hasherezade

Portable Executable parsing library (from PE-bear)

hasherezade

Persistent IAT hooking application - based on bearparser

hasherezade

Materials for Windows Malware Analysis training (volume 1)

hasherezade

Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).

hasherezade

Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).

hasherezade

Demos of various injection techniques found in malware

hasherezade

Converts PE into a shellcode

hasherezade

A library to load, manipulate, dump PE files. See also: https://github.com/hasherezade/libpeconv_tpl

hasherezade

Converts a DLL into EXE

hasherezade

A more stealthy variant of "DLL hollowing"

hasherezade