└── README.md /README.md: -------------------------------------------------------------------------------- 1 | # awesome-reversing 2 | 3 | A curated list of awesome reversing resources 4 | 5 | - [Awesome Reversing](#awesome-reversing) 6 | - [Books](#books) 7 | - [Courses](#courses) 8 | - [Channels](#channels) 9 | - [Practice](#practice) 10 | - [Hex Editors](#hex-editors) 11 | - [Binary Format](#binary-format) 12 | - [Disassemblers](#disassemblers) 13 | - [Binary Analysis](#binary-analysis) 14 | - [Bytecode Analysis](#bytecode-analysis) 15 | - [Import Reconstruction](#import-reconstruction) 16 | - [Dynamic Analysis](#dynamic-analysis) 17 | - [Debugging](#debugging) 18 | - [Mac Decrypt](#mac-decrypt) 19 | - [Document Analysis](#document-analysis) 20 | - [Scripting](#scripting) 21 | - [Android](#android) 22 | - [Yara](#yara) 23 | 24 | - - - 25 | 26 | ## Books 27 | 28 | *Reverse Engineering Books* 29 | 30 | * [The IDA Pro Book](http://amzn.com/1593272898) 31 | * [Reverse Engineering for Beginners](http://beginners.re/) 32 | * [Assembly Language for Intel-Based Computers (5th Edition) ](http://a.co/4OR6I9U) 33 | * [Practical Reverse Engineering](http://amzn.com/B00IA22R2Y) 34 | * [Reversing: Secrets of Reverse Engineering](http://amzn.com/B007032XZK) 35 | * [Practical Malware Analysis](http://amzn.com/1593272901) 36 | * [Malware Analyst's Cookbook](http://amzn.com/B0047DWCMA) 37 | * [Gray Hat Hacking](http://amzn.com/0071832386) 38 | * [The Art of Memory Forensics](http://amzn.com/1118825098) 39 | * [Hacking: The Art of Exploitation](http://amzn.com/1593271441) 40 | * [Fuzzing for Software Security](http://amzn.com/1596932147) 41 | * [Art of Software Security Assessment](http://amzn.com/0321444426) 42 | * [The Antivirus Hacker's Handbook](http://amzn.com/1119028752) 43 | * [The Rootkit Arsenal](http://amzn.com/144962636X) 44 | * [Windows Internals Part 1](http://amzn.com/0735648735) [Part 2](http://amzn.com/0735665877) 45 | * [Inside Windows Debugging](http://amzn.com/0735662789) 46 | * [iOS Reverse Engineering](https://github.com/iosre/iOSAppReverseEngineering) 47 | * [The Shellcoders Handbook](http://a.co/6H55943) 48 | * [A Guide to Kernel Exploitation](http://a.co/aM4cENn) 49 | * [Agner's software optimization resources](http://www.agner.org/optimize/) 50 | * [Learning Malware Analysis](https://www.amazon.com/Learning-Malware-Analysis-techniques-investigate/dp/1788392507/) 51 | * [Binary Analysis](https://nostarch.com/binaryanalysis) 52 | * [Rootkits and Bootkits](https://nostarch.com/rootkits) 53 | * [Serious Cryptography](https://nostarch.com/seriouscrypto) 54 | 55 | ## Courses 56 | 57 | *Reverse Engineering Courses* 58 | 59 | * [Lenas Reversing for Newbies](https://tuts4you.com/download.php?list.17) 60 | * [Open Security Training](http://opensecuritytraining.info/Training.html) 61 | * [Dr. Fu's Malware Analysis](http://fumalwareanalysis.blogspot.sg/p/malware-analysis-tutorials-reverse.html) 62 | * [Binary Auditing Course](http://www.binary-auditing.com/) 63 | * [TiGa's Video Tutorials](http://www.woodmann.com/TiGa/) 64 | * [Legend of Random](https://tuts4you.com/download.php?list.97) 65 | * [Practical Malware Analysis](https://samsclass.info/126/126_S17.shtml) 66 | * [Modern Binary