKOM for process hiding and using the Windows Filtering Platform for network obfuscation, Benthic serves as a foundational resource for those venturing into the complexities of rootkit creation.

Zygisk-Loader is an ultra-lightweight Zygisk module developed in Pure C that facilitates the dynamic injection of external shared libraries into Android application processes. Its primary use case is to enable seamless and immediate updates of payloads without the need for device reboots, thanks to its "Hot-Swap" capability and robust memfd-based RAM injection, which ensures a zero forensic footprint. Key features include support for multiple target apps via a JSON configuration, no runtime dependencies, and compliance with the latest Zygisk API for enhanced compatibility with tools like Magisk.

GlyphDbg is a deterministic introspection engine designed for remote analysis of processes and memory, offering deep insights into the Windows NT environment without traditional debugging APIs. Notable features include advanced memory and pointer introspection, remote PE reconstruction for malware analysis, symbolic command interfaces, and a stealth execution engine to avoid detection. It emphasizes a raw, low-level approach to analysis, treating system components as integral narratives rather than mere metadata, and enables extensibility through custom DLL integration.

Clipwire is a kernel exploit development harness specifically designed for the iPhone 11 series running iOS 26.1, aimed at demonstrating vulnerabilities discovered through patch diffing between versions 26.1 and 26.6 of Apple's XNU kernel. It exploits two identified bugs: one related to unlocked operations in the copy-on-write (COW) submap fault path, and the other concerning insufficient bounds checks in memory object management, allowing for potential privilege escalation and memory corruption. Notable features include a structured source code layout for various exploit stages, as well as tools for physical memory read/write operations and object discovery, catering to researchers in exploit development.

The Persona4-Decompilation tool is a project designed to achieve a byte-for-byte decompilation of the PlayStation 2 game Shin Megami Tensei: Persona 4, specifically the USA version 1.00 (SLUS_217.82). Its primary use case is to reconstruct the game's source code and executable image using various tools and setups, while providing extensive metrics on decompiled functions, recovery quality, and build processes, ensuring a high fidelity to the original codebase. Notable features include support for detailed testing and verification, as well as the capability to manage dependencies and configurations for a successful build environment.

The LPE Toolkit 2026 (xpl2026) is an advanced collection of 26 static binaries targeting local privilege escalation (LPE) vulnerabilities on Linux systems for penetration testing and security research. Notable features include universal compatibility across various Linux distributions and kernel versions, automatic detection and filtering of applicable exploits, and an interactive user interface for seamless operation. The toolkit is especially significant for its inclusion of newly researched exploits, enhancing its utility for security professionals.

GhostESP is an open-source wireless research platform that transforms an affordable ESP32 board into a multifunctional wireless tool with a user-friendly touchscreen interface. Its primary use case includes advanced wireless monitoring, firmware updates, and network analysis, featuring capabilities such as on-device firmware management, a cloud app store, and robust scripting support via GhostScript. Notable enhancements in version 2.x include expanded NFC functionalities, efficient Wi-Fi attack and monitoring tools, and improved user interface performance with a focus on accessibility and multitasking.

OpenScope 2C53T is an open-source firmware developed as a replacement for the FNIRSI 2C53T handheld oscilloscope, multimeter, and signal generator, addressing limitations and bugs in the stock firmware through a clean-room rewrite. Its primary use case includes providing a customizable interface and various diagnostic tools for signal analysis, although it currently lacks live oscilloscope functionality due to unresolved FPGA configuration issues. Notable features include a four-mode UI, variable bitmap fonts, a robust battery management system, and various analysis algorithms, while emphasis is placed on ongoing development for reliable live data capture.

The Wii IPL repository is a work-in-progress project focused on the decompilation of the Wii Menu version 4.3 across multiple regions (USA, Europe, Japan, and Korea). It provides detailed progress tracking for each version, including metrics for decompiled code and functions, though it does not contain any executable assets. This tool is primarily aimed at developers interested in understanding the Wii Menu's implementation for educational or development purposes.

The Xbox One Controller Driver for macOS is a userspace driver that translates Xbox One controller inputs into keyboard and mouse events, functioning system-wide across applications. Notable features include customizable button mappings, a menu bar application for connection status, automatic reconnection capabilities, and a JSON configuration with hot-reloading support. The driver utilizes libusb for communication with the controller and injects events through the macOS Accessibility API, adhering to limitations that prevent it from simulating a virtual gamepad.

Slave I is an offensive-security firmware specifically designed for the M5Stack Tab5, facilitating wireless research through an integrated toolkit for Wi-Fi, BLE, and 802.15.4 recon and attack capabilities. Notable features include a touch UI, a physical-keyboard workflow, extensive scanning and capturing functions, and a desktop emulator for development. It allows users to implement advanced wireless attacks while emphasizing ethical usage and compliance with legal standards.

RB3Enhanced is a mod for Rock Band 3 designed to enhance the user experience by adding features, fixing bugs, and increasing song storage capacity to 8000 songs, specifically for modified Xbox 360 and Wii consoles. Notable features include support for custom songs, multiplayer functionality without Xbox Live, additional game modifiers, and integration with other platforms like Rock Band 3 Deluxe and GoCentral. This tool aims to provide a more customizable and expansive gameplay environment for Rock Band 3 enthusiasts.

RVBBIT is an educational proof-of-concept tool for researching Linux kernel rootkits, focusing on how they obscure the actual kernel state from userspace observations. It implements various rootkit techniques, including process and module hiding, syscall interception, and manipulation of filesystem and network visibility, all aimed at understanding these evasion methods in a controlled environment. Notably, the tool is designed strictly for research and education, lacking functional capabilities for exploitation or propagation.

RollCall is a tool for assessing the security of key fobs and garage remote controls by distinguishing between rolling code and static code protocols. It captures and analyzes the signal from the remote to confirm if the code changes with each press, providing health grades to indicate the security status. Notable features include its ability to fingerprint each press without additional hardware and a "Find My Remote" function to identify the frequency of unresponsive remotes.

`r2unity` is a command-line tool and plugin for radare2 designed to inspect Unity IL2CPP builds by parsing `global-metadata.dat` and correlating it with native binaries for reverse engineering purposes. Key features include support for various metadata wire versions, comprehensive recovery of managed images and method metadata, detection of companion files across multiple platforms, and the ability to generate CycloneDX SBOMs. It also recognizes Unity SerializedFile v22 assets and BGDatabase v6 repositories, enhancing its capability for analyzing Unity game builds.

Radmin VPN for Linux allows users to run the Radmin VPN client via Wine on Linux systems, enabling VPN network access without the overhead of a Windows virtual machine. The tool employs a custom driver that bridges Wine to a Linux TAP device, overcoming compatibility issues and ensuring a fully functional VPN experience. Notable features include AI-assisted reverse engineering for protocol implementation, AppImage distribution for simplicity, and command-line options for flexible usage scenarios.

MADCAT (Mass Attack Detection Connection Acceptance Tools) is a low-interaction honeypot solution designed for detecting and logging network attacks by simulating common network services. It captures attack patterns and behaviors by recording contact attempts, including IP addresses and timestamps, without providing extensive interaction, and is intended to enhance the monitoring and forecasting of mass attacks on the internet. The tool is currently under development to include a DPI Routing Proxy and Docker Appliance for improved capabilities.

Azazel is a lightweight eBPF-based runtime security tracer specifically designed for malware analysis sandboxes. It operates within isolated Docker containers to capture detailed telemetry data, such as syscalls, file interactions, and network activities, producing a JSON output that allows integration with various data processing tools. Notable features include zero runtime dependencies, compile-once run-everywhere capability, and built-in heuristics for automatic alerts on suspicious behaviors.

Vandal Hearts — Native PC Port is a fan-driven preservation project that recreates the PlayStation 1 classic by decompiling and porting it to modern desktop environments using SDL2, OpenGL, and OpenAL. Key features include a byte-exact matching decompilation of the original game, an optional Tactical Mode for rebalanced gameplay, enhanced graphics with a PSX-accurate integer rasterizer, and an HD pack for improved assets. The project maintains compatibility on both Windows and Linux, ensuring a faithful yet enriched gaming experience.

The `game-and-watch-patch` repository provides custom firmware and a patching utility for newer Nintendo Game and Watch consoles, enabling the enhancement of stock firmware functionality. It seamlessly integrates with `retro-go`, allowing users to run retro games, store the entire firmware internally without external flash, customize graphics, and dump playable ROMs. Notable features include configuration options for easter eggs, graphical dynamics, and additional ROM hack capabilities, optimizing the gaming experience on supported devices.

SentryPeer is a fraud detection tool designed to protect SIP servers from malicious activity by tracking and logging attempts to make phone calls from bad actors. Its primary use case involves monitoring outbound calls from VoIP PBXs to notify users of potentially harmful interactions based on an extensive database of probing phone numbers. Notable features include a RESTful API for easy integration, real-time notifications to service providers, and support for Syslog and Fail2ban for enhanced security logging and management.

A decompilation of Pikmin brought to you by fans of the series.

AlwaysOnTop is a Windows utility designed to elevate a program's window to a higher Z-order position by obtaining UIAccess permissions, allowing it to remain on top of other windows, including system-level tools like the Task Manager. Its primary use case is to prevent interruptions during screen recording or marking sessions by ensuring that the program window is not obscured. Notably, it optimizes the UIAccess acquisition process, minimizing the number of required process startups and simplifying the privilege elevation methodology.

