drmemory

Dr. Memory：内存调试器 关于 Dr. Memory Dr. Memory 是一款内存监控工具，能够识别与内存相关的编程错误，例如访问未初始化内存、访问不可寻址内存（包括分配的堆单元之外以及堆下溢和堆上溢）、访问已释放内存、双重释放、内存泄漏，以及（在 Windows 上）句柄泄漏、GDI API 使用错误和访问未预留的线程局部存储槽。 Dr. Memory 可直接运行于 Windows、Linux、Mac 或 Android 系统上未经修改的应用程序二进制文件，支持 IA-32、AMD64 和 ARM 硬件平台。 Dr. Memory 采用 LGPL 许可证发布，二进制包可下载...

DrSemu

Dr.Semu Dr.Semu 在隔离环境中运行可执行文件，监控进程行为，并根据你或社区创建的 Dr.Semu 规则检测该进程是否为恶意。 该工具处于早期开发阶段 作者: @qazqaz 借助 Dr.Semu，你可以根据进程的动态行为创建规则来检测恶意软件。 通过重定向实现隔离 所有操作均在用户态完成。使用 Windows 投影文件系统 ProjFS 提供 虚拟 文件系统。对于注册表重定向，它会将所有注册表配置单元克隆到新位置，并重定向所有注册表访问。 有关其他重定向（进程/对象隔离等）的更多信息，请参阅源代码。 监控 Dr.Semu 使用 DynamoRIO（动态...

drAFL

drAFL 原始的AFL支持使用QEMU模式进行黑盒覆盖引导的模糊测试。我强烈建议先尝试它，如果不起作用，你可以尝试这个工具。此外，你可能还想尝试Manul，它支持在Windows和Linux上进行黑盒二进制文件模糊测试。 使用方法 你需要指定DRRUNPATH指向drrun启动器，以及LIBCOVPATH指向libbinafl.so覆盖库。你还需要关闭AFL的fork服务器（AFLNOFORKSRV=1），可能还需要AFLSKIPBINCHECK=1。详情请参阅下方构建部分的第5步。...

manul

Manul Manul is a coverage-guided parallel fuzzer for open-source and black-box binaries on Windows, Linux and macOS beta written in pure Python. Quick Start root@kitploit: pip3 install psutil git clone https://github.com/mxmssh/manul cd manul mkdir in mkdir out echo "AAAAAA" in/test python3...

dragondance

Dragon Dance ¿Qué es eso? Dragon Dance es un plugin para Ghidra para visualizar y manipular los datos de cobertura de código binario. Los datos de cobertura pueden importarse de múltiples fuentes de cobertura. Por ahora, el plugin es compatible con las herramientas de instrumentación binaria...

Dynamic binary instrumentation (DBI) with DynamoRio

This blog introduces dynamic binary instrumentation DBI and guides you through building your own DBI tool with the open-source DynamoRIO framework on Windows 11. DBI enables powerful runtime analysis and modification of binaries critical for malware analysis, security auditing, reverse engineerin...

DrSemu - Malware Detection And Classification Tool Based On Dynamic Behavior

Dr.Semu runs executables in an isolated environment, monitors the behavior of a process, and based on Dr.Semu rules created by you or the community, detects if the process is malicious or not. whoami:@qazqaz With Dr.Semu you can create rules to detect malware based on dynamic behavior of a proces...

Functrace - A Function Tracer

functrace is a tool that helps to analyze a binary file with dynamic instrumentation using DynamoRIO http://dynamorio.org/. These are some implemented features based on DynamoRIO: disassemble all the executed code disassemble a specific function dump if these are addresses get arguments of a...

drAFL - AFL + DynamoRIO = Fuzzing Binaries With No Source Code On Linux

Original AFL supports black-box coverage-guided fuzzing using QEMU mode. I highly recommend to try it first and if it doesn't work you can try this tool. Usage You need to specify DRRUNPATH to point to drrun launcher and LIBCOVPATH to point to libbinafl.so coverage library. You also need to switc...

Hidden for 19 years WinRAR code execution vulnerability-vulnerability warning-the black bar safety net

The researchers found WinRAR logic vulnerabilities that can full access to the victims computer control. The exploit only requires from the compressed file to extract it can work, more than 5 million users affected. More importantly, the vulnerability has been there 19 years, forcing WinRAR...

Dynamic Data Resolver (DDR) - IDA Plugin

This blog post was authored by Holger Unterbrink Executive Summary Static reverse-engineering in IDA can often be problematic. Certain values are calculated at run time, which makes it difficult to understand what a certain basic block is doing. But, if you try to perform dynamic analysis by...

Instruction Trace Visualisation Tool: rgat

An instruction trace visualisation tool intended to help reverse engineers make the link between target behaviour and code. rgat uses dynamic binary instrumentation courtesy of DynamoRIO to produce graphs from running executables. It creates static and animated visualisations in realtime to suppo...

Dynamic Instrumentation Tool Platform: DynamoRIO

Dynamic Instrumentation Tool Platform DynamoRIO is a runtime code manipulation system that supports code transformations on any part of a program, while it executes. DynamoRIO exports an interface for building dynamic tools for a wide variety of uses: program analysis and understanding, profiling...

Fuzzing Windows Binaries: WinAFL

AFL is a popular fuzzing tool for coverage-guided fuzzing. The tool combines fast target execution with clever heuristics to find new execution paths in the target binary. It has been successfully used to find a large number of vulnerabilities in real products. For more info about the original...