Exploitation](http://security.cs.rpi.edu/courses/binexp-spring2015/) 67 | * [RPISEC Malware Course](https://github.com/RPISEC/Malware) 68 | * [begin.re](https://www.begin.re/) 69 | * [RE101](https://securedorg.github.io/RE101/) 70 | * [RE102](https://securedorg.github.io/RE102/) 71 | * [ARM Assembly Basics](https://azeria-labs.com/writing-arm-assembly-part-1/) 72 | * [Offensive and Defensive Android Reversing](https://github.com/rednaga/training/raw/master/DEFCON23/O%26D%20-%20Android%20Reverse%20Engineering.pdf) 73 | 74 | ## Channels 75 | 76 | *Binary Analysis Channels* 77 | 78 | * [OALabs](https://www.youtube.com/channel/UC--DwaiMV-jtO-6EvmKOnqg) 79 | * [MalwareTech](https://www.youtube.com/channel/UCLDnEn-TxejaDB8qm2AUhHQ) 80 | * [GynvaelEN](https://www.youtube.com/user/GynvaelEN) 81 | * [VirusBtn](https://www.youtube.com/user/virusbtn) 82 | * [Intro to WinDBG](https://www.youtube.com/playlist?list=PLhx7-txsG6t6n_E2LgDGqgvJtCHPL7UFu) 83 | * [hasherzade](https://www.youtube.com/channel/UCNWVswPNgn5kutPNa5sprkg) 84 | * [Colin Hardy](https://www.youtube.com/channel/UCND1KVdVt8A580SjdaS4cZg) 85 | * [MalwareAnalysisHedgehog](https://www.youtube.com/channel/UCVFXrUwuWxNlm6UNZtBLJ-A) 86 | 87 | 88 | ## Practice 89 | 90 | *Practice Reverse Engineering. Be careful with malware.* 91 | 92 | * [Crackmes.de](http://www.crackmes.de/) 93 | * [OSX Crackmes](https://reverse.put.as/crackmes/) 94 | * [ESET Challenges](http://www.joineset.com/jobs-analyst.html) 95 | * [Flare-on Challenges](http://flare-on.com/) 96 | * [Github CTF Archives](http://github.com/ctfs/) 97 | * [Reverse Engineering Challenges](http://challenges.re/) 98 | * [xorpd Advanced Assembly Exercises](http://www.xorpd.net/pages/xchg_rax/snip_00.html) 99 | * [Virusshare.com](http://virusshare.com/) 100 | * [Contagio](http://contagiodump.blogspot.com/) 101 | * [Malware-Traffic-Analysis](https://malware-traffic-analysis.com/) 102 | * [Malshare](http://malshare.com/) 103 | * [Malware Blacklist](http://www.malwareblacklist.com/showMDL.php) 104 | * [malwr.com](https://malwr.com/) 105 | * [vxvault](http://vxvault.net/) 106 | 107 | ## Hex Editors 108 | 109 | *Hex Editors* 110 | 111 | * [HxD](https://mh-nexus.de/en/hxd/) 112 | * [010 Editor](http://www.sweetscape.com/010editor/) 113 | * [Hex Workshop](http://www.hexworkshop.com/) 114 | * [HexFiend](http://ridiculousfish.com/hexfiend/) 115 | * [Hiew](http://www.hiew.ru/) 116 | 117 | ## Binary Format 118 | 119 | *Binary Format Tools* 120 | 121 | * [CFF Explorer](http://www.ntcore.com/exsuite.php) 122 | * [Cerbero Profiler](http://cerbero.io/profiler/) // [Lite PE Insider](http://cerbero.io/peinsider/) 123 | * [Detect It Easy](http://ntinfo.biz/) 124 | * [PeStudio](http://www.winitor.com/) 125 | * [PEiD](https://tuts4you.com/download.php?view.398) 126 | * [PPEE](https://www.mzrst.com/) 127 | * [MachoView](https://github.com/gdbinit/MachOView) 128 | * [nm](https://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/man1/nm.1.html) - View Symbols 129 | * [file](https://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/man1/file.1.html) - File information 130 | * [codesign](https://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/man1/codesign.1.html) - Code signing information usage: codesign -dvvv filename 131 | 132 | ## Disassemblers/Decompilers 