Triton

Triton es una librería de análisis binario dinámico. Proporciona componentes internos que permiten construir herramientas de análisis de programas, automatizar la ingeniería inversa, realizar verificación de software o simplemente emular código. Ejecución simbólica dinámica Análisis dinámico de...

FileInsight-plugins

FileInsight-plugins: conjunto de herramientas de descodificación del editor hexadecimal FileInsight de McAfee para el análisis de malware FileInsight-plugins es un amplio conjunto de plugins para el editor hexadecimal FileInsight de McAfee. Añade muchas capacidades como descifrado, descompresión,...

unicorn_pe

Unicorn PE Unicorn PE is an unicorn based instrumentation project/framework designed to emulate code execution for windows PE files, especially packed ones. This project is archived and no longer maintained. sogen is recommended as a successor. Feature Dump PE image from emu-memory into file, fix...

Complex Code Reuse Attacks: ROPMEMU

ROPMEMU is a framework to analyze, dissect and decompile complex code-reuse attacks Talos has developed ROPMEMU, a framework to analyze, dissect and decompile complex code-reuse attacks. It adopts a set of different techniques to analyze ROP chains and reconstruct their equivalent code in a form...

Against the heuristics, code emulation detection techniques analysis-vulnerability warning-the black bar safety net

Recent researchVirusthe detection technique, although in thisTrojan, andmalwarerampant,detection technologyin addition to considering the efficiency factorshas become not very important. But I still interest want from here. looking for some ideas. Perhaps against the technology itself is not a wh...