Brochacha20 is a discontinued static client decryptor for Roblox, designed to extract and decrypt game files from the Roblox client directory. Users can specify a directory path and optional output file via command-line arguments, with features including silent mode and manual issue reporting through GitHub. Despite its current inoperability, the tool provides insights into the decryption process of Roblox's runtime page data.

Cinnamon is an open-source re-implementation of the GameMaker: Studio runner specifically designed for the Nintendo 3DS and Wii U platforms. Its primary use case is to enable the execution of GameMaker Language (GML) games compiled as bytecode, thus allowing titles such as Undertale and Deltarune to be ported to these consoles. Notable features include support for bytecode versions 16 and 17, optimization for older hardware, and ongoing development aimed at increasing game compatibility across various GML titles.

KHVNC is a remote desktop tool that enables users to create and manage a hidden virtual desktop session on a remote machine, thus allowing the execution of applications and scripts without disrupting the physical user's activities. Notable features include browser automation in stealth mode and support for multiple web browsers, making it suitable for educational and research applications. The tool consists of a server component for hosting hidden sessions and a client for controlling those sessions remotely.

Capstone is a versatile disassembly framework designed for binary analysis and reverse-engineering, catering to the security community. It supports a wide array of hardware architectures and provides a lightweight, intuitive API with detailed disassembly output and semantics of instructions, making it suitable for high-performance malware analysis and integration into various applications, including firmware and OS kernels. With native compatibility across multiple platforms and extensive language bindings, Capstone is a powerful tool for developers and security professionals.

The "local-root-exploits" repository provides a curated collection of local privilege escalation exploits for Linux systems. Its primary use case is to facilitate security research and testing by demonstrating vulnerabilities that can be exploited to gain root access on local Linux environments. Notable features include organized categories of exploits for different Linux kernel versions and configurations.

windows-lpe-lite is a local privilege escalation tool targeting Windows XP SP3 and later versions, enabling exploitation of specific CVEs (CVE-2014-4113, CVE-2015-1701, and CVE-2017-0213). Its primary use case is to grant elevated privileges on vulnerable Windows systems through the exploitation of kernel-mode vulnerabilities. Notable features include compatibility with various Windows builds and the ability to execute commands or spawn command prompts with elevated rights.

ByeIntegrity 8.0 is a sophisticated Windows privilege escalation tool that exploits design and security flaws in the operating system, operational even with User Account Control (UAC) set to the highest level. It utilizes the Task Scheduler to trigger the WDI ResolutionHost task, manipulating environment variables to load a custom payload that executes with elevated privileges. Key features include controlled event triggering via ETW and direct communication with the Program Compatibility Assistant, enabling a bypass of potential policy restrictions.

CVE-2021-27965 is a proof-of-concept (PoC) exploit targeting a local privilege escalation vulnerability in the MICSYS Windows driver, MsIo64.sys. This tool leverages stack-based buffer overflow in the driver's IOCTL dispatch routine, allowing arbitrary physical memory mapping, port access, and potential system crashes. Notable features include the ability to execute IOCTL requests that bypass Windows security mechanisms, facilitating unauthorized access to system-level operations.

Delete2SYSTEM is a tool designed to exploit arbitrary file and directory deletion vulnerabilities to achieve NT AUTHORITY\SYSTEM privileges on Windows systems. Utilizing methods derived from known techniques, it specifically targets deletion of critical folders related to Windows Error Reporting and Windows Media Player, leveraging vulnerabilities such as CVE-2020-1170 and CVE-2020-1571. Notable features include integration with the NtApiDotNet library and the ability to weaponize Windows services for privilege escalation.

Linux Kernel Exploitation is a laboratory tool designed for practicing various exploitation techniques within the Linux kernel environment. It covers advanced exploitation methods such as ret2user, memory manipulation strategies, and kernel information leaks, while providing comprehensive guidelines for compiling and preparing kernel modules and necessary utilities. Notable features include detailed instructions for building kernel sources, configuring BusyBox, and setting up an initial filesystem for testing.

UACHooker is a proof-of-concept reflective DLL designed to exploit the AicLaunchAdminProcess function in explorer.exe for privilege escalation by manipulating UAC prompts. It achieves this by redirecting user-initiated administrative commands to run a specified payload instead, masquerading it as legitimate software, while showing misleading arguments. The tool’s notable features include its ability to create indistinguishable UAC prompts for unsigned executables and the potential for future enhancements such as support for additional hooking libraries and broader target applications.

This repository provides an exploit for the Parallels Desktop vulnerability CVE-2023-27326, which allows local attackers to escalate privileges on affected installations. The exploit targets a flaw in the Toolgate component, enabling the execution of arbitrary code due to inadequate validation of user-supplied paths in file operations. It is notable for its specific applicability to version 18.0.0 of Parallels Desktop and the details of its exploitation, which are documented alongside a proof of concept.

Wall-Escape (CVE-2024-28085) is an exploit tool designed to leverage a vulnerability in the util-linux wall command that allows attackers to inject escape sequences into command line arguments, potentially leaking sensitive information such as user passwords. The tool sets up an environment to execute commands while monitoring for password input, effectively capturing credentials during user interactions—particularly in contexts like SSH login or sudo commands. Notable features include the ability to manipulate command outputs and create a fake prompt that misleads users into revealing their passwords.

The Linux-Privilege-Escalation tool provides a comprehensive set of techniques for escalating privileges on Linux systems. Its primary use case includes identifying vulnerabilities related to kernel exploits, file permissions, and sudo configurations, while notable features include detailed methods for exploiting kernel vulnerabilities, leveraging GTFOBINS for privilege escalation, and examining scheduled tasks and SUID binaries for potential exploitation paths.

PetitPotato is a local privilege escalation tool that leverages the PetitPotam technique by abusing impersonate privileges via the MS-EFSR protocol. Its primary use case is to gain SYSTEM privileges on target Windows systems by exploiting vulnerabilities in encrypted file system operations. Notable features include compatibility with the latest Windows versions and the ability to execute arbitrary commands by specifying the desired EfsID and command parameters.

The SELinux-Kernel-Module-Bypass tool enables users to bypass SELinux protections through the use of the `init_module` function, primarily aimed at security researchers and penetration testers. This project provides resources and methods for exploiting SELinux configurations, enhancing the understanding of kernel module behavior within constrained environments. Notable features include documentation and links to related resources for further exploration of Linux kernel module manipulation.

The IOCTL Linux Driver repository provides a foundational example for creating an IOCTL driver in Linux, enabling kernel mode access to special registers and memory-mapped regions for user mode applications. Notable features include an example application demonstrating driver interaction, a structured codebase with modular files for the driver and application, and debugging instructions utilizing printk output and strace for tracing user-kernel interactions.

asroot is a utility designed to run specified commands with root user privileges after prompting for the user's password. It ensures a secure execution environment by sanitizing and updating environment variables, with an option to preserve the original environment. The tool is restricted to users in the wheel group, reinforcing access control measures for executing high-privilege commands.

Chronomaly is a kernel exploit targeting CVE-2025-38352, facilitating persistent root access on LG webOS Smart TVs running kernel version 5.4.268 on ARM64 architectures. It features an automated exploit chain that leverages novel techniques, including a redesigned write primitive and non-destructive pipe reads, ensuring reliability on physical hardware through advanced race condition manipulations. The exploit has been validated across multiple TV models and firmware versions, and was disclosed responsibly to LG's Security Researcher Program.

Rootisnaked is an eBPF-based tool crafted for monitoring root privilege escalations on Linux systems by intercepting changes to user credentials, specifically monitoring when a process's UID changes to 0 (root). Primarily used for detecting potential privilege escalation attempts, it logs these events to a ring buffer, enabling subsequent analysis. The tool additionally supports centralized alerting via integration with Alertmanager and Telegram for real-time notifications.

Z-Jail is a lightweight multi-layer sandbox for executing native code on Linux, designed for scenarios such as CI pipelines and CTF challenges. It features seven ordered isolation layers that enforce security measures like namespaces, capability dropping, seccomp-BPF syscall whitelisting, and auditing with JSON logging, all within a compact ~81 KiB binary and without external dependencies. This makes Z-Jail a unique solution that balances minimalism and robust security for code execution environments.

PostShell is a post-exploitation tool designed to facilitate advanced shell access through both bind and backconnect methods, enabling attackers to maintain an interactive TTY session with job control while remaining stealthy. Notably, it features cloaked process names to minimize detection, a compact stub size of less than 14kb for easy deployment on Unix-like systems, and built-in anti-debugging mechanisms to enhance resilience against analysis. The tool's design allows for operation in environments with limited dependencies, improving post-exploitation flexibility.

A modular pentesting framework implemented in C

Zombie Ant Farm is a toolset designed for offensive security practitioners to enhance evasion techniques against Linux Endpoint Detection and Response (EDR) systems. Its primary use case involves facilitating the development of custom offensive strategies through features such as distributed payload warehousing, in-memory payload delivery, and ASLR weakening shims, making it suitable for advanced penetration testing and research. The kit includes various components such as preloaders, evasion primitives, and a warehouse service, providing a modular approach to offensive operations.

Enumy is a high-performance enumeration tool designed for penetration testing and Capture The Flag (CTF) challenges, facilitating the identification of common security vulnerabilities on target Linux machines. Its features include configurable scan options, the ability to output results in various formats, and support for multithreaded operations to optimize scan speed and efficiency. Suitable for both professional pentesters and hobbyists, Enumy assists users in uncovering security issues during post-exploitation phases.

