Skip to content

Latest commit

 

History

History
executable file
·
615 lines (586 loc) · 73 KB

RE.md

File metadata and controls

executable file
·
615 lines (586 loc) · 73 KB
Raw

Reverse Engineering

Table of Contents

http://ropgadget.com/posts/pebwalk.html

https://github.com/TakahiroHaruyama/ida_haru/tree/master/bindiff

https://blog.xpnsec.com/analysing-rpc-with-ghidra-neo4j/ http://kakaroto.homelinux.net/2017/11/introduction-to-reverse-engineering-and-assembly/ https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2019/june/advanced-frida-witchcraft-turning-an-android-application-into-a-voodoo-doll/

RE https://fkie-cad.github.io/FACT_core/ https://software.intel.com/en-us/articles/pin-a-dynamic-binary-instrumentation-tool https://dyninst.org/ https://drmemory.org/strace_for_windows.html https://www.frida.re/ http://dynamorio.org/ https://arxiv.org/pdf/1901.01161.pdf

PDF http://joxeankoret.com/blog/2010/02/21/analyzing-pdf-exploits-with-pyew/ https://blog.didierstevens.com/2008/10/30/pdf-parserpy/ http://blog.9bplus.com/ http://blog.9bplus.com/scoring-pdfs-based-on-malicious-filter/ http://honeynet.org/node/1304 https://itsjack.cc/blog/2017/08/analysingdetecting-malicious-pdfs-primer/ https://securityoversimplicity.wordpress.com/2017/09/28/not-all-she-wrote-part-1-rigged-pdfs/ https://digital-forensics.sans.org/blog/2009/12/14/pdf-malware-analysis/ https://blog.didierstevens.com/programs/pdf-tools/ https://blog.didierstevens.com/2009/03/31/pdfid/ https://www.cs.unm.edu/~eschulte/data/bed.pdf

