Discover @williballenthin Open Source projects

Willi Ballenthin (@williballenthin)

williballenthin

Stars
3,197
Global Rank 9,156 (Top 0.4 %)
Followers 985
Following 62
Registered almost 15 years ago
Most used languages

Python
65.7 %

Rust
8.6 %

JavaScript
8.6 %

Java
8.6 %

Shell
2.9 %

Go
2.9 %

Emacs Lisp
2.9 %

python-evtx

Pure Python parser for Windows Event Log files (.evtx)

python-idb

Pure Python parser and analyzer for IDA Pro database files (.idb).

python-registry

Pure Python parser for Windows Registry hives.

INDXParse

Tool suite for inspecting NTFS artifacts.

EVTXtract

EVTXtract recovers and reconstructs fragments of EVTX log files from raw binary data, including unallocated space and memory images.

shellbags

Cross-platform, open-source shellbag parser

process-forest

Reconstruct process trees from event logs

idawilli

IDA Pro resources, scripts, and configurations

python-sdb

Pure Python parser for Application Compatibility Shim Databases (.sdb files)

lancelot

intel x86(-64) code analysis library that reconstructs control flow

python-ntfs

Open source Python library for NTFS analysis

ida-netnode

Humane API for storing and accessing persistent data in IDA Pro databases

govt

Virustotal API for Go

python-dotnet-binaryformat

Pure Python parser for data encoded by .NET's BinaryFormatter

python-evt

Pure Python parser for classic Windows Event Log files (.evt)

go-reversing

Resources for reverse engineering Go binaries

python-vb

analysis of visual basic code

LfLe

Recover event log entries from an image by heurisitically looking for record structures.

viv-utils

Utilities for working with vivisect

ida-settings

Fetch and set configuration values from IDAPython scripts

wevt_template

extract and parse WEVT_TEMPLATEs from PE files

Autopsy-WindowsRegistryContentViewer

no longer maintained

reversing-clj

messing around writing reversing tools in clojure

Autopsy-WindowsRegistryIngestModule

no longer maintained

siglib

function identification signatures

python-pyqt5-hexview

PyQt5 hex viewer widget.

ucutils

Convenience routines for working with the Unicorn emulator in Python

python-pyqt5-vstructui

PyQt5 vstruct hex viewer widget.

Rejistry

Pure Java parser for Windows Registry hive files.

vivisect-vstruct

standalone copy of vstruct from vivisect

dotfiles

Local configuration files for various Linux tools

williballenthin.com

Source for my personal website

zydis-wasm

example project with zydis targetting wasm

cfg-ui

experiments in user interfaces around control flow graphs

highlighter-minor-mode

An Emacs minor mode for log analysis.