Software
TrueCyber builds practical Windows tooling for offensive security work - software that lets you see exactly what an application is doing under the hood. Here is everything available right now.
inject · intercept · modify · capture
A Windows network-hooking framework that captures, inspects and rewrites a process's traffic before it is encrypted. Covers OpenSSL, Schannel, GnuTLS, wolfSSL, NSS, WinSock, WinINet, WinHTTP and File I/O - ideal for thick-client testing and applications that are not proxy-aware.
trace · inspect · understand
Trace Windows process calls and their arguments to better understand how an application behaves and executes. CallHook surfaces the API calls a target makes in real time - invaluable for reverse engineering, debugging and mapping an application's behaviour.
binary · text · function & string diff
Diff two files and see exactly what changed - function by function, instruction by instruction. TrueDiffing pairs binary diffing, with opcode bytes, disassembly and control-flow graphs, with line-by-line text diffing, so patch analysis and build comparison happen in one place.
audit · decode · trace
A Windows driver IOCTL auditor. DriverDiscovery statically analyses WDM, WDF, NDIS and minifilter drivers, decodes every CTL_CODE into its device type, access, method and function, traces dispatch handlers through switch tables and if-else chains, and reverses XOR/ADD/AND arithmetic obfuscation to recover the real IOCTL values.
enumerate · search · resolve
Free software. Lists the export table of any Windows DLL - named and ordinal-only exports and forwarders - and searches a whole folder for a given export by name. It only reads files: it never loads or executes the DLLs it inspects.
NetHook, CallHook, TrueDiffing and DriverDiscovery each install a command-line companion right next to the GUI - same engine, same license, no window. Script it, pipe it, run it headless over SSH.
Get notified when we release new tools and updates. Subscribe to the TrueCyber newsletter →