General

  • 101
  • Articles/Blogposts
  • Educational
  • Timelines
    • Symbolic execution timeline
      • Diagram highlights some major tools and ideas of pure symbolic execution, dynamic symbolic execution (concolic) as well as related ideas of model checking, SAT/SMT solving, black-box fuzzing, taint data tracking, and other dynamic analysis techniques.
  • Videos
  • Things that Don't fit elsewhere
  • General Research/Stuff
    • TAMPER (Tamper And Monitoring Protection Engineering Research)
      • In the TAMPER Lab, we study existing security products, document how they have been penetrated in the past, develop new attack techniques, and try to forecast how newly available technologies will make it easier to bypass hardware security mechanisms. We then develop and evaluate new countermeasures and assist industrial designers in staying ahead of the game, most of all by giving them an advanced understanding of which attack techniques are most dangerous. We are especially interested in protection systems for mass-market applications, and in forensic applications.
  • General Tools
    • Binary Visualization Tools
      • binglide
        • binglide is a visual reverse engineering tool. It is designed to offer a quick overview of the different data types that are present in a file. This tool does not know about any particular file format, everything is done using the same analysis working on the data. This means it works even if headers are missing or corrupted or if the file format is unknown.
      • binvis.io
        • visual analysis of binary files
      • cantor.dust
        • a powerful, dynamic, interactive binary visualization tool
    • General
      • Binwalk
        • Binwalk is a fast, easy to use tool for analyzing, reverse engineering, and extracting firmware images.
      • Pip3line, the Swiss army knife of byte manipulation
        • Pip3line is a raw bytes manipulation utility, able to apply well known and less well known transformations from anywhere to anywhere (almost).
      • Frida
        • Inject JS into native apps
      • Binacle
        • Indexation "full-bin" of binary files
      • Construct2
        • Construct is a powerful declarative parser (and builder) for binary data. Instead of writing imperative code to parse a piece of data, you declaratively define a data structure that describes your data. As this data structure is not code, you can use it in one direction to parse data into Pythonic objects, and in the other direction, convert ("build") objects into binary data.
    • De/Obfuscators/Unpackers
      • de4dot
        • de4dot is an open source (GPLv3) .NET deobfuscator and unpacker written in C#. It will try its best to restore a packed and obfuscated assembly to almost the original assembly. Most of the obfuscation can be completely restored (eg. string encryption), but symbol renaming is impossible to restore since the original names aren't (usually) part of the obfuscated assembly.
      • Universal Extractor
        • Universal Extractor is a program designed to decompress and extract files from any type of archive or installer, such as ZIP or RAR files, self-extracting EXE files, application installers, etc
      • Stunnix C/C++ Obfuscator
      • asar
        • Simple extensive tar-like archive format with indexing
    • ELF/Related Tools
      • Rdis
        • Rdis is a Binary Analysis Tool for Linux.
      • readelf
        • Unix Tool
    • Emulators
    • Packers
      • UPX - the Ultimate Packer for eXecutables
        • UPX is an advanced executable file compressor. UPX will typically reduce the file size of programs and DLLs by around 50%-70%, thus reducing disk space, network load times, download times and other distribution and storage costs.
    • PE32/Related Tools
      • Dependency Walker
        • Dependency Walker is a free utility that scans any 32-bit or 64-bit Windows module (exe, dll, ocx, sys, etc.) and builds a hierarchical tree diagram of all dependent modules. For each module found, it lists all the functions that are exported by that module, and which of those functions are actually being called by other modules. Another view displays the minimum set of required files, along with detailed information about each file including a full path to the file, base address, version numbers, machine type, debug information, and more.
      • PPEE(puppy)
        • Professional PE file Explorer for reversers, malware researchers and those who want to statically inspect PE files in more details. Free and fast.
      • PEStudio
        • pestudio is a tool that performs the static analysis of 32-bit and 64-bit Windows executable files. Malicious executable attempts to hide its malicious intents and to evade detection. In doing so, it generally presents anomalies and suspicious patterns. The goal of pestudio is to detect these anomalies, provide indicators and score the executable being analyzed. Since the executable file being analyzed is never started, you can inspect any unknown or malicious executable with no risk.
      • PEview
        • PEview provides a quick and easy way to view the structure and content of 32-bit Portable Executable (PE) and Component Object File Format (COFF) files. This PE/COFF file viewer displays header, section, directory, import table, export table, and resource information within EXE, DLL, OBJ, LIB, DBG, and other file types.
