diff --git a/TOOLS.md b/TOOLS.md index c89fc94..fb76726 100644 --- a/TOOLS.md +++ b/TOOLS.md @@ -15,17 +15,17 @@ ### CAPA ***Web:*** https://github.com/fireeye/capa
***Developer:*** mandiant - www.mandiant.com
-***Description:*** Capa detects capabilities in executable files. You run it against a PE, ELF, or shellcode file and it tells you what it thinks the program can do. For example, it might suggest that the file is a backdoor, is capable of installing services, or relies on HTTP to communicate.
+***Description:*** Capa detects capabilities in executable files. Run this tool against a PE, ELF, or shellcode file and it tells you what it thinks the program can do. For example, it might suggest that the file is a backdoor, is capable of installing services, or relies on HTTP to communicate.
### DIE ***Web:*** https://github.com/horsicq/DIE-engine
-***Developer:*** horsicq
+***Developer:*** Hors
***Description:*** Detect It Easy, or abbreviated "DIE" is a program for determining types of files. DIE-Engine is a Graphical User Interface for DIE.
### ExeinfoPe ***Web:*** https://github.com/ExeinfoASL/ASL
***Developer:*** ASL - http://www.exeinfo.byethost18.com
-***Description:*** ExEinfo PE detects packers, obfuscators, compilers & protectors.
+***Description:*** ExEinfo PE detects packers, obfuscators, compilers & protectors in binary files.
### PE-Bear ***Web:*** https://github.com/hasherezade/pe-bear-releases
@@ -33,7 +33,7 @@ ***Description:*** PE-bear is a freeware reversing tool for PE files. Its objective is to deliver fast and flexible “first view” for malware analysts, stable and capable to handle malformed PE files.
### PEiD -***Web:*** www.peid.info (closed)
+***Web:*** https://appnee.com/peid/ (closed)
***Developer:*** snaker
***Description:*** PEiD (short for PE iDentifier) is a well-known professional, extensible packer/cryptor/compiler detecting tool. It’s so powerful that it can detect the types/signatures of almost any PE file packing tools (at present, the number has been more than 600 kinds)
@@ -49,17 +49,17 @@ ### XAPKDetector ***Web:*** https://github.com/horsicq/XAPKDetector
-***Developer:*** horsicq
+***Developer:*** Hors
***Description:*** This tool shows information about build tools, libraries and protection of APK/DEX files. Has heuristic capabilities, and runs in Win/MacOS/Linux.
### XELFViewer ***Web:*** https://github.com/horsicq/XELFViewer
-***Developer:*** horsicq
+***Developer:*** Hors
***Description:*** This is an ELF file viewer/editor for Windows, Linux and MacOS.
### XPEViewer ***Web:*** https://github.com/horsicq/XPEViewer
-***Developer:*** horsicq
+***Developer:*** Hors
***Description:*** This tool is a PE file viewer/editor for Windows, Linux and MacOS.
@@ -82,52 +82,52 @@ executables that have been packed and protected using AutoIt3Camo, Themida, Arma ***Developer:*** CW2K@gmx.de
***Description:*** Decompiles 'compiled' AutoIT Exe files.
-### [DELPHI] Dede -***Web:*** ???
-***Developer:*** DaFixer
-***Description:*** ???
+### [DELPHI] Dede - Delphi Decompiler +***Web:*** https://github.com/Hanvdm/dedex
+***Developer:*** DaFixer (https://github.com/Hanvdm)
+***Description:*** DeDe is a very fast program that can analize executables compiled with Delphi 3,4,5,6, C++Builder and Kylix and give you all dfm files on the target, every published method in well-commented Assembler, and lots of other information.-
-### [DELPHI] IDR +### [DELPHI] IDR - Interactive Delphi Reconstructor ***Web:*** https://github.com/crypto2011/IDR
***Developer:*** crypto2011
-***Description:*** Interactive Delphi Reconstructor
+***Description:*** IDR is a decompiler of executable files (EXE) and dynamic libraries (DLL), written in Delphi and executed in Windows32 environment, with the final aim of being capable to restore the most part of initial Delphi source codes from the compiled file.