OffensivePH is a post-exploitation tool designed to bypass user-mode access controls using an outdated Process Hacker driver. Its primary use case is to execute shellcode or terminate processes, enabling actions such as process hijacking and API call redirection through DLL injection. Notable features include a standalone executable for process management, integration for shellcode injection, and automatic cleanup of its driver after execution.

sudo_sniff is a discreet tool designed for post-exploitation scenarios to capture user passwords when executing the sudo command by manipulating the user's `$PATH`. It functions by hijacking the sudo execution to record both successful and failed password entries, storing them in a specified temporary file. Notable features include the ability to adapt to different system configurations for sudo and potential enhancements for stealthier operation.

Agent Loader is a modular command-and-control (C2) tool designed to facilitate the deployment of in-memory payloads and covert operations through a DNS-over-HTTPS channel. Its notable features include dynamic function encryption, a reverse-shell module, and extensive file system management capabilities, alongside a customizable CLI builder for creating tailored implants via Python. The tool also offers a Node.js web panel for interactive management, showcasing a bot list and persistence mechanisms through OneDrive and Task Scheduler.

C_keylogger is a stealthy keylogging tool developed in C for Windows that utilizes a traditional approach to log keystrokes without relying on WinAPI hooks. It features persistence, remote activation, a stealth handler to hide the Command Prompt window, and efficient memory management through variable reuse. The tool is designed for educational purposes in a controlled lab environment, requiring specific amendments before compilation to ensure connectivity.

C2KepExec is a Command and Control (C2) server designed to manage a BotNet of machines running a Remote Administration Trojan and is developed for educational purposes. Its notable features include remote keylogging, file management capabilities (uploading and downloading), integrated session control for multiple targets, and persistent infection techniques on Windows systems. The tool also allows for advanced monitoring functions such as screen captures and webcam access.

Unicorn is a Command and Control (C2) framework designed for post-exploitation and remote control operations. Built using Python and Flask, it features a client-server architecture that supports multiple listeners, dynamic command execution, and client chat synchronization, while still being in development with planned enhancements such as a proxy server and GUI integration. This tool is aimed at cybersecurity professionals for managing agents and executing commands in compromised environments.

WebcamBOF is a Beacon Object File (BOF) for Cobalt Strike that enables webcam capture functionality. Its primary use case is to facilitate remote image acquisition by allowing users to save webcam images either to disk or download them directly over the Cobalt Strike beacon. Notable features include multiple save methods, including capturing images as screenshots, and the ability to enumerate connected webcam devices.

WindowSpy is a Cobalt Strike Beacon Object File designed for targeted user surveillance, facilitating stealthy detection of significant user activities such as entering credentials or accessing confidential documents. It operates by comparing active window titles against a customizable list to trigger specific actions, like screenshots, only when relevant activities are detected, thus minimizing unnecessary data collection. Key features include easy integration with Cobalt Strike, a configurable keyword list for triggering surveillance, and the ability to customize the actions performed upon detection.

Minijail is a sandboxing tool designed to enhance security by isolating and containing processes, primarily used in ChromeOS and Android environments. It allows users to launch and sandbox executables securely, mitigating risks associated with compromised services through robust containment strategies. Notable features include an executable for sandboxing known binaries and a library that enables developers to integrate sandboxing capabilities directly into their applications.

`setcap-static` is a streamlined, statically linked tool designed to set file capabilities, particularly useful in containerized environments where non-root execution is required while maintaining specific privileges, such as binding to low-numbered ports. It addresses the limitations of Docker's `COPY` command, which does not preserve extended attributes, by allowing capabilities to be assigned directly in the target image, and it features self-deletion to minimize attack vectors by removing itself after execution. This tool is particularly advantageous in scratch images, enhancing security while facilitating necessary privilege assignments for applications.

Nakamoto is a two-layer encryption tool designed to secure sensitive data and cryptocurrency private keys. It offers functionalities for generating random passwords, as well as encrypting and decrypting files, making it suitable for users seeking to enhance their data protection measures. Notable features include its dependency on OpenSSL for cryptographic operations and straightforward command-line usage for various encryption tasks.

Meow-meow is a repository that compiles a diverse range of cybersecurity research results, showcasing both successful and experimental practical cases. Its primary use case is to serve as a resource for cybersecurity professionals and enthusiasts seeking insights into malware development and practical applications of ethical hacking. Notable features include links to various related publications and books authored by the creator, providing additional context and depth in the field of cybersecurity.

procscope is an eBPF-based process tracer for Linux that enables real-time observation of process behavior, including lifecycle events, file activity, and network connections, with minimal overhead and configuration. It is primarily designed for security researchers and incident responders to trace malware behavior and audit container workloads without the complexities of traditional monitoring tools like EDR. Notable features include support for various process-related events, file operations, and privilege transitions, allowing users to effectively monitor and analyze runtime activity.

Chase H.Q. is a reverse-engineered project for the ZX Spectrum, featuring a comprehensive disassembly and a C implementation of the original game. It utilizes SkoolKit to generate detailed assembly listings and includes a human-readable C reimplementation with SDL3 integration, allowing users to explore the game's mechanics through both disassembly and functional re-creation. Notable features include support for the 128K version, a well-structured Makefile, and the ability to create custom cheat codes via POKEs.

Open Apollo is an open-source project that provides Linux drivers and tools for Universal Audio's Apollo Thunderbolt and USB audio interfaces, enabling full duplex audio routing, preamp and monitor control, and system integration. Key features include comprehensive support for multiple sample rates, low-latency audio capture and playback, a DSP mixer with audio effects, and compatibility with PipeWire for seamless audio management. This experimental project is actively developed to enhance audio interface functionality on Linux but is not yet ready for production use due to potential stability issues.

The Rootkits Development Starter Pack provides a collection of Windows kernel-mode driver examples that demonstrate fundamental rootkit functionalities such as thread creation, process callbacks, and filesystem filtering. Its primary use case is to educate users on kernel-level development and guide them through creating modular steps for advanced rootkit development. Notable features include a comprehensive set of proof-of-concepts, detailed instructions on building drivers, and essential information on Windows kernel operations and security measures.

The Snowboard Kids 2 decompilation project provides an environment for reverse-engineering the classic Nintendo 64 game by extracting game assets from an existing ROM and combining them with C code to create an identical ROM. Its primary use case is for developers and enthusiasts interested in studying or modifying the game, and it features support for building on Debian/Ubuntu and macOS, with dependencies for C code compilation and asset extraction. The project is strictly non-commercial and emphasizes community contributions for code documentation and compatibility improvements.

Unicorn Engine is a versatile, multi-platform CPU emulator framework that supports various architectures, including ARM, x86, and MIPS, enabling users to execute and analyze software in a controlled environment. Its notable features include a simple and lightweight API, high performance through Just-In-Time compilation, and support for instrumentation and thread-safety, making it ideal for security research, software debugging, and development tasks across different programming languages.

khdays-decomp is a matching decompilation project for Nintendo DS's *Kingdom Hearts 358/2 Days*, aiming to produce C source code that can be compiled into an identical binary as the original game. Currently in early development, it reports progress by tracking the count of fully decompiled C functions and distinguishing between real C implementations and temporary ASM placeholders. Notable features include detailed progress metrics and separate handling for SDK/library byte-match identifications.

Sonic Advance Trilogy (SAT-R/sa2) is an ongoing decompilation project focused on the Sonic Advance series, specifically Sonic Advance 1 and 2, with plans for Sonic Advance 3. The tool provides a fully cross-platform and matching C codebase transcribed from the original ROMs, enables compilation for multiple platforms including Windows and PlayStation, and features comprehensive extraction of audio and graphic assets alongside detailed documentation of game mechanics. Notably, it is still under active development, with a significant portion of the original functionality and metadata already extracted and converted.

vanmoof-tools facilitates the reverse engineering of VanMoof S3/X3 electric bike firmware, providing utilities for analyzing various firmware images from multiple microcontrollers used in the bike's components. Notable features include detailed specifications for firmware structure, including boot loader and image header formats, CRC calculation methods, and support for different firmware generation containers. The toolset is designed to operate on Linux, macOS, or Raspberry Pi, making it accessible for users across various platforms.

Android-Mem-Kit is a lightweight C library designed for Android security research, offering functionalities such as memory patching, function hooking, and symbol resolution. Notable features include integration with ShadowHook for inline function hooking, XDL for dynamic linker bypassing, and SLJIT for platform-independent JIT code generation, all optimized for minimal overhead and ease of use in native Android applications.

BG3SE-macOS is a native implementation of the Baldur's Gate 3 Script Extender for macOS, enabling the use of mods that require scripting capabilities, including gameplay tweaks and UI enhancements. It aims for full parity with the Windows version, supporting a wide range of modding functionalities while specifically omitting certain features like UI scripting and input injection. The tool is built from the ground up, offering compatibility with both Apple Silicon and Intel Macs, and allows users to easily integrate and manage mods directly through Steam.

The half-life1_win32_722 repository provides a reverse-engineered version of the source code for Half-Life 1 Net Test 1 (engine build 722), designed for developers looking to explore or modify this early pre-release iteration of the GoldSrc engine. It includes restored source code for critical components like the engine, client, and localization module, along with a reimplemented lightweight launcher. The tool is particularly useful for those interested in game development or historical software analysis of the Half-Life franchise.

Jesso Decompiler is a static analysis tool that disassembles and converts compiled binaries into C code for both Windows (PE files) and Linux (ELF files), specifically targeting binaries coded in x86/x86-64 machine language. It features a GUI built with wxWidgets, allowing users to visualize the disassembly process, although it is still in development and does not yet fully support the entire Intel instruction set. The tool analyzes binaries to extract function details and generate an intermediate representation of the program's logic, assisting in reverse engineering efforts.