    • OLE
      • python-oletools
        • python-oletools is a package of python tools to analyze Microsoft OLE2 files (also called Structured Storage, Compound File Binary Format or Compound Document File Format), such as Microsoft Office documents or Outlook messages, mainly for malware analysis, forensics and debugging. It is based on the olefile parser. See http://www.decalage.info/python/oletools for more info.
    • Searching Through Binaries
      • bingrep
        • Greps through binaries from various OSs and architectures, and colors them.
    • Static Analysis Tools
    • OS X
      • Instruments - OS X system analysis
        • Instruments is a performance-analysis and testing tool for dynamically tracing and profiling OS X and iOS code. It is a flexible and powerful tool that lets you track a process, collect data, and examine the collected data. In this way, Instruments helps you understand the behavior of both user apps and the operating system.
      • Reversing iOS/OS X
    • Linux
    • Windows
      • PolyHook - x86/x64 Hooking Library
        • Provides abstract C++ 11 interface for various hooking methods
      • EasyHook
        • EasyHook makes it possible to extend (via hooking) unmanaged code APIs with pure managed functions, from within a fully managed environment on 32- or 64-bit Windows XP SP2, Windows Vista x64, Windows Server 2008 x64, Windows 7, Windows 8.1, and Windows 10.
      • Microsoft Message Analyzer
        • Microsoft Message Analyzer is a new tool for capturing, displaying, and analyzing protocol messaging traffic and other system messages. Message Analyzer also enables you to import, aggregate, and analyze data from log and trace files. It is the successor to Microsoft Network Monitor 3.4 and a key component in the Protocol Engineering Framework (PEF) that was created by Microsoft for the improvement of protocol design, development, documentation, testing, and support. With Message Analyzer, you can choose to capture data live or load archived message collections from multiple data sources simultaneously.
      • API Monitor
        • API Monitor is a free software that lets you monitor and control API calls made by applications and services. Its a powerful tool for seeing how applications and services work or for tracking down problems that you have in your own applications.
      • SpyStudio
        • SpyStudio shows and interprets calls, displaying the results in a structured way which is easy for any IT professional to understand. SpyStudio can show registry keys and files that an application uses, COM objects and Windows the application has created, and errors and exceptions.
        • SpyStudio Tutorials
      • Fibratus
        • Fibratus is a tool which is able to capture the most of the Windows kernel activity - process/thread creation and termination, file system I/O, registry, network activity, DLL loading/unloading and much more. Fibratus has a very simple CLI which encapsulates the machinery to start the kernel event stream collector, set kernel event filters or run the lightweight Python modules called filaments. You can use filaments to extend Fibratus with your own arsenal of tools.
      • Deviare2
        • Deviare is a professional hooking engine for instrumenting arbitrary Win32 functions, COM objects, and functions whose symbols are located in program databases (PDBs). It can intercept unmanaged code in 32-bit and 64-bit applications. It is implemented as a COM component, so it can be integrated with all the programming languages which support COM, such as C/C++, VB, C#, Delphi, and Python.
      • Deviare In-Proc
        • Deviare In-Proc is a code interception engine for Microsoft Windows® developed by Nektra Advanced Computing. This library is at the core of our Deviare v2.0 and SpyStudio Application Monitor technologies. Deviare is an alternative to Microsoft Detours® but with a dual license distribution. The library is coded in C++ and provides all the facilities required to instrument binary libraries during runtime. It includes support for both 32 and 64 bit applications and it implements the interception verifying different situations that can crash the process. If you need to intercept any Win32 functions or any other code, this library makes it easier than ever. Unlike the rest of the libraries, Deviare In-Proc provides a safe mechanism to implement multi-threaded application API hooking. When an application is running, more than one thread can be executing the code being intercepted. Deviare In-Proc provides safe hooking even in this scenario.
  • Debuggers
    • All platforms
      • Voltron
        • Voltron is an extensible debugger UI toolkit written in Python. It aims to improve the user experience of various debuggers (LLDB, GDB, VDB and WinDbg) by enabling the attachment of utility views that can retrieve and display data from the debugger host. By running these views in other TTYs, you can build a customised debugger user interface to suit your needs.
      • GDB - GNU Debugger
        • GDB, the GNU Project debugger, allows you to see what is going on 'inside' another program while it executes -- or what another program was doing at the moment it crashed.
      • GDB Addons