### [DOTNET] dnSpyEx ***Web:*** https://github.com/dnSpyEx/dnSpy
-***Developer:*** dnSpy
-***Description:*** dnSpy
+***Developer:*** dnSpy team
+***Description:*** dnSpy is a debugger and .NET assembly editor. You can use it to edit and debug assemblies even if you don't have any source code available.
### [DOTNET] GrayWolf -***Web:*** ???
+***Web:*** Currently offline
***Developer:*** DigitalBodyGuard
-***Description:*** GrayWolf
+***Description:*** GrayWolf is a reverse engineering tool focused on .NET Framework Applications. It can de-obfuscate binaries, live-edit IL, add payloads, edit attributes, and copy strong names signing on EXE/DLL.
### [DOTNET] ILSpy ***Web:*** https://github.com/icsharpcode/ILSpy
-***Developer:*** ic#code
-***Description:*** ILSpy
+***Developer:*** ic#code (https://github.com/icsharpcode)
+***Description:*** ILSpy is the open-source .NET assembly browser and decompiler.
### [JAVA] JD-GUI ***Web:*** https://github.com/java-decompiler/jd-gui
-***Developer:*** ???
-***Description:*** JD-GUI
+***Developer:*** the Java Decompiler dev team (https://github.com/java-decompiler)
+***Description:*** This is a standalone graphical utility that displays Java sources from CLASS files.
### [JAVA] Recaf ***Web:*** https://github.com/Col-E/Recaf
-***Developer:*** Matt Coley (Col-E)
-***Description:*** ???
+***Developer:*** Matt Coley "Col-E" (https://github.com/Col-E)
+***Description:*** An easy to use modern Java bytecode editor that abstracts away the complexities of Java programs. Recaf abstracts away constant pool, stack frames, wide instructions, and more.
### [PYTHON] PyInstxtractor ***Web:*** https://github.com/extremecoders-re/pyinstxtractor
-***Developer:*** ???
-***Description:*** ???
+***Developer:*** https://github.com/extremecoders-re
+***Description:*** is a Python script to extract the contents of a PyInstaller generated Windows executable file. The contents of the pyz file (usually pyc files) present inside the executable are also extracted. The header of the pyc files are automatically fixed so that a Python bytecode decompiler will recognize it.
+[//]: # (TODO) ### [VB] P-Code-ExDec ***Web:*** ???
***Developer:*** ???
***Description:*** ???
- ## Dissasembler ### BDASM @@ -167,77 +167,75 @@ Although W32DASM is ancient since hasn't received updates for a very long time ( ### HxD ***Web:*** https://mh-nexus.de/en/hxd
***Developer:*** Maël Hörz
-***Description:*** HxD is a carefully designed and fast hex editor which, additionally to raw disk editing and modifying of main memory (RAM), handles files of any size. -The easy to use interface offers features such as searching and replacing, exporting, checksums/digests, insertion of byte patterns, a file shredder, concatenation or splitting of files, statistics and much more.
+***Description:*** HxD is a carefully designed and fast hex editor which, additionally to raw disk editing and modifying of main memory (RAM), handles files of any size.
### ImHex ***Web:*** https://github.com/WerWolv/ImHex
***Developer:*** WerWolv
-***Description:*** ImHex is a Hex Editor, a tool to display, decode and analyze binary data to reverse engineer their format, extract informations or patch values in them. -What makes ImHex special is that it has many advanced features that can often only be found in paid applications. Such features are a completely custom binary template and pattern language to decode and highlight structures in the data, a graphical node-based data processor to pre-process values before they're displayed, a disassembler, diffing support, bookmarks and much much more.
+***Description:*** A Hex Editor for Reverse Engineers, Programmers and people who value their retinas when working at 3 AM.
