A FREE comprehensive reverse engineering tutorial covering x86, x64, 32-bit/64-bit ARM, 8-bit AVR and 32-bit RISC-V architectures.

File formats dissections and more...

📖 An approachable introduction to Assembly.

Virtual Apollo Guidance Computer (AGC) software

Materials for Windows Malware Analysis training (volume 1)

AV/EDR evasion via direct system calls.

AV/EDR evasion via direct system calls.

Template-Driven AV/EDR Evasion Framework

Windows x64 handcrafted token stealing kernel-mode shellcode

A C2 post-exploitation framework

A small, null-free Windows shellcode that executes calc.exe (x86/x64, all OS/SPs)

Just another Windows Process Injection

X86 version of syswhispers2 / x86 direct system call

Tool for working with Direct System Calls in Cobalt Strike's Beacon Object Files (BOF)

Managed assembly shellcode generation

A technique of hiding malicious shellcode via Shannon encoding.

EvilVM compiler for information security research tools.

A C library and binary for generating machine code of x86_64 assembly language and executing on the fly without invoking another compiler, assembler or linker.

Tool for working with Direct System Calls in Cobalt Strike's Beacon Object Files (BOF) via Syswhispers2

A very proof-of-concept port of InlineWhispers for using syscalls in Nim projects.

Fast and Secure Tunnelling Daemon

Simple 32/64-bit PEs loader.

A simple PoC to invoke an encrypted shellcode by using an hidden call

An example of how x64 kernel shellcode can dynamically find and use APIs

Simple project using syscalls (via Syswhispers2) to execute MessageBox shellcode.

Windows Reverse Shell shellcode

Educational repository for learning about rootkits and Windows Kernel Hooks.

Various tools, PoCs and experiments related to my blog at https://www.forrest-orr.net/

AV/EDR evasion via direct system calls.