        • PEDA
          • PEDA - Python Exploit Development Assistance for GDB
        • gdbgui
          • A modern, browser-based frontend to gdb (gnu debugger). Add breakpoints, view stack traces, and more in C, C++, Go, and Rust. Simply run gdbgui from the terminal and a new tab will open in your browser.
        • GEF - GDB Enhanced Features
          • GEF is aimed to be used mostly by exploiters and reverse-engineers. It provides additional features to GDB using the Python API to assist during the process of dynamic analysis or exploit development. Why not PEDA? Yes!! Why not?! PEDA is a fantastic tool to do the same, but is only to be used for x86-32 or x86-64. On the other hand, GEF supports all the architecture supported by GDB (x86, ARM, MIPS, PowerPC, SPARC, and so on).
          • Docs
      • edb
        • edb is a cross platform x86/x86-64 debugger. It was inspired by Ollydbg, but aims to function on x86 and x86-64 as well as multiple OS's. Linux is the only officially supported platform at the moment, but FreeBSD, OpenBSD, OSX and Windows ports are underway with varying degrees of functionality.
      • LLDB
        • LLDB is a next generation, high-performance debugger. It is built as a set of reusable components which highly leverage existing libraries in the larger LLVM Project, such as the Clang expression parser and LLVM disassembler. LLDB is the default debugger in Xcode on Mac OS X and supports debugging C, Objective-C and C++ on the desktop and iOS devices and simulator.
    • Linux
      • PulseDBG
        • Hypervisor-based debugger
      • xnippet
        • xnippet is a tool that lets you load code snippets or isolated functions (no matter the operating system they came from), pass parameters to it in several formats (signed decimal, string, unsigned hexadecimal...), hook other functions called by the snippet and analyze the result. The tool is written in a way that will let me improve it in a future, defining new calling conventions and output argument pointers.
    • OS X
    • Windows
      • OllyDbg
        • OllyDbg is a 32-bit assembler level analysing debugger for Microsoft® Windows®. Emphasis on binary code analysis makes it particularly useful in cases where source is unavailable.
        • OllyDbg Tricks for Exploit Development
      • WindDbg
      • Open Source Windows x86/x64 Debugger
      • HyperDbg
        • HyperDbg is a kernel debugger that leverages hardware-assisted virtualization. More precisely, HyperDbg is based on a minimalistic hypervisor that is installed while the system runs. Compared to traditional kernel debuggers (e.g., WinDbg, SoftIce, Rasta R0 Debugger) HyperDbg is completely transparent to the kernel and can be used to debug kernel code without the need of serial (or USB) cables. For example, HyperDbg allows to single step the execution of the kernel, even when the kernel is executing exception and interrupt handlers. Compared to traditional virtual machine based debuggers (e.g., the VMware builtin debugger), HyperDbg does not require the kernel to be run as a guest of a virtual machine, although it is as powerful.
        • Paper
    • Debugging Writeups/Papers
  • Decompilers & Disassemblers
    • General
      • IDA
        • IDA Pro combines an interactive, programmable, multi-processor disassembler coupled to a local and remote debugger and augmented by a complete plugin programming environment.
        • Overview & Tutorials
      • [fREedom](capstone based disassembler for extracting to binnavi )
        • fREedom is a primitive attempt to provide an IDA Pro independent means of extracting disassembly information from executables for use with binnavi (https://github.com/google/binnavi).
      • Hopper
        • Hopper is a reverse engineering tool for OS X and Linux, that lets you disassemble, decompile and debug your 32/64bits Intel Mac, Linux, Windows and iOS executables!
      • Reverse
        • Reverse engineering for x86 binaries (elf-format). Generate a more readable code (pseudo-C) with colored syntax. Warning, the project is still in development, use it at your own risks. This tool will try to disassemble one function (by default main). The address of the function, or its symbol, can be passed by argument.
      • Medusa
        • Medusa is a disassembler designed to be both modular and interactive. It runs on Windows and Linux, it should be the same on OSX. This project is organized as a library. To disassemble a file you have to use medusa_dummy or qMedusa. wxMedusa and pydusa are not available anymore.
      • PLASMA
        • PLASMA is an interactive disassembler. It can generate a more readable assembly (pseudo code) with colored syntax. You can write scripts with the available Python api (see an example below). The project is still in big development.
      • Snowman decompiler
      • Panopticon
        • Panopticon is a cross platform disassembler for reverse engineering written in Rust. It can disassemble AMD64, x86, AVR and MOS 6502 instruction sets and open ELF files. Panopticon comes with Qt GUI for browsing and annotating control flow graphs,
      • BinaryNinja
        • BinDbg
          • BinDbg is a Binary Ninja plugin that syncs WinDbg to Binja to create a fusion of dynamic and static analyses. It was primarily written to improve the Windows experience for Binja debugger integrations.
