Dreg

Senior Malware Researcher, OS Internals, C/C++, assembler, reversing, forensics, hardware hacking, x86_64, AVR, ARM & PIC

Projects

lldb_reversing

Dreg's setup for lldb reversing. The simplest and easiest possible, without scripting. lldb debugging setup.

Released: 01 May 2024 - 6

The-GTK-Keylogger

The GTK Keylogger

C - Released: 17 Jan 2018 - 18

emuhookdetector

hook detector using emulation and comparing static with dynamic outputs

C - Released: 09 Jun 2018 - 17

symseghelper

Helper scripts for windows debugging with symbols for Bochs and IDA Pro (PDB files). Very handy for user mode <--> kernel mode

Python - Released: 27 Jul 2022 - 18

flashrom_build_windows_x64

Dreg's fork flashrom special edition for Buzzpirat & bus pirate. Windows x64 raiden_debug_spi, ft2232_spi, serprog, buspirate_spi, dediprog, developerbox, pony_spi, usbblaster_spi, pickit2_spi, ch341a_spi, ch347_spi, digilent_spi, stlinkv3_spi, dirtyjtag_spi. x32 build is included.

C - Released: 29 Jul 2023 - 15

Win.Cerdalux

WinXPSP2.Cermalus on stereoids, supporting all 32 bits Windows version. Windows Kernel Virus stuff for noobs

Assembly - Released: 15 Jul 2023 - 15

pdbdump_bochs

Dump PDB Symbols including support for Bochs Debugging Format (with wine support)

C - Released: 26 Jul 2022 - 15

WinXPSP2.Cermalus

Malware WinXPSP2.Cermalus Windows Kernel Virus

Assembly - Released: 26 May 2017 - 14

PatchPae2_PatchPae3

PatchPae2 by wj32 and PatchPae3 by evgeny

C - Released: 12 Nov 2018 - 14

MSKLC-Michael-Scott-Kaplan-blog

MSKLC Michael Scott Kaplan blog

HTML - Released: 25 May 2017 - 7

ptrace_misconfiguration_local_privilege_escalation

ptrace misconfiguration Local Privilege Escalation

C - Released: 16 Nov 2020 - 10

dregshells

dregshells

Assembly - Released: 09 Dec 2020 - 9

nasm_vscode

nasm visual studio code

Shell - Released: 14 Dec 2020 - 9

oldrootkitweb

rootkit.es site

SCSS - Released: 15 Jul 2023 - 2

r2-syscall-printer

I created r2-syscall-printer (radare r2pipe script) because I need now Linux-kernel interface call convention support (x86 & x86_64): %rdi, %rsi, %rdx, %r10, %r8, %r9. Also you can use this tool as standalone-app to print syscall table info

Python - Released: 27 Nov 2020 - 6

lufa-sdcard-mass-storagekeyboard-fatfs-AT90USBKEY2

lufa-sdcard-mass-storagekeyboard-fatfs-AT90USBKEY2

C - Released: 18 Feb 2020 - 6

drx_ptrace_shellcode_injector

drx ptrace shellcode injector

C - Released: 17 Nov 2020 - 6

bochs-bed

Bochs Enhaced Debugger (bochs-bed). A modern console debug experience.

C++ - Released: 18 Jul 2022 - 5

ringstepper

windbg plugin easy-step from user code to kernel code

C - Released: 05 Oct 2020 - 5

rpk2

rpk2

C - Released: 13 Dec 2021 - 5

autobuspirateupgrade

automate bootloader+firmware+update+self_test on bus pirate v3 with arduino and python. Firmware 7.1 bootloader 4.5

Python - Released: 12 Aug 2023 - 4

BZub.CX-Malware-Reversing

BZub.CX Malware Reversing

HTML - Released: 26 May 2017 - 4

getproclib

Library for Windows Run-Time Dynamic Linking.

C - Released: 06 Jul 2015 - 4