19

In computer forensics & pentesting, there are live CDs that have a bunch of tools installed. This makes it easy to boot a machine and have a variety of tools for examining the HDD (for example).

Are there VMs or live CDs with a bunch of RE tools preinstalled?

This would be a great starting point for learners. It would also allow the community to answer questions more easily, by pointing out techniques that use tools already in said VM.

Improve this question

7 Answers 7

Reset to default
11

One good distro is Kali Linux, from the creators of BackTrack (BackTrack is no longer supported). Kali is Debian-based (unlike its predecessor, which was Ubuntu-based), and it has tools for reverse engineering, data collection and analysis, HDD analysis, forensics, and many other purposes. I can't name the tools off the top of my head; you'd have to boot into it to know the full set of tools (if you've used BackTrack, it's a similar toolset, but simplified based on certain specifications).

Kali Linux is meant to be booted as a live disk (the docs cover how to do that), but you can also install it as a VM (which is what I've done). Persistence can be set up (see the documentation). Additionally, you can actually install it as an operating system, but I'd recommend against it.

One further thing about Kali is that you can customize it for your purposes (minimal install, certain types of install, etc.). I'm not going to go into detail about it. The docs contain further information, as does the main website itself (there is some information about the distro found on the site that isn't necessarily in the docs).

Kali Linux has an irc channel #kali-linux on irc.freenode.net. Be sure to read the docs before asking questions.

Improve this answer
1
  • 3
    FYI backtrack was also based on Slackware.
    – cb88
    Commented Jul 30, 2013 at 17:07
11

Here is what I have found so far:

REMnux is a lightweight Linux distribution for assisting malware analysts in reverse-engineering malicious software. The distribution is based on Ubuntu and is maintained by Lenny Zeltser.

Improve this answer
2
  • 2
    Please add a small description for the link. Link only answers are not considered answers.
    – asheeshr
    Commented Mar 26, 2013 at 15:06
  • 1
    @AshRj, added the description.
    – EfForEffort
    Commented Mar 26, 2013 at 15:12
8

Much of my reverse engineering environment (IDA and Hex-Rays on Windows) consists of commercial software, so I strongly expect there would be no legitimate free VMs floating around.

Improve this answer
3
  • 2
    Is there anything really significant besides IDA Pro? (The IDA free version could be used, though it's not nearly as nice.) I was thinking the VM would include things like binwalk, distorm, wireshark, python-elfesteem, python-pefile, etc. Stuff like that.
    – EfForEffort
    Commented Mar 27, 2013 at 14:01
  • 1
    IDA Pro ($1689), Hex-Rays ($2339), Windows (~$200). Over $4k worth of software without adding anything else.
    – Rolf Rolles
    Commented Mar 27, 2013 at 21:56
  • 2
    @bueno Hex-rays depends on IDA Pro so that's a loss. You could use radare2 as alternative for IDA Pro but to my knowledge there is no plugin for it like Hex-Rays. For OSX there is Hopper which seems to develop nicely, but I can't judge how mature it is.
    – ixje
    Commented Mar 29, 2013 at 16:15
6

You probably already know about this since you are familiar with pentesting LiveCDs, but Kali Linux (formerly BackTrack) from Offensive Security is an operating system with built-in tools for penetration testing that is based on Debian.

I have not ever used it for performing reverse-engineering, but it is available to download both as a .iso and as a VMWare image. It is available at http://www.kali.org/

Improve this answer
1
  • Yes BT includes tools such as IDApro and ollydbg
    – mrhobbeys
    Commented Mar 26, 2013 at 16:43
4

Another option is Fireye's Windows-based Flare VM.

Unlike the Linux-based examples on this page, Flare VM only provides an installer script, not the VM itself. Fortunately, you can get a free Windows VM straight from Microsoft.

Their GitHub page has the full (very long) list of tools; here is a snippet:

Debuggers

  • flare-qdb
  • scdbg
  • OllyDbg + OllyDump + OllyDumpEx
  • OllyDbg2 + OllyDumpEx
  • x64dbg
  • WinDbg + OllyDumpex + pykd

Decompilers

  • RetDec
  • Jd-gui and bytecode-viewer
  • dnSpy
  • IDR
  • VBDecompiler
  • Py2ExeDecompiler

Disassemblers

  • IDA Free (5.0 & 7.0)
  • Binary Ninja Demo
  • Radare2 and Cutter
Improve this answer
3
Improve this answer
1
  • 1
    An answer like this doesn't offer very much information. Anyone can compile a list of links. It would be nice to get a little more of a description about each OS you're linking to without having to click the actual links. Please expand the answer to include some of the features.
    – JMcAfreak
    Commented Jul 29, 2013 at 20:26
3

FSL - Fedora Security Lab (also known as ​Fedora Security Spin).

The Fedora Security Spin is a livecd based on Fedora to provide a safe test-environment for working on security-auditing, forensics and penetration-testing, coupled with all the Fedora-Security features and tools.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.