anti-analysis

Phoenix-Evasion-Research Framework is an advanced educational platform designed for cybersecurity researchers, red teams, and defensive security professionals. This framework demonstrates modern evasion techniques to help security practitioners understand, analyze, and improve defensive capabilities

yes, some of them do not contain the literal string 'wine'

Changes behavior once observed

A metamorphic crypter

Modular crypter/packer for Windows PE files. Reflective loading, API hashing, anti-VM/debug/sandbox, XOR encryption, polymorphism. Reduces AV detections by up to 64%. Educational use only.

Attempts to trick malware using techniques from NavyTitanium/Fake-Sandbox-Artifacts

CLI for building statically patched DeArxan executables

Advanced memory evasion PoC that cyclically encrypts shellcode and fluctuates between RW/NoAccess and RX memory protections to bypass memory scanners like Moneta and PE-Sieve.

ESET CrackMe Analysis

A high-performance stealth Reflective ELF-Launcher for Linux binaries. Protections, Encrypts, Compresses, and executes ELF payloads directly from RAM with zero disk footprint.

Builder for analysis-aware Windows droppers

#seccamp 2014 CTF softsec (Reverse 400pt)

Documentation including tools and techniques learned during development of ThirdEye.

A high-performance stealth Reflective EFI-Loader for UEFI binaries. Protections, Encrypts, Compresses, and executes EFI payloads directly from RAM with zero disk footprint.

Assembly offensive lab focused on code obfuscation, unpacking, and evasion techniques for x86/x64 malware development and reverse engineering.

[Incomplete] Various .NET Anti-Debug and Anti-VM techniques

A high-performance stealth Reflective PE-Loader for Windows binaries. Protections, Encrypts, Compresses, and executes EXE and DLL payloads directly from RAM with zero disk footprint.

C++ Portable compile-time syscall tables & direct syscalls on Windows. (x86_64 & Wow64)

FileRedirector