sf

Miasm is a gratis together with opened upward source (GPLv2) reverse engineering framework. Miasm aims to analyze / modify / generate binary programs. Here is a not exhaustive listing of features: Opening / modifying / generating PE / ELF 32 / 64 LE / BE using Elfesteem Assembling / Disassembling X86 / ARM / MIPS / SH4 / MSP430 Representing assembly semantic using intermediate language Emulating using JIT (dynamic code analysis, unpacking, ...) Expression simplification for automatic de-obfuscation ... See the official blog for to a greater extent than examples together with demos. Basic examples Assembling / Disassembling Import Miasm x86 architecture: >>> from miasm2.arch.x86.arch import mn_x86 >>> from miasm2.core.locationdb import LocationDB Get a place db: >>> loc_db = LocationDB() Assemble a line: >>> fifty = mn_x86.fromstring('XOR ECX, ECX', loc_db, 32) >>> impress fifty XOR ECX, ECX >...

Ghidra is a software reverse applied scientific discipline (SRE) framework created in addition to maintained past times the National Security Agency Research Directorate. This framework includes a suite of full-featured, high-end software analysis tools that enable users to analyze compiled code on a multifariousness of platforms including Windows, Mac OS, in addition to Linux. Capabilities include disassembly, assembly, decompilation, graphing, in addition to scripting, along alongside hundreds of other features. Ghidra supports a broad multifariousness of procedure teaching sets in addition to executable formats in addition to tin survive run inward both user-interactive in addition to automated modes. Users may also prepare their ain Ghidra plug-in components and/or scripts using Java or Python. In back upwardly of NSA's Cybersecurity mission, Ghidra was built to solve scaling in addition to teaming problems on complex SRE efforts, in addition to to furnish a customiza...

EfiGuard is a portable x64 UEFI bootkit that patches the Windows kicking manager, kicking loader too center at kicking fourth dimension inward club to disable PatchGuard too Driver Signature Enforcement (DSE). Features Currently supports all EFI-compatible versions of Windows x64 e'er released, from Vista SP1 to Server 2019. Easy to use: tin live on booted from a USB stick via a loader application that automatically finds too boots Windows. The driver tin also live on loaded too configured manually using either the UEFI rhythm out or the loader. Makes extensive utilization of the Zydis disassembler library for fast runtime pedagogy decoding to back upwardly to a greater extent than robust analysis than what is possible amongst signature matching, which oftentimes requires changes amongst novel OS updates. Works passively: the driver does non charge or start the Windows kicking manager. Instead it acts on a charge of bootmgfw.efi yesteryear the firmware kicking ...