williballenthin/python-evt

Stars
46
Rank 613,923 (Top 13 %)
Language
Python
License
Apache License 2.0
Created almost 10 years ago
Updated over 1 year ago

williballenthin/python-evt

williballenthin

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Pure Python parser for classic Windows Event Log files (.evt)

python-evtx

Pure Python parser for Windows Event Log files (.evtx)

python-idb

Pure Python parser and analyzer for IDA Pro database files (.idb).

python-registry

Pure Python parser for Windows Registry hives.

INDXParse

Tool suite for inspecting NTFS artifacts.

EVTXtract

EVTXtract recovers and reconstructs fragments of EVTX log files from raw binary data, including unallocated space and memory images.

shellbags

Cross-platform, open-source shellbag parser

process-forest

Reconstruct process trees from event logs

idawilli

IDA Pro resources, scripts, and configurations

python-sdb

Pure Python parser for Application Compatibility Shim Databases (.sdb files)

lancelot

intel x86(-64) code analysis library that reconstructs control flow

python-ntfs

Open source Python library for NTFS analysis

ida-netnode

Humane API for storing and accessing persistent data in IDA Pro databases

govt

Virustotal API for Go

python-dotnet-binaryformat

Pure Python parser for data encoded by .NET's BinaryFormatter

go-reversing

Resources for reverse engineering Go binaries

python-vb

analysis of visual basic code

LfLe

Recover event log entries from an image by heurisitically looking for record structures.

viv-utils

Utilities for working with vivisect

ida-settings

Fetch and set configuration values from IDAPython scripts

wevt_template

extract and parse WEVT_TEMPLATEs from PE files

Autopsy-WindowsRegistryContentViewer

no longer maintained

reversing-clj

messing around writing reversing tools in clojure

Autopsy-WindowsRegistryIngestModule

no longer maintained

siglib

function identification signatures

python-pyqt5-hexview

PyQt5 hex viewer widget.

ucutils

Convenience routines for working with the Unicorn emulator in Python

python-pyqt5-vstructui

PyQt5 vstruct hex viewer widget.

Rejistry

Pure Java parser for Windows Registry hive files.

vivisect-vstruct

standalone copy of vstruct from vivisect

dotfiles

Local configuration files for various Linux tools

williballenthin.com

Source for my personal website

zydis-wasm

example project with zydis targetting wasm

cfg-ui

experiments in user interfaces around control flow graphs

highlighter-minor-mode

An Emacs minor mode for log analysis.