### REHex ***Web:*** https://github.com/solemnwarning/rehex
-***Developer:*** Daniel Collins (solemnwarning)
+***Developer:*** solemnwarning
***Description:*** A cross-platform (Windows, Linux, Mac) hex editor for reverse engineering, and everything else.
### WinHex ***Web:*** https://x-ways.net/winhex
***Developer:*** X-Ways Software Technology AG
-***Description:*** (DEPRECATED IN TOOLKIT - REMOVE THIS IN 2022.3) WinHex is in its core a universal hexadecimal editor, particularly helpful in the realm of computer forensics, data recovery, low-level data processing, and IT security.
+***Description:*** WinHex is in its core a universal hexadecimal editor, particularly helpful in the realm of computer forensics, data recovery, low-level data processing, and IT security. An advanced tool for everyday and emergency use: inspect and edit all kinds of files, recover deleted files or lost data.
## Monitor ### Api Monitor -***Web:*** ???
-***Developer:*** rohitab.com
-***Description:*** API Monitor v2 (Alpha) 32-bit
+***Web:*** http://www.rohitab.com/apimonitor
+***Developer:*** Rohitab
+***Description:*** This fine tool lets you monitor and control API calls made by applications and services. Its a powerful tool for seeing how applications and services work or for tracking down problems that you have in your own applications.
### Autoruns ***Web:*** https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns
***Developer:*** Sysinternals
-***Description:*** Autostart program viewer
+***Description:*** This utility, which has the most comprehensive knowledge of auto-starting locations of any startup monitor, shows you what programs are configured to run during system bootup or login, and when you start various built-in Windows applications like Internet Explorer, Explorer and media players.
### CurrPorts ***Web:*** https://www.nirsoft.net/utils/cports.html
***Developer:*** NirSoft
-***Description:*** CurrPorts
+***Description:*** CurrPorts is network monitoring software that displays the list of all currently opened TCP/IP and UDP ports on your local computer. For each port in the list, information about the process that opened the port is also displayed, including the process name, full path of the process, version information of the process (product name, file description, and so on), the time that the process was created, and the user that created it.
### HollowsHunter ***Web:*** https://github.com/hasherezade/hollows_hunter
-***Developer:*** ???
-***Description:*** ???
+***Developer:*** hasherezade
+***Description:*** Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
### MultiMon ***Web:*** https://www.resplendence.com/multimon_whatsnew
***Developer:*** Resplendence Software Projects Sp.
-***Description:*** MultiMon
+***Description:*** MultiMon is an advanced multifunctional system monitoring tool for Windows which displays detailed output of a wide range of activities in real-time. The system monitor displays process and thread creation as well as binary image loading. The file system monitor displays activity from the perspective of the file system. The registry monitor shows registry activity in real time.
### PE-sieve ***Web:*** https://github.com/hasherezade/pe-sieve
-***Developer:*** ???
-***Description:*** ???
+***Developer:*** hasherezade
+***Description:*** PE-sieve is a tool that helps to detect malware running on the system, as well as to collect the potentially malicious material for further analysis. Recognizes and dumps variety of implants within the scanned process: replaced/injected PEs, shellcodes, hooks, and other in-memory patches. Detects inline hooks, Process Hollowing, Process Doppelgänging, Reflective DLL Injection, etc.
### Portmon ***Web:*** https://docs.microsoft.com/en-us/sysinternals/downloads/portmon
***Developer:*** SysInternals
-***Description:*** Portmon/EE
+***Description:*** Portmon is a utility that monitors and displays all serial and parallel port activity on a system. It has advanced filtering and search capabilities that make it a powerful tool for exploring the way Windows works, seeing how applications use ports, or tracking down problems in system or application configurations.
### Process Explorer ***Web:*** https://docs.microsoft.com/en-us/sysinternals/downloads/process-explorer
***Developer:*** Sysinternals
-***Description:*** Sysinternals Process Explorer
+***Description:*** Ever wondered which program has a particular file or directory open? Now you can find out. Process Explorer shows you information about which handles and DLLs processes have opened or loaded.