133 | 134 | *Disassemblers/Decompilers* 135 | 136 | * [Ghidra](https://ghidra-sre.org/) 137 | * [IDA Pro](https://www.hex-rays.com/products/ida/index.shtml) 138 | * [Binary Ninja](https://binary.ninja/) 139 | * [JEB](https://www.pnfsoftware.com/jeb2/) 140 | * [Radare](http://www.radare.org/r/) 141 | * [Hopper](http://hopperapp.com/) 142 | * [Capstone](http://www.capstone-engine.org/) 143 | * [objdump](http://linux.die.net/man/1/objdump) 144 | * [fREedom](https://github.com/cseagle/fREedom) 145 | * [Retdec](https://retdec.com/) 146 | * [Snowman](https://derevenets.com/) 147 | 148 | ## Binary Analysis 149 | 150 | *Binary Analysis Resources* 151 | 152 | * [Mobius Resources](http://www.msreverseengineering.com/research/) 153 | * [z3](https://z3.codeplex.com/) 154 | * [bap](https://github.com/BinaryAnalysisPlatform/bap) 155 | * [angr](https://github.com/angr/angr) 156 | 157 | ## Bytecode Analysis 158 | 159 | *Bytecode Analysis Tools* 160 | 161 | * [dnSpy](https://github.com/0xd4d/dnSpy) 162 | * [Bytecode Viewer](https://bytecodeviewer.com/) 163 | * [Bytecode Visualizer](http://www.drgarbage.com/bytecode-visualizer/) 164 | * [JPEXS Flash Decompiler](https://www.free-decompiler.com/flash/) 165 | 166 | ## Import Reconstruction 167 | 168 | *Import Reconstruction Tools* 169 | 170 | * [ImpRec](http://www.woodmann.com/collaborative/tools/index.php/ImpREC) 171 | * [Scylla](https://github.com/NtQuery/Scylla) 172 | * [LordPE](http://www.woodmann.com/collaborative/tools/images/Bin_LordPE_2010-6-29_3.9_LordPE_1.41_Deluxe_b.zip) 173 | 174 | ## Dynamic Analysis 175 | 176 | *Dynamic Analysis Tools* 177 | 178 | * [ProcessHacker](http://processhacker.sourceforge.net/) 179 | * [Process Explorer](https://technet.microsoft.com/en-us/sysinternals/processexplorer) 180 | * [Process Monitor](https://technet.microsoft.com/en-us/sysinternals/processmonitor) 181 | * [Autoruns](https://technet.microsoft.com/en-us/sysinternals/bb963902) 182 | * [Noriben](https://github.com/Rurik/Noriben) 183 | * [API Monitor](http://www.rohitab.com/apimonitor) 184 | * [iNetSim](http://www.inetsim.org/) 185 | * [Wireshark](https://www.wireshark.org/download.html) 186 | * [Fakenet](http://practicalmalwareanalysis.com/fakenet/) 187 | * [netzob](https://www.netzob.org/) 188 | * [Volatility](https://github.com/volatilityfoundation/volatility) 189 | * [Dumpit](http://www.moonsols.com/products/) 190 | * [LiME](https://github.com/504ensicsLabs/LiME) 191 | * [Cuckoo](https://www.cuckoosandbox.org/) 192 | * [Objective-See Utilities](https://objective-see.com/products.html) 193 | * [XCode Instruments](https://developer.apple.com/xcode/download/) - XCode Instruments for Monitoring Files and Processes [User Guide](https://developer.apple.com/library/watchos/documentation/DeveloperTools/Conceptual/InstrumentsUserGuide/index.html) 194 | * [dtrace](http://dtrace.org/blogs/brendan/2011/10/10/top-10-dtrace-scripts-for-mac-os-x/) - sudo dtruss = strace [dtrace recipes](http://mfukar.github.io/2014/03/19/dtrace.html) 195 | * [fs_usage](https://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/man1/fs_usage.1.html) - report system calls and page faults related to filesystem activity in real-time. File I/O: fs_usage -w -f filesystem 196 | * [dmesg](https://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/man8/dmesg.8.html) - display the system message buffer 197 | 198 | ## Debugging 199 | 200 | *Debugging Tools* 201 | 202 | * [WinDbg](https://msdn.microsoft.com/en-us/windows/hardware/hh852365.aspx) 203 | * [OllyDbg v1.10](http://www.ollydbg.de/) 204 | * [OllyDbg v2.01](http://www.ollydbg.de/version2.html) 205 | * [OllySnD](https://tuts4you.com/download.php?view.2061) 206 | * [Olly Shadow](https://tuts4you.com/download.php?view.6) 207 | * [Olly CiMs](https://tuts4you.com/download.php?view.1206) 208 | * [Olly UST_2bg](https://tuts4you.com/download.php?view.1206) 209 | * [x64dbg](http://x64dbg.com/#start) 210 | * [gdb](https://www.gnu.org/software/gdb/) 211 | * [vdb](https://github.com/vivisect/vivisect) 212 | * [lldb](http://lldb.llvm.org/) 213 | * [qira](http://qira.me/) 214 | * [unicorn](https://github.com/unicorn-engine/unicorn) 215 | 216 | ## Mac Decrypt 217 | 218 | *Mac Decrypting Tools* 219 | 220 | * [Cerbero Profiler](http://cerbero-blog.com/?p=1311) - Select all -> Copy to new file 221 | * [AppEncryptor](https://github.com/AlanQuatermain/appencryptor) - Tool for decrypting 222 | * [Class-Dump](http://stevenygard.com/projects/class-dump/) - use deprotect option 223 | * [readmem](https://github.com/gdbinit/readmem) - OS X Reverser's process dumping tool 224 | 225 | ## Document Analysis 226 | 227 | *Document Analysis Tools* 228 | 229 | * [Ole Tools](http://www.decalage.info/python/oletools) 230 | * [Didier's PDF Tools](http://blog.didierstevens.com/programs/pdf-tools/) 231 | * [Origami](https://github.com/cogent/origami-pdf) 232 | 233 | ## Scripting 234 | 235 | *Scripting* 236 | 237 | * [IDA Python Src](https://github.com/idapython/src) 238 | * [IDC Functions Doc](https://www.hex-rays.com/products/ida/support/idadoc/162.shtml) 239 | * [Using IDAPython to Make your Life Easier](http://researchcenter.paloaltonetworks.com/tag/idapython/) 240 | * [Introduction to IDA Python](https://tuts4you.com/download.php?view.3229) 241 | * [The Beginner's Guide to IDA Python](https://leanpub.com/IDAPython-Book) 242 | * [IDA Plugin Contest](https://www.hex-rays.com/contests/) 243 | * [onehawt IDA Plugin List](https://github.com/onethawt/idaplugins-list) 244 | * [pefile Python Libray](https://github.com/erocarrera/pefile) 245 | * [ghidra ninja](https://github.com/ghidraninja/ghidra_scripts) 246 | 247 | ## Android 248 | 249 | *Android tools* 250 | 251 | * [Android Developer Studio](http://developer.android.com/sdk/index.html) 252 | * [APKtool](http://ibotpeaches.github.io/Apktool/) 253 | * [dex2jar](https://github.com/pxb1988/dex2jar) 254 | * [Bytecode Viewer](https://bytecodeviewer.com/) 255 | * [IDA Pro](https://www.hex-rays.com/products/ida/index.shtml) 256 | 257 | ## Yara 258 | 259 | *Yara Resources* 260 | 261 | * [Yara docs](http://yara.readthedocs.org/en/v3.4.0/writingrules.html) 262 | * [Cheatsheet](https://gist.github.com/tylerha97/eeabc765e9befad9b80a) 263 | * [yarGen](https://github.com/Neo23x0/yarGen) 264 | * [yabin](https://github.com/AlienVault-OTX/yabin) 265 | * [Yara First Presentation](/Users/thalfpop/Downloads/first_2014_-_schuster-_andreas_-_yara_basic_and_advanced_20140619.pdf) 266 | --------------------------------------------------------------------------------