    • Java
      • Procyon - Java Decompiler
        • Luyten
          • Java Decompiler Gui for Procyon
      • JavaSnoop
        • A tool that lets you intercept methods, alter data and otherwise test the security of Java applications on your computer.
      • Blackhat - 2010 JavaSnoop: How to hack anything written in Java
      • JavaSnoop – Debugging Java applications
      • Krakatau
        • Java decompiler, assembler, and disassembler
      • Bytecode Viewer
        • Bytecode Viewer is an Advanced Lightweight Java Bytecode Viewer, GUI Java Decompiler, GUI Bytecode Editor, GUI Smali, GUI Baksmali, GUI APK Editor, GUI Dex Editor, GUI APK Decompiler, GUI DEX Decompiler, GUI Procyon Java Decompiler, GUI Krakatau, GUI CFR Java Decompiler, GUI FernFlower Java Decompiler, GUI DEX2Jar, GUI Jar2DEX, GUI Jar-Jar, Hex Viewer, Code Searcher, Debugger and more. It's written completely in Java, and it's open sourced. It's currently being maintained and developed by Konloch.
    • .NET
      • DotPeek
        • dotPeek is a .NET decompiler that has several handy features.
      • dnSpy
        • dnSpy is a debugger and .NET assembly editor. You can use it to edit and debug assemblies even if you don't have any source code available.
      • ILSpy
        • ILSpy is the open-source .NET assembly browser and decompiler.
      • Shed
        • Shed is an application that allow to inspect the .NET runtime of a program in order to extract useful information. It can be used to inspect malicious applications in order to have a first general overview of which information are stored once that the malware is executed.
      • dotNET_WinDBG
        • This python script is designed to automate .NET analysis with WinDBG. It can be used to analyse a PowerShell script or to unpack a binary packed using a .NET packer.
      • Unravelling .NET with the Help of WinDBG - TALOS
        • This article describes: How to analyse PowerShell scripts by inserting a breakpoint in the .NET API; How to easily create a script to automatically unpack .NET samples following analysis of the packer logic.
    • IDA specific Stuff
      • IDA Extensions
        • BAP-IDA
          • This package provides the necessary IDAPython scripts required for interoperatibility between BAP and IDA Pro. It also provides many useful feature additions to IDA, by leveraging power from BAP.
        • funcap - IDA Pro script to add some useful runtime info to static analysis.
          • This script records function calls (and returns) across an executable using IDA debugger API, along with all the arguments passed. It dumps the info to a text file, and also inserts it into IDA's inline comments. This way, static analysis that usually follows the behavioral runtime analysis when analyzing malware, can be directly fed with runtime info such as decrypted strings returned in function's arguments. In author's opinion this allows to understand the program's logic way faster than starting the "zero-knowledge" reversing. Quick understanding of a malware sample code was precisely the motivation to write this script and the author has been using it succesfully at his $DAYJOB. It is best to see the examples with screenshots to see how it works (see below). It must be noted that the script has been designed with many misconceptions, errors and bad design decisions (see issues and funcap.py code) as I was learning when coding but it has one advantage - it kind of works :) Current architectures supported are x86, amd64 and arm. IDAPython Embedded Toolkit
          • IDAPython is a way to script different actions in the IDA Pro disassembler with Python. This repository of scripts automates many different processes necessary when analyzing the firmware running on microcontroller and microprocessor CPUs. The scripts are written to be easily modified to run on a variety of architectures. Read the instructions in the header of each script to determine what ought to be modified for each architecture.
      • IDA Plugins
        • A list of IDA Plugins
        • IDA Python - Ero Carrera
          • IDAPython is an extension for IDA , the Interactive Disassembler . It brings the power and convenience of Python scripting to aid in the analysis of binaries. This article will cover some basic usage and provide examples to get interested individuals started. W e will walk through practical examples ranging from iterating through functions, segments and instructions to data mining the binaries, collecting references and analyzing their structure.
        • Kam1n0-Plugin-IDA-Pro
          • Kam1n0 is a scalable system that supports assembly code clone search. It allows a user to first index a (large) collection of binaries, and then search for the code clones of a given target function or binary file. Kam1n0 tries to solve the efficient subgraph search problem (i.e. graph isomorphism problem) for assembly functions. Given a target function (the middle one in the figure below) it can identity the cloned subgraphs among other functions in the repository (the ones on the left and the right as shown below). Kam1n0 supports rich comment format and has an IDA Pro plug-in to use its indexing and searching capabilities via IDA Pro.
        • FLARE-Ida