The Kirby & The Amazing Mirror repository provides a complete disassembly of the USA version of the game, allowing users to compile the ROM file katam.gba. Its primary use case is to facilitate game modifications and reverse engineering for fans and developers. Notable features include detailed source code and setup instructions, enhancing the modding community's ability to understand and modify the game.

KNSoft.NDK provides native C/C++ definitions and import libraries for Windows NT development, enhancing interaction with undocumented Windows APIs and offering additional functionality. Key features include extensive API declarations, import libraries for Windows DLL exports, and utility functions for unit testing, string handling, command-line parsing, and random number generation. Developers can seamlessly integrate KNSoft.NDK by including its header files, which serve as an addendum to the standard Windows SDK.

Memory of Alessa is a decompilation project focused on achieving 100% byte-matching for the PlayStation 2 game Silent Hill 3, as well as its underlying engine from Silent Hill 2. The tool aims to facilitate the understanding and documentation of Team Silent's PS2 engine, providing resources for both decompilation and technical learning, though it is currently in early stages of development. Notable features include robust support for working across various operating systems and a comprehensive setup guide for users.

nfdx64dbg is a plugin designed for the x64dbg debugging platform, primarily used for analyzing and reverse-engineering PE (Portable Executable) files. Its notable features include enhanced functionality for file inspection and manipulation within the x64dbg environment, streamlining the debugging process for security researchers and developers.

OpenBGI is an open-source re-implementation of the Ethornell Buriko General Interpreter (BGI), targeting cross-platform execution of Buriko Programs (`._bp` scripts). Its primary use case is to provide a highly portable engine capable of running visual novels while integrating tools for game translation and graphical enhancement. Notable features include the ability to execute basic opcodes, early support for graphics routines, and plans for compatibility with multiple platforms, including Windows, macOS, Linux, Android, and WASM.

The Pokémon Platinum repository is a work-in-progress decompilation of the Pokémon Platinum game, allowing developers to build and customize the ROM files. Its primary use case is to facilitate modifications and enhancements for the game, supporting collaborative contributions from the community. Notable features include support for building multiple ROM revisions and comprehensive installation and contribution guidelines.

The radar_pi plugin integrates various yacht radar systems with the OpenCPN marine navigation software, enhancing its capabilities for maritime navigation. It notably supports Garmin HD, Garmin xHD, Navico Broadband Radar, and select Raymarine radars, offering features like guard zones, target trails, and customizable PPI windows. This plugin provides crucial functionality for sailors and marine enthusiasts who use compatible radar systems for improved navigation and situational awareness.

Rizin is a comprehensive reverse engineering framework designed for analyzing binaries, disassembling code, and debugging programs, offering enhanced usability and features compared to its predecessor, radare2. It supports a wide array of operating systems and architectures, includes multiple utilities for scripting and binary manipulation, and facilitates interaction with popular programming languages through rzpipe. Notable features include a command-line assembler, tools for binary comparison and pattern searching, as well as extensive file format compatibility.

The RTL8196E Gateway project provides open Linux firmware for the Lidl Silvercrest Zigbee Gateway, transforming it into a fully local smart home hub capable of serving as a Zigbee coordinator, Thread Border Router, or Zigbee router. Notable features include support for modern Zigbee stacks, SSH access for secure management, and the ability for over-the-air firmware updates. The firmware is designed to be portable across various RTL8196E-based gateways, bolstering its versatility in IoT environments.

Silent Hill Hub is a comprehensive repository designed for reverse engineering, documentation of file formats, and modding tools for the Silent Hill video game series. It provides utilities for extracting and viewing game assets such as 3D models, textures, audio, as well as scripts for various popular tools like 010 Editor and Noesis, facilitating in-depth exploration and modification of game content. Additionally, the project aims to preserve community knowledge and resources related to the series, thereby supporting both developers and enthusiasts in the Silent Hill modding community.

spm-decomp is a decompilation project focused on the Super Paper Mario game, primarily targeting the PAL versions along with some support for the NTSC-U version. It aims to extract specific parts of the game's code useful for modding or analysis, without intending to provide a complete decompilation or platform ports. Notable features include the ability to modify game behavior through a configurable setup and support for various disc image formats for building the project.

SR CoD4x is a modification of the Call of Duty 4: Modern Warfare server that addresses original game bugs and enhances server functionality through a plugin system. Notable features include automated client updates, robust anti-cheat measures, extended player movements, and a reliable player identification mechanism, providing a more optimized and feature-rich gaming experience for players.

AirStrike 3D Tools is a specialized reverse engineering toolkit aimed at deconstructing the AirStrike 3D game series. It enables users to perform tasks such as APK archive extraction, model conversion (MDL to OBJ), save file previewing, and audio conversion, while also supporting graphics viewing and Linux compatibility. The toolkit is built using C++ and Python, emphasizing extensibility and ease of use for reverse engineering game assets.

Butterscotch is an open-source re-implementation of the GameMaker: Studio runner, enabling the execution of GameMaker games compiled to bytecode on various platforms. It primarily aims to support a wide range of GameMaker: Studio games, especially targeting titles like Undertale, by allowing compatibility with multiple WAD versions. Notable features include a focus on community collaboration, ongoing development for increased game support, and the ability to generate PlayStation 2 ISO files.

CANopenTerm is an open-source tool designed for developing, testing, and analyzing CANopen CC networks and devices, with added support for SAE J1939 and OBD-II protocols. Notable features include advanced network monitoring, configuration and simulation capabilities, raw CAN CC interface, and automation support via Lua and Python scripts, making it a versatile solution for professionals in automotive and industrial applications. Additionally, it provides functionalities like SDO management, conformance testing, and test report generation, enhancing the overall workflow for engineers working with CAN protocols.

Freelancer.Reverse.Runtime is a project focused on building a custom managed runtime layer for the 2003 space trading and combat simulation game, Freelancer. Its primary use case is to reconstruct, document, and extend the game's engine behavior through compatible proxy DLLs while avoiding chaotic memory manipulation. Notable features include the implementation of a structured C++ layer that replaces original DLLs, monitors engine behavior, and seamlessly injects new functionality, facilitating a reliable engineering approach that respects the original game architecture.

Garlic is a high-performance open-source decompiler for Android and Java files, designed to convert APK, DEX, JAR, and CLASS files into readable Java source code. Notable features include multi-threading capabilities for faster decoding, integration for cross-platform builds using Zig, and functionality for string searching within decompiled outputs. This tool caters primarily to security researchers and developers needing to analyze or reverse-engineer Android applications efficiently.

ROLLER is a modern implementation of the 1995 racing game Whiplash, designed to run on current PC systems by replacing DOS-specific functions with SDL and platform-compatible equivalents. Its primary use case is for users to play a nostalgic game experience in contemporary environments, either through a browser demo or a native installation that requires original game assets. Notable features include support for loading game data from legally owned retail discs, a built-in demo version, and comprehensive tools for debugging and assembly output generation.

Shiva is a Just-In-Time (JIT) micropatching engine designed for ELF dynamic linking and patching of native Linux software on AArch64 and X86_64 architectures. It allows users to write C-based patches that can be compiled into ELF relocatable objects, enabling runtime modification of binaries at load-time through a method known as "chained linking." Notably, Shiva supports dynamic patching while retaining compatibility with existing ELF interpreters and emphasizes a straightforward user guide for seamless integration into existing workflows.

Embedded Hacking is a comprehensive educational resource designed for individuals interested in embedded software development and reverse engineering. The course offers step-by-step tutorials, specifically focused on working with the Raspberry Pi Pico and includes practical skills such as live variable hijacking, command line operation, and breadboarding. Key features include a free downloadable course book, video tutorials, and links to necessary hardware and skills prerequisites.

Pokemon Stadium (US) is a work-in-progress decompilation project that allows users to build a functioning ROM for the game Pokemon Stadium (US) from its source code. The tool requires a pre-existing ROM and enables users to initialize and reassemble the game through a straightforward make process. Notable features include support for various system dependencies and a Python-based build environment, making it accessible for users familiar with development practices.

Radare2 is a comprehensive reverse engineering framework designed for Unix environments, providing a suite of tools and libraries to facilitate tasks such as binary analysis, disassembly, and debugging. Notable features include support for scripting through an embedded JavaScript interpreter, local and remote debugging capabilities, and extensive plugin architecture that enables users to extend its functionality with various plugins. This tool is especially aimed at security researchers and developers looking for powerful solutions in binary exploitation and reverse engineering.

The Win11Src repository contains a partially leaked version of the Windows 11 source code, primarily derived from extracted resources, modified legacy files, and officially released components from Microsoft. Its primary use case is for educational and research purposes, allowing users to explore the inner workings of Windows 11 and its architecture. Notable features include a collection of fragments from DLLs obtained via ResHacker and contributions from other non-Microsoft open-source projects.

1337kit is a 64-bit Loadable Kernel Module (LKM) rootkit builder designed for educational use, allowing users to create custom rootkits based on YAML configurations. Its notable features include remote shell connectivity, the ability to hide files, process IDs, and network connections, as well as obfuscation and encryption options for enhanced stealth. This tool is tailored for malware analysts and cybersecurity practitioners involved in creating Capture The Flag (CTF) exercises.

