Administrator
-- Debuggers:
x64Dbg:
IDA: hex-rays.com/ida-pro/
OllyDbg:
WinDbg:
Live kernel debugger:
Ghidra:
Binary Ninja
-- Static analysis:
IDA: hex-rays.com/ida-pro/
Ghidra:
DnSpy:
Radare2:
Binary Ninja
Relyze
JADX
ODA
miasm:
distorm:
lida:
-- Traffic analysis:
Wireshark:
Ettercap:
-- Misc:
ScyllaHide
TitanHide
De4dot:
Exeinfo:
PEiD:
Megadumper:
DiE:
Process dump:
SharpOD:
-- SysInternals Suite:
Port monitor:
Process monitor (regmon + filemon):
ProcMon: Monitoring all changes on C drive, useful to see if files are being dropped on drive
ListDlls (also scans unlisted dlls loaded in proc):
Port monitor:
Pipelist (intercept kernel driver comms):
Tcpview:
Handle viewer (reveals all handles a process has open):
Hybrid analysis (virustotal but better):
-- Books
Reverse engineering for beginners:
Practical malware analysis:
x64Dbg:
You must be registered for see links
IDA: hex-rays.com/ida-pro/
OllyDbg:
You must be registered for see links
WinDbg:
You must be registered for see links
Live kernel debugger:
You must be registered for see links
Ghidra:
You must be registered for see links
Binary Ninja
You must be registered for see links
-- Static analysis:
IDA: hex-rays.com/ida-pro/
Ghidra:
You must be registered for see links
DnSpy:
You must be registered for see links
Radare2:
You must be registered for see links
Binary Ninja
You must be registered for see links
Relyze
You must be registered for see links
JADX
You must be registered for see links
ODA
You must be registered for see links
miasm:
You must be registered for see links
distorm:
You must be registered for see links
lida:
You must be registered for see links
-- Traffic analysis:
Wireshark:
You must be registered for see links
Ettercap:
You must be registered for see links
-- Misc:
ScyllaHide
You must be registered for see links
TitanHide
You must be registered for see links
De4dot:
You must be registered for see links
Exeinfo:
You must be registered for see links
PEiD:
You must be registered for see links
Megadumper:
You must be registered for see links
DiE:
You must be registered for see links
Process dump:
You must be registered for see links
SharpOD:
You must be registered for see links
-- SysInternals Suite:
Port monitor:
You must be registered for see links
Process monitor (regmon + filemon):
You must be registered for see links
ProcMon: Monitoring all changes on C drive, useful to see if files are being dropped on drive
You must be registered for see links
ProcDump:
You must be registered for see links
ListDlls (also scans unlisted dlls loaded in proc):
You must be registered for see links
Port monitor:
You must be registered for see links
Pipelist (intercept kernel driver comms):
You must be registered for see links
Tcpview:
You must be registered for see links
Handle viewer (reveals all handles a process has open):
You must be registered for see links
Hybrid analysis (virustotal but better):
You must be registered for see links
-- Books
Reverse engineering for beginners:
You must be registered for see links
Practical malware analysis:
You must be registered for see links
Last edited:
