PINdemonium
A Windows malware unpacker using Intel PIN for dynamic binary instrumentation and Scylla for import reconstruction.
What is PINdemonium?
PINdemonium is a Windows malware unpacker that uses Intel PIN for dynamic binary instrumentation to trace and dump unpacked code from packed executables. It automatically reconstructs the Import Address Table using Scylla and integrates Yara for rule-based detection of packers and malware families. The tool helps security analysts extract and analyze the original payload from obfuscated malware.
Malware analysts, reverse engineers, and security researchers who need to unpack and analyze packed Windows executables, particularly in forensic or threat intelligence contexts.
PINdemonium combines the power of Intel PIN's instrumentation with Scylla's IAT reconstruction in an automated workflow, reducing manual effort in malware unpacking. Its plugin system and heuristic-based dumping make it adaptable to various packing techniques encountered in real-world malware.
Overview
A pintool in order to unpack malware
Use Cases
Best For
- Unpacking malware samples protected by common packers like UPX, ASProtect, or Themida
Related Projects
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