Blindsight is a high-density hex viewer designed for visual pattern matching and manipulation of binaries under 1MB, primarily aimed at reverse engineering and one-off CTF tools. Notable features include support for live code reload to facilitate rapid prototyping with C scripts, the ability to extend and customize views using C libraries, and a focus on encouraging innovative analysis of binary data.

ctf-toolkit is a specialized toolkit designed for assisting with Attack-Defense (AWD) and other Capture The Flag (CTF) offline competitions. Its primary use case revolves around providing necessary resources and functionalities to streamline participant engagement in CTFs, enabling efficient and effective challenge handling. Notable features include tools tailored for various aspects of CTF gameplay, enhancing the overall competitive experience.

FCracker is a command-line tool designed for brute-forcing password-protected files, supporting various formats including zip, rar, pdf, and gpg on Linux systems. Intended for personal and capture the flag (CTF) usage, it integrates with John the Ripper or Hashcat for enhanced cracking capabilities. The tool requires specific dependencies and allows users to input target files and wordlists for the cracking process.

CTF-Challenges is a repository designed for educational purposes, featuring a collection of CTF (Capture The Flag) challenges and guides for setting up a Linux user space pwn environment. Its primary use case is to aid users in understanding and practicing exploitation techniques through structured challenges, while also providing instructional materials to enhance learning. Notable features include the accessibility of various challenges and comprehensive setup notes to facilitate an effective learning environment.

The iOS 26 Activation Lock repository documents 31 firmware-level vulnerabilities found in iOS 26.3, specifically targeting the activation lock subsystem. It serves primarily as a resource for the security research community, featuring self-contained writeups for each vulnerability, ranking from critical to less severe, along with proof-of-concept implementations and exploitation scripts. Notable features include detailed descriptions, reproduction steps, and evidence for each finding, aiding researchers in understanding and possibly mitigating the identified security issues.

APKX-Hunter is a comprehensive open-source Android Static Analysis Framework developed in C, tailored for security assessments, malware analysis, and penetration testing of Android applications. It supports a wide array of package formats and features advanced capabilities such as recursive multi-APK scanning, integration of OWASP MASVS compliance checks across 15 categories, and a machine learning-based secret classification engine for efficient vulnerability prioritization. Notable features include detailed scan statistics, various decompilation methods, and streamlined integration for Debian systems, making it a robust tool for security researchers.

WiFi-Deauther is a tool designed for executing deauthentication attacks and monitoring Wi-Fi packets using an ESP8266 module. It features an OLED display for real-time status updates, button controls for navigation, and the ability to enhance signal strength with external antennas. The tool is primarily intended for educational and security testing, emphasizing responsible use with appropriate permissions.

Inject is a command line tool designed for crafting, injecting, and sniffing various network protocols, making it ideal for network troubleshooting, testing, or educational purposes. It supports multiple protocols such as Ethernet, ARP, IP, ICMP, TCP, and UDP, and includes features for creating custom network packets, integrating payload files, and capturing packets with customizable filtering options. Notable functionalities encompass detailed packet injection and robust network sniffing capabilities.

reveng_rtkit is a Linux Loadable Kernel Module (LKM) rootkit specifically designed for the 5.11.0-49-generic Linux kernel, primarily used for post-exploitation stealth techniques. Its key features include syscall table address retrieval, function hooking, and the capability to hide itself and other processes from system monitoring tools, making it difficult to detect. Additionally, it implements an IOCTL for interactive control and can bypass known rootkit detection tools like rkhunter.

Diamorphine is a Linux kernel module rootkit designed for various Linux kernel versions from 2.6 to 6.x across x86/x86_64 and ARM64 architectures. Its notable features include the ability to conceal processes and directories, as well as granting root privileges to specified users through specific signal commands. This tool enables undetected manipulation of the system, making it particularly useful for advanced stealth operations in cybersecurity contexts.

Lulzbuster is a high-speed, multithreaded HTTP(S) directory and file brute-forcing tool designed for penetration testing and security assessments. It leverages concurrent HTTP requests to efficiently enumerate valid file paths and directories, while offering customizable options such as status code filtering, proxy support, and client certificate usage. Notable features include the ability to minimize false positives through smart mode options and support for extensive wordlists to ensure comprehensive scan results.

symp is a Mach-O symbol-based tool designed for patching functions in binary files by leveraging symbol tables, export tables, and Obj-C metadata. Its primary use case is for developers and security researchers to manipulate binary files through various patching methods, including writing hex bytes, implementing predefined patches, or replacing functions with new binaries. Notable features include support for multiple symbol formats, architecture selection, and integration with the xsp tool for enhanced hex patching workflows.

ICE9 Bluetooth Sniffer is a Wireshark-compatible tool designed for comprehensive Bluetooth traffic analysis through wideband sniffing capabilities, utilizing software-defined radios like HackRF and bladeRF. It features multi-channel support (4-60 MHz) and offers command-line operation for capturing Bluetooth Low Energy (BLE) packets or all channels, with the ability to log data into PCAP files for further analysis. Additionally, it supports GPU-accelerated FFT processing and can be integrated directly into Wireshark for user-friendly interface access.

ColdWer is a cybersecurity tool that enables users to freeze endpoint detection and response (EDR) or antivirus (AV) processes by leveraging the WerFaultSecure.exe PPL bypass, allowing for the extraction of LSASS memory on modern Windows systems. Its primary use case is for security assessments and exploit development, featuring a fast execution model, manual process control, and the ability to bypass process protection via in-memory modifications. This tool is particularly useful for maintaining stealth during sensitive operations while extracting potentially credential-related information from LSASS.

CS-EDR-Enumeration is a Cobalt Strike Aggressor Script designed to enumerate antivirus (AV), endpoint protection platform (EPP), endpoint detection and response (EDR), and telemetry/SIEM products on Windows hosts post-compromise. It features six commands with varying noise levels to suit different operational risk tolerances, and includes a comprehensive signature database for major security vendors, enabling silent enumeration techniques that minimize detection. Notable capabilities include kernel driver enumeration, automatic threat level assessment, and color-coded output for quick identification of security products.

CS2BR is a compatibility layer designed to enable the execution of Cobalt Strike (CS) Beacon Object Files (BOFs) in Brute Ratel C4 (BRC4) by translating CS API calls to their BRC4 equivalents. It facilitates the use of existing CS BOFs in the BRC4 environment, though it currently only works at the source code level and does not cover all CS API functionalities. Notable features include a patching process for BOF source code and the option to generate parameters for execution, while users should be aware of limitations regarding certain APIs and the potential for increased code size.

InlineWhispers3 is a tool designed to modify SysWhispers3 generated files for compatibility with Cobalt Strike's Beacon Object Files (BOFs), specifically utilizing indirect system calls to enhance evasion from endpoint detection and response (EDR) systems. By eliminating direct system calls, it significantly improves the stealth of red team operations on Windows platforms. The tool's notable features include its ability to merge output files and the straightforward integration of generated syscalls into project code for seamless usage.

RevEng.AI Radare2 Plugin enhances the Radare2 framework with AI-driven reverse engineering functionalities, including decompilation, function analysis, and binary similarity detection. It seamlessly integrates with existing Radare2 workflows, providing automated setup scripts across multiple platforms and the capability to utilize an external API for advanced analysis tasks. Noteworthy features include a straightforward installation process, automatic library path configuration, and the generation of necessary configuration files directly through Radare2 commands.

Rebellion is a Linux kernel rootkit malware designed for x86 and x86_64 architectures, offering features such as self-hiding capabilities, folder and file concealment, TCP/UDP port hiding, privilege escalation from low-privilege users to root, and a backdoor mechanism accessed via ICMP packets. Currently in beta, it seeks collaboration for development to address existing bugs and architecture compatibility issues. Notable functionalities include the ability to manipulate visibility within the system using the `kill` command and the curation of specific configurations through a dedicated `config.h` file.

TibaneC2 is a modular Command & Control (C2) framework designed for offensive security research and red teaming, featuring a C/C++ core server, a PHP-based web panel, and a CLI console. Its notable characteristics include cross-platform implants, multi-language stagers, and scripting tools for enhanced automation and emulation, facilitating extensive customization without altering core functionality. The framework is intended strictly for educational and authorized testing purposes.

RVBBIT Arsenal is a dual-purpose cybersecurity tool designed for educational purposes in Linux rootkit warfare, encompassing both offensive and defensive capabilities. It includes Project RVBBIT, a kernel rootkit integrated with a miner and a network worm for attack simulations, and RvbbitSafe, a defensive framework that detects and eliminates RVBBIT threats. This repository serves as a comprehensive resource for understanding both the techniques of rootkit deployment and the corresponding countermeasures.

KHAØS C2 is a sophisticated post-exploitation command and control framework designed for stealth and evasion against endpoint detection systems. It features five covert communication channels, including Microsoft Teams and GitHub Gist, ensuring that the traffic blends with normal operations. The framework includes extensive post-exploitation capabilities, such as token theft, process injection, and lateral movement, along with a user-friendly React-based UI for real-time monitoring and payload management.

SpyIt is a real-time desktop surveillance tool designed for educational and research purposes, utilizing DXGI Desktop Duplication to capture and stream screen content over HTTP as MJPEG. It offers low-overhead operation, system audio streaming, and a user-friendly HTML viewer with multi-monitor support, making it suitable for red team operations and integration with AdaptixC2 for streamlined deployment and control. Key features include dynamic port assignment, background execution, and extensive audio device handling.

