A FREE comprehensive reverse engineering tutorial covering x86, x64, 32-bit ARM & 64-bit ARM architectures.

File formats dissections and more...

Materials for Windows Malware Analysis training (volume 1)

AV/EDR evasion via direct system calls.

AV/EDR evasion via direct system calls.

Proof of Concepts (PE, PDF...)

MOVED TO: https://cirosantilli.com/linux-kernel-module-cheat/userland-assembly with code at https://github.com/cirosantilli/linux-kernel-module-cheat/tree/master/userland/arch/x86_64 SEE README. x8…

Architectural privilege escalation on x86

Source code for 'Low-Level Programming' by Igor Zhirkov

Just another Windows Process Injection

windows syscall table from xp ~ 10 rs4

KeyGen for 010 Editor

X86 version of syswhispers2 / x86 direct system call

Simple 32/64-bit PEs loader.

Semantics of x86-64 in K

Simple Polymorphic Engine (SPE32) is a simple polymorphic engine for encrypting code and data. It is an amateur project that can be used to demonstrate what polymorphic engines are.

Assembly block for hooking windows API functions.

ASM Malicious code - PE infector

Assembly block for finding and calling the windows API functions inside import address table(IAT) of the running PE file.

C/C++ machine code obfuscation.

APISearch Plugin (x86) - A Plugin For x64dbg

APIInfo Plugin (x86) - A Plugin For x64dbg

A radare2 Python script to dump a raw IA32 binary to an NASM source file