diff --git a/malware-analysis_ref_and_memo.md b/malware-analysis_ref_and_memo.md index b594d04..3a1f8cb 100644 --- a/malware-analysis_ref_and_memo.md +++ b/malware-analysis_ref_and_memo.md @@ -41,7 +41,7 @@ DFIR,マルウェア解析,OSINTに特化したUbuntuベースのディスト |[IDA pro](https://www.hex-rays.com/products/ida/)|[Lighthouse](https://github.com/gaasedelen/lighthouse)
[UEFI_RETool](https://github.com/yeggor/UEFI_RETool/tree/master/ida_plugin)
[VT-IDA Plugin](https://github.com/VirusTotal/vt-ida-plugin)
[uEMU](https://github.com/brendantay/uEmu)
[IFL - Interactive Functions List](https://github.com/hasherezade/ida_ifl)|Not free|multi|||||| |[Binary Ninja](https://binary.ninja/)|[Lighthouse](https://github.com/gaasedelen/lighthouse)
[BinDbg](https://github.com/kukfa/bindbg)
[Emotet API+string deobfuscator (v0.1)](https://github.com/mauronz/binja-emotet)|Not free|multi|||||| |[Cutter](https://github.com/radareorg/cutter)|[CutterDRcov](https://github.com/oddcoder/CutterDRcov)
[Jupyter Plugin for Cutter](https://github.com/radareorg/cutter-jupyter)
[x64dbgcutter](https://github.com/yossizap/x64dbgcutter)
[tiny_tracer_tag_to_cutter](https://github.com/Dump-GUY/tiny_tracer_tag_to_cutter)
[etc.](https://github.com/radareorg/cutter-plugins)|free|multi|||||| -|[Ghidra](https://ghidra-sre.org/)|[pwndra](https://github.com/0xb0bb/pwndra)
[ghidra_scripts](https://github.com/alephsecurity/general-research-tools/tree/master/ghidra_scripts)
[OOAnalyzer](https://insights.sei.cmu.edu/sei_blog/2019/07/using-ooanalyzer-to-reverse-engineer-object-oriented-code-with-ghidra.html)
[ghidra_scripts by ghidraninja](https://github.com/ghidraninja/ghidra_scripts)
[ghidra_scripts by AllsafeCyberSecurity](https://github.com/AllsafeCyberSecurity/ghidra_scripts)|free|multi|||||| +|[Ghidra](https://ghidra-sre.org/)|[pwndra](https://github.com/0xb0bb/pwndra)
[ghidra_scripts](https://github.com/alephsecurity/general-research-tools/tree/master/ghidra_scripts)
[OOAnalyzer](https://insights.sei.cmu.edu/sei_blog/2019/07/using-ooanalyzer-to-reverse-engineer-object-oriented-code-with-ghidra.html)
[ghidra_scripts by ghidraninja](https://github.com/ghidraninja/ghidra_scripts)
[ghidra_scripts by AllsafeCyberSecurity](https://github.com/AllsafeCyberSecurity/ghidra_scripts)
[reversing-class](https://github.com/nullteilerfrei/reversing-class)|free|multi|||||| |[x64/x32dbg](https://x64dbg.com/#start)|[DbgChild](https://github.com/David-Reguera-Garcia-Dreg/DbgChild)
[checksec](https://github.com/klks/checksec)
[idenLib](https://github.com/secrary/idenLib)
[xdbg](https://github.com/brock7/xdbg)
[ScyllaHide](https://github.com/x64dbg/ScyllaHide)
[x64dbgpylib](https://github.com/x64dbg/x64dbgpylib)
[ClawSearch](https://github.com/codecat/ClawSearch)
[x64dbg-dark](https://github.com/nextco/x64dbg-dark)
[YaraGen](https://github.com/mrexodia/YaraGen)
[xAnalyzer](https://github.com/ThunderCls/xAnalyzer)
[Unpacking Script](https://github.com/x64dbg/Scripts)|free|windows|||||| |[WinDbg](https://docs.microsoft.com/ja-jp/windows-hardware/drivers/debugger/debugger-download-tools)||free|windows|Kernel mode debugging possible||||| |GDB|gdbpeda
pwngdb|free|linux|[onlinegdb](https://www.onlinegdb.com/)|||||