PE Tools - Portable executable (PE) manipulation toolkit

Automatic and platform-independent unpacker for Windows binaries based on emulation

Process Ghosting - a PE injection technique, similar to Process Doppelgänging, but using a delete-pending file instead of a transacted file

Portable Executable (PE) library written in .Net

Transacted Hollowing - a PE injection technique, hybrid between ProcessHollowing and ProcessDoppelgänging

Antivirus software written in Python and C++ that blocks threats through deep learning and behavioral monitoring!

Malware Data Science Reading Diary / Notes

POC of a better implementation of GetProcAddress for ntdll using binary search

A Malware classifier dataset built with header fields’ values of Portable Executable files

PE Binary Shellcode Injector - Automated code cave discovery, shellcode injection, ASLR bypass, x86/x64 compatible

A Machine Learning approach for classifying a file as Malicious or Legitimate

Small visualizator for PE files

Herpaderply Hollowing - a PE injection technique, hybrid between Process Hollowing and Process Herpaderping

Dump certificates from PE files in different formats

A malware dataset curation tool which helps identify packed samples.

Detecting Malware in PE files

ProcessGhosting 技术的 rust 实现版本

Golang port of pefile

This project is Malware detection API using ML and CNN techniques

[IN THE WORKS] Python script designed to provide comprehensive analysis of malware samples, combining static and dynamic analysis techniques to analyse the behaviour and characteristics of analysed malware. Utilises PEfile library and PyREBox (VM sandbox)

Hex Workshop editor's structure library for the Microsoft's Portable Executable format.

HexSpell is an open-source library written in Rust, designed to parse and manipulate executable files, DLLs, and more with minimal dependency overhead.

A small tool to patch PE files' import address table with an external payload DLL.

Library for executable/object files parsing(include PE version info, virtual memory), in Kotlin multiplatform.

Malice PExecutable Plugin

This project analyzes PE information of exe files to detect malware. In this repository you will learn how to create your own dataset and will be able to see the use of machine learning models using the dataset. We will use machine learning for detect malware.

My personal PE Fixer that allows you to patch a raw PE dump to a fully patched and working PE dump that will help your analysis.

process dumper

Pypy.js compatible version of pefile.py for use in offline browser implementation

View and edit Portable Exexutable (PE) files.