NullSection

NullSection NullSection es una herramienta anti-reversing que aplica una técnica que sobrescribe el encabezado de la sección con bytes nulos. Instalación root@kitploit: git clone https://github.com/MatheuZSecurity/NullSection cd NullSection gcc nullsection.c -o nullsection ./nullsection Ventaja A...

pe-bear-old

Release di PE-bear PE-bear è uno strumento freeware di reverse engineering per file PE. Il suo obiettivo è offrire una "prima visione" rapida e flessibile per gli analisti di malware, stabile e in grado di gestire file PE malformati. Firme per PE-bear: SIG.txt aggiornato: 22.01.2014 - contiene...

COM-Code-Helper

COM-Code-Helper Zwei IDAPython-Skripte helfen Ihnen, Microsoft COM Component Object Model Code zu rekonstruieren. Insbesondere Malware-Reverser werden dies nützlich finden, da COM-Code immer noch regelmäßig in Malware vorkommt. ClassAndInterfaceToNames.py Dieses IDAPython-Skript durchsucht eine...

toolkit

English | Español Indetectables Toolkit Designed as a Swiss Army knife, this curated toolkit is invaluable for malware analysts, crackers, and cybersecurity experts. It is meticulously crafted to support both novice and experienced users. This toolkit complements the manuals and the numbered...

awesome-ctf-resources

Tolle CTF-Ressourcen Eine Liste von Capture The Flag CTF-Frameworks, Bibliotheken, Ressourcen und Software für Anfänger/erfahrene CTF-Spieler 🚩 Jeder Beitrag ist willkommen, sende mir einen PR! ❤️ -Die gesammelten Software und Ressourcen gehören nicht mir und wurden nur zu Bildungszwecken...

GDA-android-reversing-Tool

ˇ GDAGJoy Dex Analyzer GDA, C++ में लागू एक शक्तिशाली Dalvik बाइटकोड डीकंपाइलर है, जिसमें तेज विश्लेषण, कम मेमोरी और डिस्क खपत तथा apk, dex, odex, oat, jar, class, aar फ़ाइलों को डीकंपाइल करने की अधिक क्षमता के लाभ हैं। GDA पूरी तरह से नेटिव सॉफ्टवेयर है और बिना किसी सेटअप या Java VM के काम करता...

defcon_27_windbg_workshop

Workshop DEFCON 27 "Modern Debugging with WinDbg Preview" Questo repository contiene i materiali per il DEFCON 27 workshop Panoramica Abstract Siamo nel 2019 eppure troppi sviluppatori e hacker Windows fanno ancora affidamento su strumenti vecchia scuola utili, ma comunque datati per il debug dei...

TEE-reversing

Nozioni di base e generali sui TEE Introduzione al Trusted Execution Environment: la TrustZone di ARM https://blog.quarkslab.com/introduction-to-trusted-execution-environment-arms-trustzone.html Introduzione ai TEE titolo originale: TEEを中心とするCPUセキュリティ機能の動向...

qualcomm_baseband_scripts

qualcommbasebandscripts Sammlung von Skripten zum Reverse Engineering der Qualcomm-Baseband-/Modem-Firmware Alle Offsets/Adressen in den Skripten wurden auf die Pixel-5-März-Firmware aktualisiert und müssen geändert werden, wenn du eine andere Version verwendest. Zusammenführen...

rust-reversing-workshop-recon-2024

Reverse Engineering von Rust-Binaries: Ein Schritt über Strings hinaus - REcon 2024 Workshop Dieses Repository enthält die begleitenden Dateien für den Reverse Engineering von Rust-Binaries: Ein Schritt über Strings hinaus Workshop auf der REcon 2024, der am 28. Juni 2024 präsentiert wurde. Währe...

Malicious Package

Overview @meme-sdk/trade is a malicious package. This package contains malicious code, and its content was not yet removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

Malicious Package

Overview @validate-sdk/v2 is a malicious package. This package contains malicious code, and its content was not yet removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview react-state-optimizer-core is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

winlow

Windows Internals & Exploitation A concise, practical referen...

nightmare

This repository is an introduction to binary exploitation and reverse engineering course based on CTF challenges, called "Nightmare". It contains a large amount of content, with over 90 challenges, laid out in a linear fashion, and well-documented write-ups explaining how to go from being handed...

TEE-reversing

This repository is an offensive tool for learning how to reverse-engineer and achieve trusted code execution on ARM devices. It contains a curated list of public TEE resources, including papers on TEE reversing and security analysis. The repository includes links to various papers and resources o...

Hidden between the tags: Insights into spammers’ evasion techniques in HTML Smuggling

Cisco Talos has spotted several malicious email campaigns over the past few months that disguise JavaScript code within HTML email attachments, a technique commonly known as "HTML Smuggling." Cisco Talos has noticed that some industry verticals were targeted more than others by email threats usin...

NullSection - An Anti-Reversing Tool That Applies A Technique That Overwrites The Section Header With Nullbytes

NullSection is an Anti-Reversing tool that applies a technique that overwrites the section header with nullbytes. Install git clone https://github.com/MatheuZSecurity/NullSection cd NullSection gcc nullsection.c -o nullsection ./nullsection Advantage When running nullsection on any ELF, it could ...

The Sound of Malware

The Sound of Malware By Trellix · June 23, 2022 Do, a debugger, you often use Re, a reverse engineer Mi, a name, I call myself Anyways…. By now, you must be very thankful I reminded you of this famous song; I am sure it will be stuck in your head the rest of the day. You’re welcome! Confused on h...

Targeted Malware Reverse Engineering Workshop follow-up. Part 2

If you have read our previous blogpost "Targeted Malware Reverse Engineering Workshop follow-up. Part 1", you probably know about the webinar we conducted on April 8, 2021, with Kaspersky GReATs Ivan Kwiatkowski and Denis Legezo, to share best practices in reverse engineering and demonstrate...