dynStruct
dynStruct is a tool using dynamoRio to monitor memory accesses of an ELF binary via a data gatherer, and use this data to recover structures of the original code. dynStruct can also be used to quickly find where and by which function a member of a structure is write or read. Papers: dynStruct was the subject of a master thesis and a publication. Requirements: Data gatherer, CMake >= 2.8, DynamoRIO (avoid the last release, recommended version at DynamoRIO cronbuild or build 7.91.18109). Structure recovery and web interface: Python3, Capstone, Bottle. Setup: - Data Gatherer: Set the environment variable DYNAMORIO_HOME to the absolute path of your DynamoRIO installation. Execute build.sh. To compile dynStruct for a 32bits target on a 64bits os, execute build.sh 32. - Structure recovery and web interface: Install dependencies for dynStruct.py using 'pip3 install -r requirements.txt'. Data gatherer Usage: drrun -opt_cleancall 3 -c <dynStruct_path> <dynStruct_args> -- <prog>
FEATURES
EXPLORE BY TAGS
SIMILAR TOOLS
A malware processing and analytics tool that utilizes Pig, Django, and Elasticsearch to analyze and visualize malware data.
A blog post discussing INF-SCT fetch and execute techniques for bypass, evasion, and persistence
Largest open collection of Android malware samples, with 298 samples and contributions welcome.
VolatilityBot automates binary extraction and memory analysis, including detecting code injections and strings.
A .NET wrapper for libyara that provides a simplified API for developing tools in C# and PowerShell.
A PE/COFF file viewer that displays header, section, directory, import table, export table, and resource information within various file types.
A collection of Yara rules for identifying malicious PEs with unique or suspicious PDB paths.
PINNED
Mandos
Fractional CISO service that helps B2B companies implement security leadership to win enterprise deals, achieve compliance, and develop strategic security programs.
Checkmarx SCA
A software composition analysis tool that identifies vulnerabilities, malicious code, and license risks in open source dependencies throughout the software development lifecycle.
Orca Security
A cloud-native application protection platform that provides agentless security monitoring, vulnerability management, and compliance capabilities across multi-cloud environments.
DryRun
A GitHub application that performs automated security code reviews by analyzing contextual security aspects of code changes during pull requests.