Zig

libd2 is a clean-room reimplementation of the Diablo II 1.14d engine core, written in Zig, designed primarily for game development and reverse engineering. It features a seed-driven map generator that replicates the game's world, along with comprehensive systems for item generation, network protocols, and world routing, all accessible across multiple programming languages and platforms, including WASM support. The library allows for on-the-fly act generation and provides rich functionalities through various APIs, ensuring seamless integration for developers.

x64dbg-MCP Server is a native plugin for x64dbg that enables programmatic control of the debugger over HTTP, utilizing the Model Context Protocol (MCP). Its primary use case is for enhanced reverse engineering, allowing users to manage breakpoints, step through code, and access memory and registers via any MCP-compatible AI assistant. Notable features include zero dependencies, dual transport methods (streamable HTTP and SSE), and comprehensive debugger control with 71 available tools and 22 event callbacks.

The d2-dedicated-server project provides a self-hosted, open-source dedicated game server for Diablo II version 1.14d, functioning as a cloud-native replacement for PvPGN. It features a headless architecture that integrates an injected Zig DLL to manage the game engine and a clean-room realm server, enabling seamless multiplayer experiences for unmodified retail clients. Designed for containerized environments, it supports Kubernetes and Docker, with stateless scalability and compatibility with modern observability tools like Grafana.

ZYRA is a Zig-based obfuscator, packer, and loader aimed at safeguarding executable files against static analysis and reverse engineering. Its notable features include performance optimization through Zig, the ability to generate complex control flow to hinder reversing efforts, and runtime decryption for secure execution of payloads. Currently, ZYRA supports Linux, with straightforward installation and usage options for packaging executables.

Black-Hat-Zig is a cybersecurity tool that focuses on implementing various malware techniques using the Zig programming language, catering particularly to security researchers, malware developers, and reverse engineers. Notable features include continuous updates and a community-driven approach, which encourages contributions to expand its functionality and content. This tool serves as a resource for exploring and weaponizing capabilities within the Zig environment.

Rango is a basic C2 agent developed in Zig for GNU/Linux systems, primarily serving as a proof of concept for utilizing Zig in command and control applications. Notable features include basic command execution capabilities, a straightforward codebase without external dependencies, and recent support for Windows targets mirroring its Linux functionality. The tool is still in development, with additional features such as file upload/download and BOF support planned for the future.

The bof-launcher is a versatile programming library designed for in-memory management and execution of Beacon Object Files (BOFs) across multiple platforms, including Windows and Linux. It supports various architectures and integrates seamlessly with languages such as C, Zig, and Rust, offering features like asynchronous execution, cross-platform compatibility, and advanced memory masking techniques. Additionally, the library facilitates the development of BOFs using Zig, leveraging a rich standard library for enhanced functionality during red team engagements.