ADMmutate is a polymorphic shellcode mutation engine designed to evade Network Intrusion Detection Systems (NIDS) by generating unique but functionally equivalent code fragments that resist signature-based detection. Its notable features include XOR-based polymorphic encoding, sliding key mechanisms, and multiple code paths, enhancing its ability to obfuscate shellcode in various architectures such as IA32, SPARC, and MIPS. The tool specifically targets signature analysis weaknesses in NIDS, employing advanced techniques to adapt and randomize its output dynamically.

The illusionsec Archive is a comprehensive collection of Distributed Denial of Service (DDoS) tools, scanners, and botnet resources tailored for cybersecurity professionals and researchers. It features multiple versions of notable botnets, such as Mirai and QBot, alongside vulnerability exploits, various attack methods (Layer 4, Layer 7, UDP, TCP), and additional utilities for bot compilation and command/control management. This archive serves as an extensive toolkit for testing and analyzing DDoS attack methodologies and their defensive countermeasures.

The KSMBD-CVE-2025-37947 repository provides a proof-of-concept exploit targeting the out-of-bounds write vulnerability identified as CVE-2025-37947 in the ksmbd kernel server. Its primary use case is to demonstrate the exploitation of the vulnerability through various provided scripts and configuration files, including a BPF tracer and a minimal trigger. Notable features include a ready-to-use build system and a script to launch a testing environment using QEMU.

The PoCs-and-Exploits repository offers a collection of exploits authored by the creator, categorized into three main directories: personal CVEs, their own exploits for external vulnerabilities, and third-party exploits for quick reference. The tool is primarily used for sharing research findings in cybersecurity, with an emphasis on privacy and documentation quality. Notable features include the organization of exploits by authorship and a commitment to including comprehensive README files for each exploit to elucidate their mechanics and root causes.

0xKern3lCrush is an educational repository designed to understand Bring-Your-Own-Vulnerable-Driver (BYOVD) techniques and document key artifacts related to recent vulnerabilities like CVE-2026-0828. It provides safe user-mode reconnaissance code for process enumeration, alongside static analysis on identified vulnerable drivers, aimed at assisting security professionals in recognizing patterns in malicious behavior and improving detection capabilities. Notable features include an emphasis on ethical usage, detailed research notes, and a lack of any exploitative code to prevent misuse.

This repository provides a proof-of-concept for a Windows local privilege escalation exploit that combines a User Account Control (UAC) bypass with token duplication to elevate a process to SYSTEM-level privileges. It serves primarily for educational purposes, demonstrating key concepts of Windows security, such as token mechanics and process elevation, while employing techniques like registry manipulation and access token duplication to illustrate vulnerabilities in privilege management. Notably, the tool employs specific Windows APIs for process creation and token handling, highlighting potential attack vectors in a controlled environment.

Atomic-Mirai is an educational tool modeled after the Condi-Mirai botnet family, aimed at facilitating research on IoT security vulnerabilities and DDoS attack methodologies. It features a flexible compilation process for various architectures and includes a command and control (C&C) server setup, allowing users to simulate and analyze attack vectors in a controlled environment. Notably, this tool is strictly intended for educational and research purposes, with a clear disclaimer against illegal usage.

Copy Fail is a proof-of-concept tool designed to demonstrate a method for fully unprivileged containers to achieve node-level code execution on Kubernetes by exploiting the CVE-2026-31431 Linux kernel vulnerability. It leverages the shared image layers in container runtimes, allowing an unprivileged pod to corrupt binaries in a shared layer that are later executed by privileged DaemonSets, thereby achieving container escape. Notable features include validation on multiple cloud platforms (Alibaba Cloud, Amazon EKS, and Google GKE) and a comprehensive breakdown of the attack chain, which includes page-cache corruption, cross-container propagation, and privileged execution.

The CVE-2022-0847 tool exploits a vulnerability known as "Dirty Pipe" to achieve container escape, allowing an attacker to overwrite read-only files on the host system from within a container. Its primary use case is for demonstrating the potential risks associated with granting the `CAP_DAC_READ_SEARCH` capability to containers. Notable features include the ability to bypass file permission checks and use the `splice()` system call to overwrite files directly on the host filesystem.

Dirty Frag is a proof-of-concept tool that demonstrates how an unprivileged Kubernetes Pod can exploit the Dirty Frag vulnerability (CVE-2026-43284) to achieve node-level code execution on Amazon EKS by corrupting in-memory cached pages of shared container image layers. Its primary use case is to illustrate the risks associated with privileged DaemonSets in Kubernetes clusters that share image layers, as it allows for direct execution of compromised binaries by these privileged workloads. Notable features include the ability to target any privileged DaemonSet, leveraging kernel page-cache corruption alongside the sharing of image layers, thereby exposing a significant security vulnerability in Kubernetes environments.

dirtyfrag-arm64 is an ARM64/AARCH64 exploit tool adapted from the original x86_64 dirtyfrag PoC, targeting vulnerabilities CVE-2026-43284 and CVE-2026-43500. Its primary use case is for privilege escalation by corrupting system binaries, specifically employing an ESP path for exploitation due to limitations on the ARM64 architecture. Notable features include detailed analysis of AppArmor bypass methods and architecture-specific payload adaptations, allowing it to interact with existing user and network namespaces on vulnerable systems.

Isolation Alloc (IsoAlloc) is a secure, C11-based memory allocator designed as a drop-in replacement for `malloc` on 64-bit Linux and MacOS systems, emphasizing memory allocation isolation to enhance security by spatially separating objects of various sizes and types. Key features include the management of memory through distinct zones for specific sizes, comprehensive debugging support for memory leaks and usage, and built-in compatibility with Address Sanitizer and similar tools. IsoAlloc is particularly suitable for applications where security and performance of memory management are crucial.

The Linux-Exploitation repository provides a comprehensive set of tools and techniques for performing privilege escalation on Linux systems. Its primary use case is to assist security professionals in identifying vulnerabilities that can be exploited to gain higher access levels, featuring sections on manual enumeration, automated tools, password mining, misconfiguration exploitation, and maintaining access through SSH key uploads. Notable features include detailed guides on various escalation methods, scripts for automated enumeration, and an exhaustive list of potential exploits tailored for Linux environments.

Pentagram-exploit-tester is a utility designed to assess whether a device running iOS 15.0 to 15.1.1 and 15.2 BETA 1 is vulnerable to CVE-2021-30955, facilitating compatibility with jailbreak exploits. The tool informs users of their device's status regarding this vulnerability, advising against updates if the device is vulnerable. Notably, the tool allows for multiple testing attempts in case of transient errors during execution.

The SNEK Blue War Hammer is a research tool that facilitates the exploration of Windows Defender's update mechanisms and potential vulnerabilities through sophisticated Windows API interactions. It is primarily aimed at security researchers and system administrators for educational purposes, implementing advanced features such as RPC communication, COM interfaces, VSS manipulation, and kernel-level file system operations. Notably, it allows for the extraction and analysis of Defender update packages directly from Microsoft, highlighting attack vectors associated with file access controls during the update process.

BrowserSnatch is an offensive-security tool designed for authorized penetration testing that extracts and decrypts sensitive data from over 40 web browsers, including both Chromium and Gecko-based platforms. Notable features include the ability to retrieve stored passwords, cookies, bookmarks, and browsing history, as well as support for app-bound encrypted data, all optimized for high performance with minimal dependencies. The tool serves red teams in demonstrating the impact of endpoint compromise and aids blue teams in improving detection tactics against browser data theft.

BUSted is a repository designed for conducting microarchitectural side-channel attacks on MCU bus interconnects, specifically targeting the Smart Lock application as a proof of concept. It consolidates tools and scripts for measuring covert-channel capacities, along with the firmware and hardware configurations necessary for replicating the attack on STM32 devices. Notable features include a script for automated measurement of channel capacity and tools for visualizing the channel matrix.

Copy Fail is a cross-platform implementation in C of the Copy Fail Linux Local Privilege Escalation (LPE) exploit (CVE-2026-31431), designed to demonstrate the vulnerability on various architectures without relying on per-architecture hex blobs or inline assembly. The tool includes multiple variants for payload delivery, such as a binary-mutation dropper and a variant that modifies the `/etc/passwd` file, as well as a non-destructive vulnerability checker. It requires no additional libraries and supports extensive architecture compatibility through the included nolibc.

CVE-2022-23093 is a cybersecurity tool designed to exploit a stack-based buffer overflow vulnerability in the FreeBSD ping utility, which results from improper handling of IP option headers during ICMP response processing. Its primary use case is to demonstrate the ability to execute arbitrary shellcode through crafted ICMP packets that trigger the overflow. Notable features include the ability to customize the shellcode as well as the detailed technical analysis of the vulnerability's mechanics and its impact on system integrity.

Erebos-Zero is a personal arsenal for malware development featuring sophisticated techniques for evasion and injection. It includes a variety of exploitation methods such as shellcode injection, DLL injection, and process manipulation, along with advanced anti-forensics and evasion techniques tailored for bypassing endpoint detection and response systems. This tool is primarily intended for research and educational purposes, focusing on the creation and deployment of stealthy malicious payloads.

IrisC2 is a command and control (C2) framework designed for authorized security testing, red team exercises, and internal research. It features a modular architecture comprising a Client for user interaction, a Server for managing communication and tasks, Beacons for executing commands within target environments, and a Stager for handling staged payloads. Notable capabilities include multi-platform support, advanced task scheduling, plugin integration for extended actions, and comprehensive event synchronization.

The Linux LPE Toolkit is a multi-architecture privilege escalation tool designed to identify and exploit vulnerabilities to gain root access on Linux systems. It includes 24 pre-built exploits for various architectures, automatically detects kernel versions, filters out patched exploits, and attempts each exploit until root access is achieved. Notable features include a dry-run mode for planning, command execution upon successful exploitation, and options for verbose or silent output during exploitation.

Osiris-Jailbreak is an experimental jailbreak tool for iOS devices running versions 11.2 to 11.3.1, intended solely for developers to explore the jailbreaking process. Key features include the execution of the multi_path exploit (CVE-2018-4241), granting kernel task permissions, enabling remote terminal access, and bypassing certain security measures like the Sandbox and AMFI. However, the tool is still in development, lacks essential features like Cydia support, and is not recommended for general users due to its potential instability and incomplete functionality.

The Qualcomm GBL Exploit PoC tool facilitates the unlocking of bootloaders on Qualcomm devices through a specific exploit. Its primary use case is to enable users to install custom software, recover locked devices, or troubleshoot advanced issues, all without requiring programming knowledge. Notable features include a straightforward graphical interface for running the unlocking process and compatibility with various Qualcomm devices, operational on Windows systems.

CLR-Stomp is a Beacon Object File (BOF) designed for Cobalt Strike that implements .NET assembly stomping by loading a specified .NET assembly from the Global Assembly Cache (GAC) and replacing its content with a malicious payload before the runtime reads the metadata. This technique offers a covert execution mechanism that retains the legitimate disk identity of the GAC assembly, enabling the payload to evade detection while running in the victim's environment. Notable features include the use of custom memory managers to manipulate the CLR's assembly mapping process and the ability to suppress strong-name verification, which maintains the facade of legitimate assembly usage.

CrystalForge is a custom AdaptixC2 agent designed to enhance payload generation through integration with the Crystal Palace UDRL pipeline. It facilitates the creation of various payload formats, including DLL and shellcode, while allowing users to specify custom Crystal Palace loader specifications, all while preserving the features of the existing Adaptix beacon architecture. Key functionalities include multi-transport support, a straightforward plugin installation process, and a roadmap for expanding capabilities beyond current limitations.

The EternalHush Framework is an advanced command and control (C&C) platform designed specifically for Windows systems, enabling users to extend its functionality through a Python API for plugin development. Notable features include an intuitive GUI, integration capabilities for external modules, and a variety of built-in implant functionalities such as TCP/HTTP(S) connections and reflective DLL loading, all aimed at facilitating data collection and interaction with infected systems. This open-source project is currently in early development and seeks community collaboration for enhancements.

Flipper RF Lab transforms the Flipper Zero device into a sophisticated RF analysis and research tool, featuring 15 advanced capabilities such as RF fingerprinting, adaptive signal modeling, and real-time spectrum monitoring. It enables users to perform detailed signal capture and analysis, protocol reverse engineering, and long-term logging within the 300-928 MHz frequency range. Notable functionalities include real-time activity mapping, threat modeling, and a robust modular research mode, making it suitable for professional RF forensics.

hARMless is an ELF Packer/Loader designed for ARM64 and x86-64 Linux binaries, utilizing multi-layer encryption techniques for secure execution. Its primary use case is to facilitate stealthy operation by preventing the original binary from being written to disk and employing runtime in-memory execution, alongside features such as code obfuscation, CRC32 integrity checks, and polymorphic loading to enhance anti-analysis measures.

KoviD is an open-source Loadable Kernel Module (LKM) designed for educational and defensive security research focused on rootkit techniques within Linux Kernel version 5 and later. It empowers security researchers and system administrators to analyze rootkit behavior, develop detection signatures, and enhance their understanding of kernel-level vulnerabilities through practical demonstrations of real-world threat capabilities. Notable features include support for investigating module concealment, process hiding, and log manipulation, enabling users to test and improve their security monitoring and incident response strategies.

LID (Linux Integrity Drift) is a tool designed to systematically identify kernel code paths that bypass Linux Security Module (LSM) hooks, thereby exposing visibility gaps in security policies without breaching the security guarantees of the LSM framework. It provides detailed insights into what security-sensitive operations are not evaluated by the LSM, affecting compliance and forensic capabilities. Notable features include distinguishing between visibility gaps and practical escalation paths, offering a nuanced understanding of potential security weaknesses in Linux environments.

RedTeam-Agent is an AI-powered autonomous framework designed for red team security assessments, enabling automated execution of commands across multiple tools through a skill-first terminal workflow. Its notable features include support for over 15 integrated security tools, advanced output filtering, and comprehensive Active Directory attack coverage, allowing users to streamline the red teaming process without manual tool management. The framework facilitates multi-client operations and includes functionalities for reconnaissance, data collection, analysis, and lateral movement.

Reflectra is a User-Defined Reflective Loader (UDRL) designed for Windows x64 platforms, enabling modular integration with various Command and Control (C2) frameworks. It features a customizable reflective loading pipeline, advanced evasion techniques such as syscall spoofing and ETW patching, and extensive control over execution flow and memory layout, allowing for sophisticated payload manipulation. The tool is built on the Crystal Palace architecture and focuses on seamless DLL-based payload delivery while maintaining operational stealth.

Zero-loader is a polymorphic x64 shellcode loader designed to evade detection by generating unique binaries with every build, thus ensuring no static signatures are shared across compilations. Its primary use case is for authorized security testing and research, featuring advanced evasion techniques such as indirect syscalls, patchless AMSI/ETW bypass, module stomping, and anti-emulation measures. By employing methods like XOR encryption and synthetic function tables, the tool maintains a low profile during execution, effectively avoiding modern detection systems.

Donut-CustomHost is a sophisticated tool designed to generate and execute shellcode while maintaining stealth against modern endpoint detection and response (EDR) solutions. Key features include a custom CLR host that intercepts assembly loading directly from memory, advanced memory tracking evasion techniques, and architecture-aware event tracing for Windows (ETW) bypassing, all of which are aimed at minimizing detection during execution. Additionally, the tool has optimized the shellcode size, ensuring efficient memory use and a reduced footprint.

Entropia is a high-level compiled language designed for generating Windows position-independent x86-64 shellcode and Beacon Object Files (BOFs) with a streamlined build process. Its primary use case is to simplify the development pipeline for red-team artifacts by combining multiple stages—from compilation to OPSEC enhancements—into a single step. Notable features include direct access to Windows SDK headers, enabling easy integration of native functions, and support for compiling complete BOFs in minimal code, while maintaining a compact and intuitive language syntax.

KHAØS LOADER is a multi-stage Windows x64 loader that utilizes AES-256-CBC to decrypt and inject donut shellcode into a `rundll32.exe` process spawned under `explorer.exe`, employing advanced evasion techniques such as indirect syscalls with call stack spoofing. Notable features include early-bird APC injection, unhooking capabilities, and robust sandbox evasion mechanisms, which ensure stealthy operation against various security measures. This tool is designed for authorized use only and integrates multiple sophisticated methods to remain undetected during execution.

C-Full-Offensive-Course is a bilingual educational resource designed to guide users through a comprehensive C programming curriculum focused on offensive security practices across Windows, Linux, and macOS platforms. The course comprises 216 progressive units with hands-on coding exercises, alongside a centralized codebase to facilitate learning. It emphasizes ethical usage by instructing users to conduct security labs only within authorized and isolated environments.

ENDGAME is a command and control framework designed for authorized red team operations and penetration testing, enabling users to simulate adversarial techniques and assess their network's detection capabilities. Its standout feature is the integrated AI Console, which interprets user objectives in natural language and suggests executable commands based on real-time contextual data, enhancing efficiency in red team workflows. Additionally, the framework supports automated analysis of command outputs to inform follow-up actions, ensuring a streamlined operational process.

Rubber Dolphy is a proof-of-concept tool designed for the FlipperZero device that enables data exfiltration via BadUSB functionality utilizing mass storage capabilities. It allows users to copy data onto the FlipperZero when it acts as a BadUSB device, facilitating the retrieval of exfiltrated information across different operating systems, including Linux, Windows, and macOS. Notable features include support for FAT file system imaging and the integration of DuckyScripts for streamlined operations, along with planned enhancements for increased functionality and automation.

Tung is a command-line tool designed for configuring and testing firewalls against various types of DoS attacks. Its primary use case is to assist security professionals in evaluating firewall resilience and understanding DoS attack vectors through a collection of common techniques across multiple network protocols, including implementations of attacks like Slowloris and BlueNurse. Notable features include support for ICMP, TCP, UDP, and IP, making it a versatile tool for both educational and practical security testing purposes.

XeraLdr is an advanced Windows loader engineered for executing payloads stealthily while evading modern Endpoint Detection and Response (EDR) systems, specifically tested against Microsoft Defender for Endpoint with no alerts triggered. Key features include techniques such as module stomping, IAT camouflage, and advanced anti-analysis measures, which significantly enhance its stealth capabilities and reduce detection risks. This tool is designed primarily for educational and research purposes, enabling users to understand sophisticated evasion tactics used in malware payload delivery.

dnsmap is a tool designed for scanning domains to identify subdomains through brute-forcing techniques, utilizing a built-in wordlist of approximately 1000 English and Spanish terms. It is primarily used by penetration testers during the information gathering phase of security assessments to uncover hidden servers and resources that may not be easily discoverable through standard enumeration methods. Notable features include the ability to save results in CSV and human-readable formats, and it operates without requiring root privileges to enhance security.

Impost3r is a C language-based tool designed for stealing various types of passwords on Linux systems, specifically targeting sudo, su, and ssh credentials. It operates by manipulating user environment files to intercept password entries without alerting the user, automatically erasing traces post-use, and can transmit the captured data via DNS protocol. Noteworthy features include stealth operation, automated cleanup of traces, and adaptable configurations for local storage or network transmission of stolen credentials.

Macgonuts is a versatile ARP/NDP tool designed for network address spoofing, supporting both IPv4 and IPv6 protocols. It aims to provide a lightweight, user-friendly interface for ethical hacking and pentesting while allowing developers to leverage its functionalities via C libraries or bindings in Go and Python. Compatible with Linux and FreeBSD, Macgonuts emphasizes responsible use and ethical practices in network security assessments.

Packet Batch is a high-performance tool designed for generating and sending network packets, primarily used for penetration testing and network monitoring. Its notable features include the ability to send multiple packets with random source IPs and payloads, support for UDP, TCP, and ICMP, and optional checksum calculations to offload processing to the NIC. The tool also offers a version utilizing AF_XDP sockets for improved performance on recent Linux kernels.

COM-Hunter is a COM hijacking persistence tool designed for both educational purposes and red teaming applications, offering functionality in .NET and as a Cobalt Strike compatible BOF variant. Its notable features include multiple modes for establishing or removing COM hijacking persistence mechanisms, such as searching for CLSIDs, executing classic persistence, and utilizing Task Scheduler. This versatile tool assists security professionals in simulating advanced persistence techniques within Windows environments.

ExploitHawk is a terminal-based exploit search tool tailored for ethical hacking and red team operations on Linux distributions. It offers features such as fast multi-threaded searches through local databases, customizable name and version querying, a user-friendly ncurses interface, and clipboard integration for easy result management. The tool is primarily designed to enhance safe testing for users with permissions on systems while requiring a local copy of Exploit-DB for functionality.

okhi is an open-source keystroke logging implant designed for integration into USB and PS2 keyboards, allowing real-time monitoring of keystrokes via WiFi. It employs an RP2040 microcontroller for data capture and an ESP32-C2 chip for wireless transmission, making it a compact and efficient solution for educational and proof-of-concept purposes. Key features include support for both keyboard types, real-time data access, and a modular design that facilitates easy installation and operation.

SKELETONKEY is a comprehensive Linux local privilege escalation (LPE) tool that consolidates 46 modules targeting 41 distinct CVEs from 2016 to 2026, offering both red team and blue team functionalities. It features verified exploits, automatic module selection based on safety, detection rules for security audit logging, and a scanning capability for system administrators to identify unpatched vulnerabilities. This tool is designed for authorized testing only, ensuring ethical hacking practices while providing robust functionality for pentesters and system administrators alike.

AL-ANQA-FIRMWARE is an offensive security firmware designed for the LilyGo T-Deck, transforming it into a portable pentesting terminal equipped with over 60 integrated WiFi, Bluetooth, network, and radio tools. Key features include on-device WiFi attack capabilities, a comprehensive Bluetooth LE security audit suite, an interactive SSH client, and tools for wardriving and device monitoring—all operational without the need for additional PCs or GUIs, ensuring a self-contained and efficient testing environment.

Argos is a passive Wi-Fi tracking tool designed to capture probe request frames from Wi-Fi enabled devices, allowing users to extract SSID information and acquire geographic data through Wigle, subsequently visualizing this on a Google Maps interface. The tool features a web interface, dynamic data filtering options, and parameters for controlling the scanning environment, while emphasizing strict ethical usage guidelines to prevent privacy violations. Notable functionalities include the ability to limit signal strength, support for multiple network interfaces, and compatibility with various Wi-Fi adapters for optimal performance.

The Flipper Zero IR Signal Generator is a versatile tool designed to generate and emit various infrared signals for security assessments and hardware hacking. It features a user-friendly interface, customizable settings for different signal types, and secure operations to minimize risks, making it accessible even to users with limited technical experience. The tool is compatible with Windows, macOS, and Linux systems, requiring only a Flipper Zero device and a USB connection for operation.

Specter transforms the Flipper Zero into a sophisticated counter-surveillance tool designed for detecting active 13.56 MHz NFC readers. This tool passively listens for RF emissions from hidden skimmers or covert readers, providing real-time feedback on the presence and type of detected devices, as well as the cleanliness of the environment. Notable features include an analog EMF gauge for proximity detection, a fingerprinting capability to classify the type of NFC reader, and the ability to log and monitor over time, enhancing situational awareness for security professionals.

KASLD is a tool designed to recover the Linux kernel's virtual and physical memory layout, specifically the kernel text base, from a local process by leveraging various system evidence and architectural invariants. Its primary use case is kernel Address Space Layout Randomization (KASLR) derandomization, which allows users to infer potential kernel text placements even in hardened environments. Notable features include support for multiple architectures, an inference engine that fuses evidence from various techniques, and the ability to report the upper bounds of KASLR protection based on the collected data.

The DEFCON 31 Syscalls Workshop repository provides educational materials focusing on direct and indirect syscalls within Windows operating systems, particularly aimed at enhancing understanding of Win32 and Native APIs for Red Team activities. It includes theoretical content, practical exercises, and proof of concepts (POCs) to facilitate learning about syscall mechanisms and their implications in EDR evasion. Notable features include an emphasis on manual techniques over complex automation, offering foundational insights into call stacks and shellcode execution dynamics.

The kernelpwn repository serves as a comprehensive resource for Capture The Flag (CTF) challenges focused on kernel exploitation, providing both challenge write-ups and educational material for beginners in the field. It features a collection of solved kernel-pwn challenges with detailed write-ups, covering various complex exploitation techniques such as SMEP, SMAP, KPTI, and KASLR bypasses. Notable features include a focus on both kernel and non-userland vulnerabilities, as well as an invitation for community contributions to enhance the repository’s challenge offerings.

The Learning Reverse Engineering repository provides a collection of programs aimed at enhancing skills in reverse engineering and malware analysis. It organizes content by specific concepts related to reverse engineering, delivers both source code and compiled binaries, and includes links to supplementary online courses and video playlists. Notable features include guidance on using various tools like Ghidra and IDA Pro, as well as instructions for compiling the source code with Microsoft’s C/C++ compiler.

各种CMS、各种平台、各种系统、各种软件漏洞的EXP、POC ,该项目将持续更新

Android Unpacker presented at Defcon 22: Android Hacker Protection Level 0

A collection of awesome resources & modules for the Flipper Zero device. Best used with Rogue Master Flipper Zero Custom Firmware.

CTF竞赛权威指南

CTF Cheat Sheet + Writeups / Files for some of the Cyber CTFs that I've done

Interactive CTF Exploration Tool

CVE-2020-0796 - Windows SMBv3 LPE exploit #SMBGhost

Universal local privilege escalation Proof-of-Concept exploit for CVE-2024-1086, working on most Linux kernels between v5.14 and v6.6, including Debian, Ubuntu, and KernelCTF. The success rate is 99.4% in KernelCTF images.

Explore RootSec's DDOS Archive, featuring top-tier scanners, powerful botnets (Mirai & QBot) and other variants, high-impact exploits, advanced methods, and efficient sniffers. Ideal for cybersecurity professionals and researchers.

Reverse engineering the 1997 game "Carmageddon"

An easy-to-use library for emulating memory dumps. Useful for malware analysis (config extraction, unpacking) and dynamic analysis in general (sandboxing).

A powerful static binary rewriting tool

eBPF-based lightweight debugger for Android

Fully chained kernel exploit for the PS Vita on firmwares 3.65-3.68

A FREE Windows C development course where we will learn the Win32API and reverse engineer each step utilizing IDA Free in both an x86 and x64 environment.

🇺🇦 Windows driver with usermode interface which can hide processes, file-system and registry objects, protect processes and etc

Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).

State-of-the-art native debugging tools

My proof-of-concept exploits for the Linux kernel

Various kernel exploits

A fast, hackable and simple x64 VT-x hypervisor for Windows and Linux. Builtin userspace sandbox and introspection engine.

linux-kernel-exploits Linux平台提权漏洞集合

Dynamic unpacker based on PE-sieve

A tool to dump the login password from the current linux user

NetCat for Windows

Platform for Architecture-Neutral Dynamic Analysis

Decompilation of Paper Mario (Nintendo 64)

ParadoxiaRat : Native Windows Remote access Tool.

A simple & straight-to-the-point PHP profiling extension with its built-in web UI

An offline Wi-Fi Protected Setup brute-force utility

Decompilation of Pokémon Emerald

Decompilation of Pokémon FireRed/LeafGreen

Decompilation of Pokémon Ruby/Sapphire

A collection of Windows, Linux and MySQL privilege escalation scripts and exploits.

The Official Radare2 Book

The PE file analysis toolkit

Driver 2 Playstation game reverse engineering effort

ret-sync is a set of plugins that helps to synchronize a debugging session (WinDbg/GDB/LLDB/OllyDbg2/x64dbg) with IDA/Ghidra/Binary Ninja disassemblers.

A post exploitation framework designed to operate covertly on heavily monitored environments

Example of using revealed "Spectre" exploit (CVE-2017-5753 and CVE-2017-5715)

hydra

Open source re-implementation of Tomb Raider I and Tomb Raider II, along with additional enhancements and bugfixes

Source code of Valve Anti-Cheat obtained from disassembly of compiled modules

Reverse engineering of Validity/Synaptics 138a:0090, 138a:0094, 138a:0097, 06cb:0081, 06cb:009a fingerprint readers protocol

windows-kernel-exploits Windows平台提权漏洞集合

xAnalyzer plugin for x64dbg

Using Zygisk to dump il2cpp data at runtime