PHPGGC
0 (0)
A library of PHP unserialize() payloads and a tool to generate them.
The FLARE Obfuscated String Solver (FLOSS, formerly FireEye Labs Obfuscated String Solver) uses advanced static analysis techniques to automatically extract and deobfuscate all strings from malware binaries. You can use it just like strings.exe to enhance the basic static analysis of unknown binaries. Obfuscated Strings Rather than heavily protecting backdoors with hardcore packers, many malware authors evade heuristic detections by obfuscating only key portions of an executable. Often, these portions are strings and resources used to configure domains, files, and other artifacts of an infection. These key features will not show up as plaintext in the output of the strings.exe utility that we commonly use during basic static analysis. FLOSS extracts all the following string types: - static strings: "regular" ASCII and UTF-16LE strings - stack strings: strings constructed on the stack at run-time - tight strings: a special form of stack strings, decoded on the stack - decoded strings: strings decoded in a function Please review the theory behind FLOSS [here](link). Our blog post talks more about the motivation behind FLOSS and details how the tool works. FLOSS version
A library of PHP unserialize() payloads and a tool to generate them.
PinCTF is a tool for using Intel's Pin Tool to instrument reverse engineering binaries and count instructions.
Automate the process of writing YARA rules based on executable code within malware.
A tool that recovers passwords from pixelized screenshots
A tool for searching a Git repository for interesting content
A tool that extracts and deobfuscates strings from malware binaries using advanced static analysis techniques.