Moderator
-- Debuggers:
IDA: hex-rays.com/ida-pro/
x64Dbg:
OllyDbg:
WinDbg:
Live kernel debugger:
-- Static analysis:
IDA: hex-rays.com/ida-pro/
Relyze:
Ghidra:
DnSpy:
Radare2:
ODA:
miasm:
distorm:
lida:
-- Traffic analysis:
Wireshark:
-- Misc:
De4dot:
Exeinfo:
PEiD:
Megadumper:
DiE:
Process dump:
-- SysInternals Suite:
Port monitor:
Process monitor (regmon + filemon):
ProcMon: Monitoring all changes on C drive, useful to see if files are being dropped on drive
ListDlls (also scans unlisted dlls loaded in proc):
Port monitor:
Pipelist (intercept kernel driver comms):
Tcpview:
Handle viewer (reveals all handles a process has open):
Hybrid analysis (virustotal but better):
-- Books
Reverse engineering for beginners:
Practical malware analysis:
IDA: hex-rays.com/ida-pro/
x64Dbg:
You must be registered for see links
OllyDbg:
You must be registered for see links
WinDbg:
You must be registered for see links
Live kernel debugger:
You must be registered for see links
-- Static analysis:
IDA: hex-rays.com/ida-pro/
Relyze:
You must be registered for see links
Ghidra:
You must be registered for see links
DnSpy:
You must be registered for see links
Radare2:
You must be registered for see links
ODA:
You must be registered for see links
miasm:
You must be registered for see links
distorm:
You must be registered for see links
lida:
You must be registered for see links
-- Traffic analysis:
Wireshark:
You must be registered for see links
-- Misc:
De4dot:
You must be registered for see links
Exeinfo:
You must be registered for see links
PEiD:
You must be registered for see links
Megadumper:
You must be registered for see links
DiE:
You must be registered for see links
Process dump:
You must be registered for see links
-- SysInternals Suite:
Port monitor:
You must be registered for see links
Process monitor (regmon + filemon):
You must be registered for see links
ProcMon: Monitoring all changes on C drive, useful to see if files are being dropped on drive
You must be registered for see links
ProcDump:
You must be registered for see links
ListDlls (also scans unlisted dlls loaded in proc):
You must be registered for see links
Port monitor:
You must be registered for see links
Pipelist (intercept kernel driver comms):
You must be registered for see links
Tcpview:
You must be registered for see links
Handle viewer (reveals all handles a process has open):
You must be registered for see links
Hybrid analysis (virustotal but better):
You must be registered for see links
-- Books
Reverse engineering for beginners:
You must be registered for see links
Practical malware analysis:
You must be registered for see links
Last edited:
