-
Notifications
You must be signed in to change notification settings - Fork 94
Add Deobfuscation Category & Tools #1615
Copy link
Copy link
Open
Labels
🌀 FLARE-VMA package or feature to be used by FLARE-VMA package or feature to be used by FLARE-VM❔ discussionFurther discussion is neededFurther discussion is needed
Description
Details
Modern malware is increasingly becoming more complex and obfuscated, thus I think it is worthwhile to include tools/libraries to assist with general deobfuscation of executables, outside of the standard .NET deobfuscation and javascript deobfuscation tools we have.
Example List for PE files:
- d810 and/or d810-ng (https://github.com/joydo/d810 / https://github.com/w00tzenheimer/d810-ng)
- z3 (https://github.com/z3prover/z3)
- cvc5 (https://github.com/cvc5/cvc5)
- klee (https://github.com/klee/klee)
- triton (https://github.com/jonathansalwan/triton)
- gooMBA (https://github.com/HexRaysSA/goomba)
- Miasm (https://github.com/cea-sec/miasm)
Example list for additional javascript tools:
- restringer (https://github.com/HumanSecurity/restringer)
- synchrony (https://github.com/relative/synchrony)
- webcrack - (https://github.com/j4k0xb/webcrack)
- jsir (https://github.com/google/jsir)
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
🌀 FLARE-VMA package or feature to be used by FLARE-VMA package or feature to be used by FLARE-VM❔ discussionFurther discussion is neededFurther discussion is needed