          • This repository contains a collection of IDA Pro scripts and plugins used by the FireEye Labs Advanced Reverse Engineering (FLARE) team.
        • toolbag
          • The IDA Toolbag is a plugin providing supplemental functionality to Hex-Rays IDA Pro disassembler.
        • Dynamic IDA Enrichment (aka. DIE)
          • DIE is an IDA python plugin designed to enrich IDA's static analysis with dynamic data. This is done using the IDA Debugger API, by placing breakpoints in key locations and saving the current system context once those breakpoints are hit.
        • HexRaysCodeXplorer
          • Hex-Rays Decompiler plugin for better code navigation in RE process of C++ applications or code reconstruction of modern malware as Stuxnet, Flame, Equation
        • Ida Pomidor
          • IDA Pomidor is a fun and simple plugin for the Hex-Ray's IDA Pro disassembler that will help you retain concentration and productivity during long reversing sessions.
        • idaConsonance
          • Consonance, a dark color theme for IDA.
        • Lighthouse - Code Coverage Explorer for IDA Pro
          • Lighthouse is a code coverage plugin for IDA Pro. The plugin leverages IDA as a platform to map, explore, and visualize externally collected code coverage data when symbols or source may not be available for a given binary.
        • NRS
          • NRS is a set of Python librairies used to unpack and analysis NSIS installer's data. It also feature an IDA plugin used to disassembly the NSIS Script of an installer
        • Ponce
          • Ponce (pronounced [ 'poN θe ] pon-they ) is an IDA Pro plugin that provides users the ability to perform taint analysis and symbolic execution over binaries in an easy and intuitive fashion. With Ponce you are one click away from getting all the power from cutting edge symbolic execution. Entirely written in C/C++.
        • IDASkins
          • Advanced skinning plugin for IDA Pro
        • Ida Sploiter
          • IDA Sploiter is a plugin for Hex-Ray's IDA Pro disassembler designed to enhance IDA's capabilities as an exploit development and vulnerability research tool. Some of the plugin's features include a powerful ROP gadgets search engine, semantic gadget analysis and filtering, interactive ROP chain builder, stack pivot analysis, writable function pointer search, cyclic memory pattern generation and offset analysis, detection of bad characters and memory holes, and many others.
        • vtbl-ida-pro-plugin
          • Identifying Virtual Table Functions using VTBL IDA Pro Plugin + Deviare Hooking Engine
        • virusbattle-ida-plugin
          • The plugin is an integration of Virus Battle API to the well known IDA Disassembler. Virusbattle is a web service that analyses malware and other binaries with a variety of advanced static and dynamic analyses.
        • ida-batch_decompile
          • IDA Batch Decompile is a plugin for Hex-Ray's IDA Pro that adds the ability to batch decompile multiple files and their imports with additional annotations (xref, stack var size) to the pseudocode .c file
        • IdaRef
          • IDA Pro Full Instruction Reference Plugin - It's like auto-comments but useful.
        • [YaCo])(https://github.com/DGA-MI-SSI/YaCo)
          • YaCo is an Hex-Rays IDA plugin. When enabled, multiple users can work simultaneously on the same binary. Any modification done by any user is synchronized through git version control.
        • HexRaysPyTools
          • The plugin assists in the creation of classes/structures and detection of virtual tables. It also facilitates transforming decompiler output faster and allows to do some stuff which is otherwise impossible.
      • IDA Tutorials/Help
  • File Formats
  • Flash Player
    • #Fldbg
      • #Fldbg, a Pykd script to debug FlashPlayer
    • SWFRETools
      • The SWFRETools are a collection of tools built for vulnerability analysis of the Adobe Flash player and for malware analysis of malicious SWF files. The tools are partly written in Java and partly in Python and are licensed under the GPL 2.0 license.
  • Frameworks
  • Programming Language Specifics/Libraries
    • Libraries
      • openreil
        • Open source library that implements translator and tools for REIL (Reverse Engineering Intermediate Language)
    • Go
    • Java
      • PortEx
        • PortEx is a Java library for static malware analysis of Portable Executable files. Its focus is on PE malformation robustness, and anomaly detection. PortEx is written in Java and Scala, and targeted at Java applications.
    • Python
  • Anti-Reverse Engineering Techniques & Countermeasures
  • Hardware Reverse Engineering
    • See 'Embedded Devices & Hardware Hacking'
  • .NET Related
    • Getting Started with CLR MD
    • Microsoft.Diagnostics.Runtime.dll(CLR MD)
      • Microsoft.Diagnostics.Runtime.dll (nicknamed "CLR MD") is a process and crash dump introspection library. This allows you to write tools and debugger plugins which can do thing similar to SOS and PSSCOR.
    • Reflexil
      • Reflexil is an assembly editor and runs as a plug-in for Red Gate's Reflector, ILSpy and Telerik's JustDecompile. Reflexil is using Mono.Cecil, written by Jb Evain and is able to manipulate IL code and save the modified assemblies to disk. Reflexil also supports C#/VB.NET code injection
  • Writeups

