msdocsviewer is a simple tool that parses Microsoft's win32 API and driver documentation to be used within IDA. - alexander-hanel/msdocsviewer

Explore this post and more from the MalwareAnalysis community

﷽

﷽

A YARA & Malware Analysis Toolkit written in Rust. - dwmetz/MalChela

Process Injection without R/W target memory and without creating a remote thread - Maff1t/InjectNtdllPOC

By Seth Jenkins, Project ZeroIntroductionIn December 2022, Google’s Threat Analysis Group (TAG) discovered an in-the-wild exploit chain targeting Samsu...

Rusty Bootkit - Windows UEFI Bootkit in Rust (Codename: RedLotus) - memN0ps/redlotus-rs

A list of awesome resources about HyperDbg. Contribute to HyperDbg/awesome development by creating an account on GitHub.

Open Source EDR for Windows. Contribute to 0xrawsec/whids development by creating an account on GitHub.

In this article we will see how Windows drivers work, how to create one and, in the end, we will develope a custom EDR that will rely on kernel callback functions, static analysis and API hooking.

FirmWire is a full-system baseband firmware emulation platform for fuzzing, debugging, and root-cause analysis of smartphone baseband firmwares - FirmWire/FirmWire

This post is an addendum to my journey to discover and verify the internals of ALPC, which I've documented in Offensive Windows IPC Internals 3: ALPC. While preparing this blog I figured a second post, explaining the debugging steps I took to verify and discover…

Study of an Android runtime (ART) hijacking mechanism for bytecode injection through a step-by-step analysis of the packer used to protect the DJI Pilot Android application.

Generating legitimate call stack frame along with indirect syscalls by abusing Vectored Exception Handling (VEH) to bypass User-Land EDR hooks in Windows.