al-khaser
GPL-2.0🧬 Reverse Engineering · C++
al-khaser is a proof-of-concept application that implements numerous malware evasion techniques in a single codebase. It serves as a reference for security researchers studying how malware detects virtual machines, sandboxes, debuggers, and analysis environments. Techniques include timing attacks, CPU feature detection, registry checks, process enumeration, hardware fingerprinting, and API hooking detection. Each technique is implemented, documented, and testable independently. Security teams use al-khaser to validate that their analysis environments and sandboxes are resistant to common evasion methods employed by real-world malware.
Installation
$ git clone https://github.com/LordNoteworthy/al-khaser.gitUse Cases
- Testing sandbox and VM detection resistance
- Studying malware evasion techniques
- Validating analysis environment stealth
- Reference implementation for anti-analysis research
Tags
Details
- Category
- 🧬 Reverse Engineering
- Language
- C++
- Repository
- LordNoteworthy/al-khaser
- License
- GPL-2.0
- Platforms
- 🪟windows
Links
Community Reviews
Alternatives & Comparisons
capa
PythonAutomatically identify capabilities in executable files - detects techniques like persistence, C2, and anti-analysis.
Compare al-khaser vs capaMore in Reverse Engineering
dnSpy
C#.NET debugger, decompiler, and assembly editor. Inspect and modify .NET and Unity assemblies without source code.
ILSpy
C#Open-source .NET decompiler and assembly browser. Produces clean C# from compiled binaries with cross-platform support.
x64dbg
C++Open-source x64/x32 debugger for Windows. Full-featured binary debugger with plugin ecosystem for malware analysis and reverse engineering.
Detect It Easy
C++/QtBinary packer and compiler detection. Identifies compilers, linkers, packers, and protectors used to build PE, ELF, and Mach-O files.
angr
PythonBinary analysis framework. Symbolic execution, CFG recovery, and vulnerability discovery for compiled binaries in Python.
RetDec
C++Retargetable decompiler by Avast. Converts machine code back to C from x86, ARM, MIPS, and PowerPC binaries.