pefile

PE Tools - Portable executable (PE) manipulation toolkit

Automatic and platform-independent unpacker for Windows binaries based on emulation

Process Ghosting - a PE injection technique, similar to Process Doppelgänging, but using a delete-pending file instead of a transacted file

Portable Executable (PE) library written in .Net

Transacted Hollowing - a PE injection technique, hybrid between ProcessHollowing and ProcessDoppelgänging

Antivirus software written in Python and C that blocks threats through deep learning and behavioral monitoring!

Malware Data Science Reading Diary / Notes

POC of a better implementation of GetProcAddress for ntdll using binary search

A Malware classifier dataset built with header fields’ values of Portable Executable files

PE Binary Shellcode Injector - Automated code cave discovery, shellcode injection, ASLR bypass, x86/x64 compatible

A Machine Learning approach for classifying a file as Malicious or Legitimate

Small visualizator for PE files

Herpaderply Hollowing - a PE injection technique, hybrid between Process Hollowing and Process Herpaderping

Dump certificates from PE files in different formats

A malware dataset curation tool which helps identify packed samples.

Detecting Malware in PE files

This project is Malware detection API using ML and CNN techniques

ProcessGhosting 技术的 rust 实现版本

Golang port of pefile

Hex Workshop editor's structure library for the Microsoft's Portable Executable format.