0

i am really glad i found this great site and wanted to ask from your expertise regarding the following issue:

i have been doing malware analysis and researching for a few years, and i want to learn something new; a new tool to deepen my understanding while utilizing it for mundane tasks.

i want to learn modern dynamic instrumentation. i searched the web and literacy and found a couple of suggestions: dynamorio, pin/pintools, frida(familiar with already), lief, triton, angr and manticore.

i need the "tool" to have a lowest overhead(i know it depends also on the way i implement the scripts), and it will mainly be used for reverse engineering, pe research and mostly for exploit development.

what should i learn in order to gain the benefits for what i mentioned? i didn't specify architecture as i will be using it on windows,linux,arm and mips (if there are other tools or better ones, i would really love to learn from your input to improve myself and gain new skills).

on a side note, i know that dynamorio is being used on winafl and other fork, but it seems quite old, so i was wondering if there's something newer with lower overheads for vulnerability research/malware analysis purposes.

on a side note, i tried to check several conferences for notes and talks regarding the issue, but i saw that every year there seems to be something new, and a few months later something newer, so i am wondering, what is the current "cool toy" of 2020?

would love to learn from your inputs and study what you mentioned to improve my knowledge base. thank you very much

1

Some may favor miasm over other frameworks (see for instance the Advanced Binary Deobfuscation material). Examples:

  1. Analyzing Shellcodes with Miasm for Fun and Profit
  2. ZeusVM analysis

The Qiling emulator has been used for binary analysis and in conjunction with AFL++. Examples:

  1. Moving From Dynamic Emulation of UEFI Modules To Coverage-Guided Fuzzing of UEFI Firmware
  2. PE Emulation With Code Coverage Using Qiling and Dragon Dance

Not the answer you're looking for? Browse other questions tagged or ask your own question.