### Process Hacker 3 -***Web:*** https://processhacker.sourceforge.io/nightly.php
+***Web:*** https://processhacker.sourceforge.io
***Developer:*** Process Hacker
-***Description:*** Process Hacker
+***Description:*** A free, powerful, multi-purpose tool that helps you monitor system resources, debug software and detect malware.
### Procmon ***Web:*** https://docs.microsoft.com/en-us/sysinternals/downloads/procmon
***Developer:*** Sysinternals
-***Description:*** Process Monitor
+***Description:*** Process Monitor is an advanced monitoring tool for Windows that shows real-time file system, Registry and process/thread activity. It combines the features of two legacy Sysinternals utilities, Filemon and Regmon, and adds an extensive list of enhancements.
### RegShot ***Web:*** https://github.com/Seabreg/Regshot
@@ -271,6 +269,7 @@ binary took while running on the system.
***Developer:*** Vaibhav Pandey -aka- VPZ
***Description:*** Open-source, cross-platform Qt based IDE for reverse-engineering Android application packages.
+[//]: # (TODO) ### ASCII Art Generator ***Web:*** ???
***Developer:*** ASCII Art Generator
@@ -282,8 +281,8 @@ binary took while running on the system.
***Description:*** AstroGrep is a Microsoft Windows GUI File Searching (grep) utility. Its features include regular expressions, versatile printing options, stores most recent used paths and has a "context" feature which is very nice for looking at source code.
### AVFucker -***Web:*** www.indetectables.net
-***Developer:*** Sr Sombrero
+***Web:*** https://marcoramilli.com/2010/01/02/avfucker-new-version/
+***Developer:*** Marco Ramilli
***Description:*** AVFucker is a tool that helps you evade Antivirus using the “replace byte signature” techniques.
### Cool Beans NFO Creator @@ -307,10 +306,11 @@ binary took while running on the system.
***Description:*** ImpRec is a very handy tool that can be used to repair/reconstruct the import table for packed programs.
### Indetectables Offset Locator -***Web:*** https://www.indetectables.net/viewtopic.php?t=29725
-***Developer:*** Mingo, Yorll & Metal
+***Web:*** https://www.indetectables.net/viewtopic.php?t=29725&sid=d42f7cab211096f4f52fef67efc9b538
+***Developer:*** Mingo, yorll, metal
***Description:*** This is a classic, great tool to clean AV signatures in executables.
+[//]: # (This is a comment.) ### NFO Maker ***Web:*** ???
***Developer:*** The Millenium Group
@@ -319,7 +319,7 @@ binary took while running on the system.
### ProcDOT ***Web:*** https://www.procdot.com/downloadprocdotbinaries.htm
***Developer:*** CERT.at
-***Description:*** ProcDOT - Visual Malware Analysis
+***Description:*** ProcDOT aids malware analysis via visual means, by correlating ProcMon and PCAP data and showing it as an interactive, animated graph. It also detects and shows Thread Injection, smartly follows algorithms, filters out noise, and correlates network events with the involved processes.
### Process-Dump ***Web:*** http://split-code.com/processdump.html
@@ -333,9 +333,10 @@ binary took while running on the system.
### Scylla ***Web:*** https://github.com/NtQuery/Scylla
-***Developer:*** ???
+***Developer:*** The NtQuery team
***Description:*** Great tool for the purpose of rebuilding an Import Table. This is an alternative to ImpRec.
+[//]: # (TODO) ### ShowString ***Web:*** ???
***Developer:*** ???
@@ -358,28 +359,26 @@ binary took while running on the system.
### XOpCodeCalc ***Web:*** https://github.com/horsicq/XOpcodeCalc
-***Developer:*** horsicq
+***Developer:*** Hors
***Description:*** This tool is an x86/64 Opcode calculator. The program works on macOS, Linux and Windows.
## Rootkits Detector ### GMER -***Web:*** www.gmer.net
+***Web:*** http://www.gmer.net
***Developer:*** The GMER dev team.
-***Description:*** GMER is an application that detects and removes rootkits. -It scans for: hidden processes, hidden threads, hidden modules, hidden services, hidden files, hidden disk sectors (MBR), hidden Alternate Data Streams, -hidden registry keys, drivers hooking SSDT, drivers hooking IDT, drivers hooking IRP calls and inline hooks
+***Description:*** GMER is an application that detects and removes rootkits.