Sort

  • State of the art of network protocol reverse engineering tools

  • linux-re-101

    • Cool resource relating to REing linux related things. Structured similar to this reference

  • Reversing Objective-C Binaries With the REobjc Module for IDA Pro - Todd Manning

  • oleviewdotnet

    • OleViewDotNet is a .NET 4 application to provide a tool which merges the classic SDK tools OleView and Test Container into one application. It allows you to find COM objects through a number of different views (e.g. by CLSID, by ProgID, by server executable), enumerate interfaces on the object and then create an instance and invoke methods. It also has a basic container to attack ActiveX objects to so you can see the display output while manipulating the data.

  • Cryptoshark

    • Interactive code tracer for reverse-engineering proprietary software

  • Hide data inside pointers

  • BinCAT

    • BinCAT is a static Binary Code Analysis Toolkit, designed to help reverse engineers, directly from IDA.

  • Record and Replay Debugging with Firefox

  • rr

    • rr is a lightweight tool for recording and replaying execution of applications (trees of processes and threads). More information about the project, including instructions on how to install, run, and build rr, is at http://rr-project.org.w

  • What are the methods to find hooked functions and APIs?

  • Taking a Snapshot and Viewing Processes - msdn.ms

  • QEMU

    • PyREBox
      • PyREBox is a Python scriptable Reverse Engineering sandbox. It is based on QEMU, and its goal is to aid reverse engineering by providing dynamic analysis and debugging capabilities from a different perspective. PyREBox allows to inspect a running QEMU VM, modify its memory or registers, and to instrument its execution, by creating simple scripts in python to automate any kind of analysis. QEMU (when working as a whole-system-emulator) emulates a complete system (CPU, memory, devices...). By using VMI techniques, it does not require to perform any modification into the guest operating system, as it transparently retrieves information from its memory at run-time.

  • Binary Instrumentation

  • Etnaviv

    • Project Etnaviv is an open source user-space driver for the Vivante GCxxx series of embedded GPUs. This repository contains reverse-engineering and debugging tools, and rnndb register documentation. It is not necessary to use this repository when building the driver. Android

  • Tracing arbitrary Methods and Function calls on Android and iOS

  • Offensive & Defensive Android Reverse Engineering

    • Thinking like an attacker, you will learn to identify juicy Android targets, reverse engineer them, find vulnerabilities, and write exploits. We will deep dive into reverse engineering Android frameworks, applications, services, and boot loaders with the end goal of rooting devices. Approaching from a defensive perspective, we will learn quickly triage applications to determine maliciousness, exploits, and weaknesses. After learning triage skills, we will deep dive into malicious code along while dealing with packers, obfuscators, and anti-reversing techniques. Between the offensive and defensive aspects of this class, you should walk away with the fundamentals of reverse engineering and a strong understanding of how to further develop your skills for mobile platforms.

  • ARMwiki - hehyrick.co.uk

    • ARM processor wiki

https://github.com/Wenzel/r2vmi https://github.com/giMini/mimiDbg https://github.com/samyk/frisky https://hshrzd.wordpress.com/how-to-start/ http://www.hexacorn.com/blog/2018/04/14/how-to-become-the-best-malware-analyst-e-v-e-r/ https://github.com/yellowbyte/reverse-engineering-reference-manual https://hex-rays.com/contests/2017/index.shtml https://www.endgame.com/blog/technical-blog/introduction-windows-kernel-debugging http://jamie-wong.com/post/reverse-engineering-instruments-file-format/ http://deniable.org/reversing/binary-instrumentation http://terminus.rewolf.pl/terminus/

Symbolic Execution
	* [Theorem prover, symbolic execution and practical reverse-engineering](https://doar-e.github.io/presentations/securityday2015/SecDay-Lille-2015-Axel-0vercl0k-Souchet.html#/)
	* [A bibliography of papers related to symbolic execution](https://github.com/saswatanand/symexbib)

* [BOLO: Reverse Engineering — Part 1 (Basic Programming Concepts) - Daniel Bloom](https://medium.com/bugbountywriteup/bolo-reverse-engineering-part-1-basic-programming-concepts-f88b233c63b7)