Projects in Awesome Lists by hasherezade

https://github.com/hasherezade/pe-sieve

Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).

anti-malware hooking libpeconv malware-analysis memory-forensics pe-analyzer pe-dumper pe-format pe-sieve process-analyzer scans

Last synced: 13 May 2025

https://github.com/hasherezade/pe-bear

Portable Executable reversing tool with a friendly GUI

bearparser malware-analysis multiplatform pe-analyzer pe-analyzer-gui pe-editor pe-file pe-format

Last synced: 14 May 2025

https://github.com/hasherezade/pe_to_shellcode

Converts PE into a shellcode

pe-file pe-to-shellcode pe2shc pe2shellcode shellcode shellcode-development

Last synced: 15 May 2025

https://github.com/hasherezade/hollows_hunter

Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).

anti-malware malware-analysis malware-detection memory-forensics pe-sieve

Last synced: 14 May 2025

https://github.com/hasherezade/malware_training_vol1

Materials for Windows Malware Analysis training (volume 1)

malware-analysis malware-research windows-malware-analysis

Last synced: 15 May 2025

https://github.com/hasherezade/tiny_tracer

A Pin Tool for tracing API calls etc

api-trace dbi intel-pintools malware-analysis reverse-engineering

Last synced: 28 May 2026

https://github.com/hasherezade/exe_to_dll

Converts a EXE into DLL

Last synced: 08 Oct 2025

https://github.com/hasherezade/libpeconv

A library to load, manipulate, dump PE files. See also: https://github.com/hasherezade/libpeconv_tpl

libpeconv manual-mapping pe-file pe-format pe-loader

Last synced: 13 Apr 2025

https://github.com/hasherezade/dll_to_exe

Converts a DLL into EXE

dll-to-exe dll2exe libpeconv pe-file

Last synced: 04 Apr 2025

https://github.com/hasherezade/demos

Demos of various injection techniques found in malware

code-injection dll-injection malware process-hollowing runpe

Last synced: 24 Oct 2025

https://github.com/hasherezade/pe-bear-releases

PE-bear (builds only)

pe-analyzer pe-editor pe-format

Last synced: 04 Apr 2025

https://github.com/hasherezade/mal_unpack

Dynamic unpacker based on PE-sieve

libpeconv malware-analysis malware-unpacker memory-forensics pe-sieve

Last synced: 15 May 2025

https://github.com/hasherezade/bearparser

Portable Executable parsing library (from PE-bear)

bearparser multiplatform parser-library pe

Last synced: 15 May 2025

https://github.com/hasherezade/process_ghosting

Process Ghosting - a PE injection technique, similar to Process Doppelgänging, but using a delete-pending file instead of a transacted file

pe-injection pe-injector pefile

Last synced: 04 Apr 2025

https://github.com/hasherezade/process_doppelganging

My implementation of enSilo's Process Doppelganging (PE injection technique)

malware pe-injector process-doppelganging

Last synced: 04 Apr 2025

https://github.com/hasherezade/transacted_hollowing

Transacted Hollowing - a PE injection technique, hybrid between ProcessHollowing and ProcessDoppelgänging

code-injection malware pe-injector pefile

Last synced: 05 Apr 2025

https://github.com/hasherezade/ida_ifl

IFL - Interactive Functions List (plugin for IDA Pro)

ida-plugin ida-pro idapython-plugin

Last synced: 15 May 2025

https://github.com/hasherezade/malware_analysis

Various snippets created during malware analysis

malware malware-analysis trickbot

Last synced: 05 Apr 2025

https://github.com/hasherezade/process_overwriting

Yet another variant of Process Hollowing

Last synced: 16 May 2025

https://github.com/hasherezade/module_overloading

A more stealthy variant of "DLL hollowing"

pe-injector process-hollowing

Last synced: 06 Apr 2025

https://github.com/hasherezade/iat_patcher

Persistent IAT hooking application - based on bearparser

bearparser hooking iat iat-hooking multiplatform pe pe-file pe-format

Last synced: 04 Jul 2025

https://github.com/hasherezade/thread_namecalling

Process Injection using Thread Name

processinjection redteam shellcode-injection shellcode-injector

Last synced: 07 Apr 2025

https://github.com/hasherezade/persistence_demos

Demos of various (also non standard) persistence methods used by malware

Last synced: 15 Feb 2026

https://github.com/hasherezade/chimera_pe

ChimeraPE (a PE injector type - alternative to: RunPE, ReflectiveLoader, etc) - a template for manual loading of EXE, loading imports payload-side

pe-injector reflectiveloader runpe

Last synced: 09 Apr 2025

https://github.com/hasherezade/masm_shc

A helper utility for creating shellcodes. Cleans MASM file generated by MSVC, gives refactoring hints.

shellcode shellcode-development

Last synced: 04 Apr 2025

https://github.com/hasherezade/shellconv

Small tool for disassembling shellcode (using objdump)