### Sysinspector ***Web:*** https://www.eset.com/int/support/sysinspector/
***Developer:*** ESET
-***Description:*** SysInspector scans your operating system and captures details such as running processes, registry content, startup items and network connections. ESET SysInspector is a convenient utility for the toolbox of every IT expert and first responder.
+***Description:*** SET SysInspector scans your operating system and captures details such as running processes, registry content, startup items and network connections. ESET SysInspector is a convenient utility for the toolbox of every IT expert and first responder.
### Windows Kernel Explorer ***Web:*** https://github.com/AxtMueller/Windows-Kernel-Explorer
***Developer:*** AxtMueller
-***Description:*** Windows Kernel Explorer is a free but powerful kernel research tool. It supports from Windows XP to Windows 11. Compared with WIN64AST and PCHunter, WKE can run on the latest Windows 11 without updating binary files.
+***Description:*** Windows Kernel Explorer (you can simply call it as "WKE") is a free but powerful kernel research tool. It supports from Windows XP to Windows 11. Compared with WIN64AST and PCHunter, WKE can run on the latest Windows 11 without updating binary files.
## UnPacking @@ -387,22 +386,22 @@ hidden registry keys, drivers hooking SSDT, drivers hooking IDT, drivers hooking ### De4Dot ***Web:*** https://github.com/de4dot/de4dot
***Developer:*** de4dot
-***Description:*** e4dot is an open source .NET deobfuscator and unpacker written in C#. It will try its best to restore a packed and obfuscated assembly to almost the original assembly.
+***Description:*** de4dot is an open source .NET deobfuscator and unpacker written in C#. It will try its best to restore a packed and obfuscated assembly to almost the original assembly.
### GUnPacker -***Web:*** ???
-***Developer:*** ???
-***Description:*** ???
+***Web:*** http://qunpack.ahteam.org/?p=327 (russian)
+***Developer:*** AHTeam
+***Description:*** This tool is a generic unpacker. It has two main functionalities: (A) OEP positioning, and (B) the dumped code and data can be used to repair the follow-up of a PE header.
### NETUnpack -***Web:*** ???
+***Web:*** https://ntcore.com
***Developer:*** NTCore
-***Description:*** .NET Generic Unpacker
+***Description:*** This is a program to dump .NET packed applications. Of course no serious .NET protection relies on packing. In fact, this software shows how easily you can unpack a protected assemly.
### QUnpack -***Web:*** http://qunpack.ahteam.org
+***Web:*** http://qunpack.ahteam.org (russian)
***Developer:*** Archer
-***Description:*** Generic unpacker
+***Description:*** Yet another generic unpacker. This one, dated from 2010, comes with the source code.
### RL!dePacker ***Web:*** Offline as of now - see developer website, or better yet, google a bit.
@@ -415,11 +414,11 @@ hidden registry keys, drivers hooking SSDT, drivers hooking IDT, drivers hooking ***Description:*** Universal Extractor 2 is a tool designed to extract files from any type of extractable file.
### VM Unpacker -***Web:*** ???
+***Web:*** http://www.leechermods.com/2010/01/vmunpacker-16-latest-version.html (unofficial)
***Developer:*** YingCracker
-***Description:*** Anti Spyware Toolkit VMUnpacker
+***Description:*** This tool uses the technology of Virtual Machines. It can unpack various known & unknown shells. It is suitable for unpacking the shelled Trojan horse in virus analysis, and because all codes are run under the VM, they will not take any danger to your system.
### XVolkolak ***Web:*** http://n10info.blogspot.com/2018/07/xvolkolak-021.html
-***Developer:*** horsicq
+***Developer:*** Hors (https://github.com/horsicq)
***Description:*** XVolkolak is an unpacker emulator.