pefile

PE Tools - Portable executable (PE) manipulation toolkit

Automatic and platform-independent unpacker for Windows binaries based on emulation

Process Ghosting - a PE injection technique, similar to Process Doppelgänging, but using a delete-pending file instead of a transacted file

Portable Executable (PE) library written in .Net

Transacted Hollowing - a PE injection technique, hybrid between ProcessHollowing and ProcessDoppelgänging

Python Antivirus Software

Malware Data Science Reading Diary / Notes

POC of a better implementation of GetProcAddress for ntdll using binary search

A Malware classifier dataset built with header fields’ values of Portable Executable files

A Machine Learning approach for classifying a file as Malicious or Legitimate

PE Binary Shellcode Injector - Automated code cave discovery, shellcode injection, ASLR bypass, x86/x64 compatible

Small visualizator for PE files

Herpaderply Hollowing - a PE injection technique, hybrid between Process Hollowing and Process Herpaderping

Dump certificates from PE files in different formats

A malware dataset curation tool which helps identify packed samples.

ProcessGhosting 技术的 rust 实现版本

Detecting Malware in PE files

This project is Malware detection API using ML and CNN techniques

Golang port of pefile

Hex Workshop editor's structure library for the Microsoft's Portable Executable format.