18

In computer forensics & pentesting, there are live CDs that have a bunch of tools installed. This makes it easy to boot a machine and have a variety of tools for examining the HDD (for example).

Are there VMs or live CDs with a bunch of RE tools preinstalled?

This would be a great starting point for learners. It would also allow the community to answer questions more easily, by pointing out techniques that use tools already in said VM.

11

One good distro is Kali Linux, from the creators of BackTrack (BackTrack is no longer supported). Kali is Debian-based (unlike its predecessor, which was Ubuntu-based), and it has tools for reverse engineering, data collection and analysis, HDD analysis, forensics, and many other purposes. I can't name the tools off the top of my head; you'd have to boot into it to know the full set of tools (if you've used BackTrack, it's a similar toolset, but simplified based on certain specifications).

Kali Linux is meant to be booted as a live disk (the docs cover how to do that), but you can also install it as a VM (which is what I've done). Persistence can be set up (see the documentation). Additionally, you can actually install it as an operating system, but I'd recommend against it.

One further thing about Kali is that you can customize it for your purposes (minimal install, certain types of install, etc.). I'm not going to go into detail about it. The docs contain further information, as does the main website itself (there is some information about the distro found on the site that isn't necessarily in the docs).

Kali Linux has an irc channel #kali-linux on irc.freenode.net. Be sure to read the docs before asking questions.

  • 3
    FYI backtrack was also based on Slackware. – cb88 Jul 30 '13 at 17:07
10

Here is what I have found so far:

REMnux is a lightweight Linux distribution for assisting malware analysts in reverse-engineering malicious software. The distribution is based on Ubuntu and is maintained by Lenny Zeltser.

  • 2
    Please add a small description for the link. Link only answers are not considered answers. – asheeshr Mar 26 '13 at 15:06
  • 1
    @AshRj, added the description. – EfForEffort Mar 26 '13 at 15:12
7

Much of my reverse engineering environment (IDA and Hex-Rays on Windows) consists of commercial software, so I strongly expect there would be no legitimate free VMs floating around.

  • 2
    Is there anything really significant besides IDA Pro? (The IDA free version could be used, though it's not nearly as nice.) I was thinking the VM would include things like binwalk, distorm, wireshark, python-elfesteem, python-pefile, etc. Stuff like that. – EfForEffort Mar 27 '13 at 14:01
  • 1
    IDA Pro ($1689), Hex-Rays ($2339), Windows (~$200). Over $4k worth of software without adding anything else. – Rolf Rolles Mar 27 '13 at 21:56
  • 2
    @bueno Hex-rays depends on IDA Pro so that's a loss. You could use radare2 as alternative for IDA Pro but to my knowledge there is no plugin for it like Hex-Rays. For OSX there is Hopper which seems to develop nicely, but I can't judge how mature it is. – ixje Mar 29 '13 at 16:15
6

You probably already know about this since you are familiar with pentesting LiveCDs, but Kali Linux (formerly BackTrack) from Offensive Security is an operating system with built-in tools for penetration testing that is based on Debian.

I have not ever used it for performing reverse-engineering, but it is available to download both as a .iso and as a VMWare image. It is available at http://www.kali.org/

  • Yes BT includes tools such as IDApro and ollydbg – mrhobbeys Mar 26 '13 at 16:43
4

Another option is Fireye's Windows-based Flare VM.

Unlike the Linux-based examples on this page, Flare VM only provides an installer script, not the VM itself. Fortunately, you can get a free Windows VM straight from Microsoft.

Their GitHub page has the full (very long) list of tools; here is a snippet:

Debuggers

  • flare-qdb
  • scdbg
  • OllyDbg + OllyDump + OllyDumpEx
  • OllyDbg2 + OllyDumpEx
  • x64dbg
  • WinDbg + OllyDumpex + pykd

Decompilers

  • RetDec
  • Jd-gui and bytecode-viewer
  • dnSpy
  • IDR
  • VBDecompiler
  • Py2ExeDecompiler

Disassemblers

  • IDA Free (5.0 & 7.0)
  • Binary Ninja Demo
  • Radare2 and Cutter
3
  • 1
    An answer like this doesn't offer very much information. Anyone can compile a list of links. It would be nice to get a little more of a description about each OS you're linking to without having to click the actual links. Please expand the answer to include some of the features. – JMcAfreak Jul 29 '13 at 20:26
3

FSL - Fedora Security Lab (also known as ​Fedora Security Spin).

The Fedora Security Spin is a livecd based on Fedora to provide a safe test-environment for working on security-auditing, forensics and penetration-testing, coupled with all the Fedora-Security features and tools.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.