NullSection

NullSection NullSection 是一款反逆向工具，它采用一种技术将节头覆盖为空字节。 安装 root@kitploit: git clone https://github.com/MatheuZSecurity/NullSection cd NullSection gcc nullsection.c -o nullsection ./nullsection 优势 在任何 ELF 文件（例如 .ko rootkit）上运行 nullsection 后，如果你使用 Ghidra/IDA 来解析 ELF 函数，将不会显示任何内容——反编译器中不会有可解析的函数。即便你运行...

toolkit

English | Español Indetectables Toolkit Designed as a Swiss Army knife, this curated toolkit is invaluable for malware analysts, crackers, and cybersecurity experts. It is meticulously crafted to support both novice and experienced users. This toolkit complements the manuals and the numbered...

awesome-ctf-resources

Awesome CTF 资源 这里列出了 夺旗赛 CTF 的框架、库、资源和软件，面向新手和资深 CTF 玩家 🚩 欢迎任何贡献，给我发 PR！❤️ -所收集的软件和资源并非本人所有，仅供教育目的整理- 目录 创建 平台 取证 隐写 Web 解决 密码学 漏洞利用 / Pwn 取证 杂项 逆向 隐写 Web 资源 在线平台 协作工具 题解仓库 课程 参考文献 0x00. 创建 用于创建 CTF 题目的工具 平台 可用于托管 CTF 的框架 CTFd - 用于托管 Jeopardy 风格 CTF 的平台。 FBCTF - Facebook CTF 平台，可用于 Jeopardy...

GDA-android-reversing-Tool

ˇ GDA（GJoy Dex分析器） GDA是一个用C++实现的强大的Dalvik字节码反编译器，具有分析速度快、内存和磁盘消耗低、反编译apk、dex、odex、oat、jar、class、aar文件能力强的优点。 GDA是完全原生的软件，无需任何安装和Java虚拟机即可运行，在任何新的Windows系统和虚拟机系统中都可以正常工作，无需额外配置。GDA反编译器项目始于2013年，首个版本1.0于2015年在GDA官网发布。...

COM-Code-Helper

COM-Code-Helper 两个 IDAPython 脚本，帮助你重构 Microsoft COM（组件对象模型）代码。 恶意软件逆向工程师尤其会发现此工具非常有用，因为 COM 代码仍然常见于恶意软件中。 ClassAndInterfaceToNames.py 此 IDAPython 脚本扫描 idb 文件中的类和接口 UUID，并创建相应的结构及其名称。 请确保 interfaces.txt + classes.txt 与 ClassAndInterfaceToNames.py 位于同一目录下。 Microsoft-SDK-Vtable-Structs.py 此 IDAPytho...

x86-cpp-reversing-skill

x86-cpp-reversing Una habilidad de Claude Code para la ingeniería inversa de binarios x86 IA-32 little-endian de 32 bits y desensamblado compilado desde C++. Recupera diseños de clases, vtables, despacho virtual y jerarquías de RTTI/herencia desde binarios ELF o PE, y cubre los flujos de trabajo...

EFISwissKnife

. //| | | | | | | \ | \ | | / / / || / / . . . / / || | |/ | | |/ \ / / / |/ /// | || | /|| | / / / / / / EFI Swiss Knife Un plugin de IDA para mejorar la ingeniería inversa de UEFI Copyright C 2016, 2017 Pedro Vilaça fG! - [email protected] - https://reverse.put.as Este es un plugin de IDA...

pe-bear-old

PE-bear releases PE-bear es una herramienta gratuita de reversión para archivos PE. Su objetivo es ofrecer una «primera vista» rápida y flexible para los analistas de malware, estable y capaz de manejar archivos PE malformados. Firmas para PE-bear: SIG.txt actualizado: 22.01.2014 - contiene firma...

defcon_27_windbg_workshop

Taller "Modern Debugging with WinDbg Preview" de DEFCON 27 Este repositorio contiene los materiales para el taller de DEFCON 27 Descripción general Resumen Estamos en 2019 y, aun así, demasiados desarrolladores y hackers de Windows por igual siguen confiando en herramientas útiles, pero bastante ...

qualcomm_baseband_scripts

qualcommbasebandscripts Colección de scripts para la ingeniería inversa del firmware de banda base / módem de Qualcomm Todos los offsets/direcciones en los scripts se han actualizado al firmware de marzo del Pixel 5 y deben cambiarse si se utiliza una versión diferente. Fusión mergemodemfirmware....

TEE-reversing

Fundamentos de TEE y conceptos generales Introducción al entorno de ejecución confiable: TrustZone de ARM https://blog.quarkslab.com/introduction-to-trusted-execution-environment-arms-trustzone.html Introducción a TEE título original: TEEを中心とするCPUセキュリティ機能の動向...

rust-reversing-workshop-recon-2024

Reversing binarios de Rust: Un paso más allá de los strings - Taller REcon 2024 Este repositorio contiene los archivos complementarios para el taller Reversing Rust Binaries: One step beyond strings en REcon 2024, presentado el 28 de junio de 2024. Durante la presentación, construiremos y...

Malicious Package

Overview @meme-sdk/trade is a malicious package. This package contains malicious code, and its content was not yet removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

Malicious Package

Overview @validate-sdk/v2 is a malicious package. This package contains malicious code, and its content was not yet removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview react-state-optimizer-core is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

winlow

Windows Internals & Exploitation A concise, practical referen...

nightmare

This repository is an introduction to binary exploitation and reverse engineering course based on CTF challenges, called "Nightmare". It contains a large amount of content, with over 90 challenges, laid out in a linear fashion, and well-documented write-ups explaining how to go from being handed...

TEE-reversing

This repository is an offensive tool for learning how to reverse-engineer and achieve trusted code execution on ARM devices. It contains a curated list of public TEE resources, including papers on TEE reversing and security analysis. The repository includes links to various papers and resources o...

Hidden between the tags: Insights into spammers’ evasion techniques in HTML Smuggling

Cisco Talos has spotted several malicious email campaigns over the past few months that disguise JavaScript code within HTML email attachments, a technique commonly known as "HTML Smuggling." Cisco Talos has noticed that some industry verticals were targeted more than others by email threats usin...

NullSection - An Anti-Reversing Tool That Applies A Technique That Overwrites The Section Header With Nullbytes

NullSection is an Anti-Reversing tool that applies a technique that overwrites the section header with nullbytes. Install git clone https://github.com/MatheuZSecurity/NullSection cd NullSection gcc nullsection.c -o nullsection ./nullsection Advantage When running nullsection on any ELF, it could ...