bookmarks.md

Contents

1. Web Analysis Tools
2. Analysis Librarys
3. Ida Plugins
4. File Formats
5. Yara
6. File Id and labelling
7. Reverse Engineering Papers

---

Web Analysis Tools

• Unpacme :) - https://unpac.me
• Online Disassembler - https://onlinedisassembler.com/odaweb/

---

Analysis Librarys

Librarys and projects I find helpful for analysis and automation.

• Unicorn - https://www.unicorn-engine.org/
• Capstone - http://www.capstone-engine.org/
• Nucleus (Function Detection)- https://www.vusec.net/projects/function-detection/
  • Fork - https://github.com/idiom/nucleus
• Qiling - https://github.com/qilingframework/qiling

---

IDA Pro

• Qiling IDA Plugin - https://docs.qiling.io/en/latest/ida/

---

File Formats

Portable Executable (PE)

• PE Format https://docs.microsoft.com/en-us/windows/win32/debug/pe-format
• corkami PE Poster - https://github.com/corkami/pics/blob/master/binary/PE.png
• Rich Header - http://bytepointer.com/articles/the_microsoft_rich_header.htm
• .NET File Format
  • https://www.ntcore.com/files/dotnetformat.htm
  • https://ghidra.re/ghidra_docs/api/ghidra/app/util/bin/format/pe/ImageCor20Header.html

---

Yara

• Yara - https://virustotal.github.io/yara/
• Yara Vim Syntax Highlighting - https://github.com/s3rvac/vim-syntax-yara

---

File Id and Labelling

• ClamAV - https://www.clamav.net/
• ClamAV Signatures - https://www.clamav.net/documents/creating-signatures-for-clamav#:~:text=In%20order%20to%20detect%20malware,a%20given%20method%20of%20detection.

Reverse Engineering Papers

• https://github.com/firmianay/security-paper/tree/master/Reverse-Engineering