Mars is a cross-platform network component developed by WeChat.

Extract and decrypt browser data, supporting multiple data types, runnable on various operating systems (macOS, Windows, Linux).

A free, powerful, multi-purpose tool that helps you monitor system resources, debug software and detect malware. Brought to you by Winsider Seminars & Solutions, Inc. @ http://www.windows-internals…

Remove AV/EDR Kernel ObRegisterCallbacks、CmRegisterCallback、MiniFilter Callback、PsSetCreateProcessNotifyRoutine Callback、PsSetCreateThreadNotifyRoutine Callback、PsSetLoadImageNotifyRoutine Callback...

macOS system monitor in your menu bar

OverSight monitors a mac's mic and webcam, alerting the user when the internal mic is activated, or whenever a process accesses the webcam.

The Ultimate iOS Crash Reporter

A command line tool for pstree-like output on macOS with additional pid capturing capabilities

A binary authorization system for macOS

🚀 Awesome list of open source applications for macOS. https://t.me/s/opensourcemacosapps

 A curated list of awesome applications, softwares, tools and shiny things for macOS.

Defences against Cobalt Strike

A C++ Yara Rule Runner

Process Monitor Library (based on Apple's new Endpoint Security Framework)

40行代码检测到大部分CobaltStrike的shellcode

An app to protect against process injection and suspicious file links on macOS

Using ftrace for function hooking in Linux kernel

A simple auditing utility for macOS

检测绝大部分所谓的内存免杀马

High Performance TCP/UDP/HTTP Communication Component

HTTP load generator, ApacheBench (ab) replacement, formerly known as rakyll/boom

C++ IPC Library: A high-performance inter-process communication using shared memory on Linux/Windows.

linux kernel inline hook framework for arm32 and arm64

Linux棋牌游戏服务器框架，支持TCP、websocket、http、lua。游戏开发，支持网狐、红鸟、火妹等等直接移植，只需改少量代码。

适用于C++异常捕获的一个实现方法。里面包含两部分，捕捉异常堆栈信息StackWalk和输出log，两部分都源自git，经过整合，完成了将异常堆栈信息输出到log的目的。

Phantom DLL hollowing PoC

A simple example application to collect DNS queries logs using etw-api

记录游戏逆向的分析过程

Source code of the TunSafe client