Last synced: 25 Mar 2025

https://github.com/hasherezade/dll_injector

A simple commandline injector using classic DLL injection

dll-injection dll-injector hooking injector

Last synced: 25 Mar 2025

https://github.com/hasherezade/password_scrambler

Password scrambler - a deterministic password re-generator (alternative to a password manager)

Last synced: 25 Mar 2025

https://github.com/hasherezade/antianalysis_demos

Set of antianalysis techniques found in malware

antidebug malware malware-evasion

Last synced: 25 Mar 2025

https://github.com/hasherezade/funky_malware_formats

Parsers for custom malware formats ("Funky malware formats")

Last synced: 25 Mar 2025

https://github.com/hasherezade/process_chameleon

A process overwriting its own PEB to make an illusion that it has been loaded from a different path.

Last synced: 15 Jun 2025

https://github.com/hasherezade/mal_unpack_drv

MalUnpack companion driver

Last synced: 16 Aug 2025

https://github.com/hasherezade/pe_unmapper

Small tool to convert beteween the PE alignments (raw and virtual).

Last synced: 25 Mar 2025

https://github.com/hasherezade/ViDi

ViDi Visual Disassembler (experimental)

bearparser disassembler multiplatform pe-file

Last synced: 17 Apr 2026

https://github.com/hasherezade/crypto_utils

Set of my small utils related to cryptography, encoding, decoding etc

Last synced: 25 Mar 2025

https://github.com/hasherezade/vidi

ViDi Visual Disassembler (experimental)

bearparser disassembler multiplatform pe-file

Last synced: 25 Mar 2025

https://github.com/hasherezade/pe2pic

Small visualizator for PE files

malware-analysis pe-file pe-format pefile visualization

Last synced: 14 Oct 2025

https://github.com/hasherezade/pin_n_sieve

An experimental dynamic malware unpacker based on Intel Pin and PE-sieve

Last synced: 09 May 2025

https://github.com/hasherezade/paramkit

A small library helping to parse commandline parameters (for C/C++)

argument-parser argument-parsing arguments cli-args command-line command-line-parser parameters

Last synced: 25 Mar 2025

https://github.com/hasherezade/petya_key

A decoder for Petya victim keys, using the Janus' masterkey.

petya ransomware

Last synced: 25 Mar 2025

https://github.com/hasherezade/petya_recovery

Application for cracking Red Petya key based on genetic algorithms.

petya petya-red ransomware

Last synced: 25 Mar 2025

https://github.com/hasherezade/libpeconv_tpl

A ready-made template for a project based on libpeconv.

libpeconv

Last synced: 16 Aug 2025

https://github.com/hasherezade/shellc_encoder

Standalone Metasploit-like XOR encoder for shellcode

Last synced: 25 Mar 2025

https://github.com/hasherezade/pesieve-go

Golang bindings for PE-sieve

Last synced: 25 Mar 2025

https://github.com/hasherezade/hidden_bee_tools

Parser for a custom executable format from Hidden Bee malware (first stage)

Last synced: 16 Jun 2025

https://github.com/hasherezade/sig_finder

Signature finder (from PE-bear)

pattern-matching pattern-searching

Last synced: 07 Mar 2026

https://github.com/hasherezade/mal_sort

Various scripts helpful in sorting collections of malware samples.

Last synced: 06 Aug 2025

https://github.com/hasherezade/flareon2019

Flare-On solutions

Last synced: 25 Mar 2025

https://github.com/hasherezade/iat_patcher_samples

Sample libraries to be used with IAT Patcher

Last synced: 25 Mar 2025

https://github.com/hasherezade/pe_utils

A set of small utilities, helpers for PIN tracers

Last synced: 25 Mar 2025

https://github.com/hasherezade/mal_unpack_py

Python wrappers for mal_unpack

Last synced: 25 Mar 2025

https://github.com/hasherezade/decryptors_archive

Archive of ransomware decryptors

Last synced: 07 Mar 2026

https://github.com/hasherezade/flareon2022

Last synced: 25 Mar 2025

https://github.com/hasherezade/flareon2023

Last synced: 23 Jul 2025

https://github.com/hasherezade/petya_green

Application for random attack on Green Petya's key

petya petya-green ransomware

Last synced: 06 Oct 2025

https://github.com/hasherezade/asm16_projects

My small projects writen in 16 bit asm (NOTE: those are my practice projects that I wrote when I was 15, I give no warranty for this code!)

16-bit 16bit 16bits ascii-art tasm

Last synced: 25 Mar 2025

Last synced: 04 Apr 2025

https://github.com/hasherezade/loaderine

A demo implementation of a well-known technique used by some malware to evade userland hooking, using my library: libpeconv.

libpeconv

Last synced: 25 Mar 2025

https://github.com/hasherezade/jpassword_scrambler

Small utility to generate complicated passwords - version with GUI

password-generator password-manager

Last synced: 13 Jun 2025

Last synced: 28 Feb 2026