Hot answers tagged

4

Another option is Fireye's Windows-based Flare VM. Unlike the Linux-based examples on this page, Flare VM only provides an installer script, not the VM itself. Fortunately, you can get a free Windows VM straight from Microsoft. Their GitHub page has the full (very long) list of tools; here is a snippet: Debuggers flare-qdb scdbg OllyDbg + ...


3

If you consider genetic algorithms as a type of machine learning, here’s an interesting post on using it to create an assembler from opcodes and disassembler: A Fast Track To Assembler Writing You can also check Joxean Koret’s experience on using ML to match binaries to source code, including with machine learning: https://docs.google.com/presentation/d/...


3

I, of course, use uncompyle6. Disclaimer: I work on this project. I've written at length about the uncompyle6 and pycdc here.


2

You did not mention what the format of the binary is. If the decompiler you choose to extend does not support the format of the binary you want to decompile then you will need to either implement support for that format or find a work-around. There are a number of open-source decompiler projects under active development that you can choose from. Of course, ...


2

As mentioned here, IDArling was released recently and is still being actively maintained (last commit was just over a week ago). Notably, it also won the 2018 IDA Plugin Contest.


1

You can use Ghidra for this: https://ghidra-sre.org/ Creating new CPU descriptions is possible. There's nothing obvious in the way of documentation, but there are plenty of examples in the Ghidra/Processors folder. I managed to muddle through and create a new one for the 6502, even though I didn't quite understand everything (and still don't): https://...


1

If I understand you correctly then for what you want to achieve you dont need any tools as word files are just archives. You can use your favourite unzip program and then you can find images in \word\media folder. I dont know python but should be simple to unzip files and search for image files.


1

Depending on the CPU architecture the process targets, there are many dynamic instrumentation tools that can perform this function. However, you have not specified the environment the process of interest runs in. Architecture-specific examples: Intel's pintool. Someone on stackoverflow has already asked about how to use pintool to print all executed ...


1

Here’s a port of Apple’s cctools to Linux, it should include lipo: https://github.com/tpoechtrager/cctools-port


1

I am using burpsuite for HTTPS inspection. Need to install its root cert on the phone. Most apps does not verify cert, or uses phone cert store. Windows users often use Fiddler. These tools generate a new CA cert, that needs to be moved to the phones cert store, and be trusted. In case the app downloads cert first time, and uses SSL pinninng, it is best to ...


1

It seems that most of the people are better using the mitmproxy tool (see docs) together with SSLsplit for this kind of usage. Just for the sake of completeness, here are a few pages explaining how to do: Intercepting SSL and HTTPS traffic with mitmproxy and SSLsplit. MITM attack over HTTPS connection with SSLStrip. Use SSLsplit to transparently sniff TLS/...


1

we can use them so our "machine" can learn how the assembly and executable of these codes look like and just study on them, mastering the art of reversing, and therefore building a tool this way that can reverse any given program with a great accuracy This is a pipe dream for several reasons: Reliably differentiating between code and data in an ...


1

I have used "File Monitor" from SteelWorks (I am not associated with this company in any way) on a non-routed Android device and it works fine.


Only top voted, non community-wiki answers of a minimum length are eligible