首页
社区
课程
招聘
问答 CTF 排行榜 知识库 工具下载 峰会 看雪商城 证书查询
  1. 社区
  2. 安全工具
    3. 发新帖
[转帖]开源项目：逆向工程资源：2019年12月23日更新
发表于: 2020-10-31 17:01 13566

[转帖]开源项目：逆向工程资源：2019年12月23日更新

梦幻的彼岸 活跃值
2
2020-10-31 17:01
13566

简介

逆向工程资源，涉及所有平台（Windows / Linux / macOS / Android / iOS / IoT）以及各个方面！ （超过3500个开源工具和2300个帖子和视频）

论坛备份阅览

 

目录

 

更新完善中

所有收集类项目:

  • 收集的所有开源工具: 超过18K, 包括Markdown和Json两种格式
  • 逆向资源: IDA/Ghidra/x64dbg/OllDbg/WinDBG/CuckooSandbox/Radare2/BinaryNinja/DynamoRIO/IntelPin/Frida/QEMU/Android安全/iOS安全/Window安全/Linux安全/macOS安全/游戏Hacking/Bootkit/Rootkit/Angr/Shellcode/进程注入/代码注入/DLL注入/WSL/Sysmon/...
  • 网络相关的安全资源: 代理/GFW/反向代理/隧道/VPN/Tor/I2P，以及中间人/PortKnocking/嗅探/网络分析/网络诊断等
  • 攻击性网络安全资源: 漏洞/渗透/物联网安全/数据渗透/Metasploit/BurpSuite/KaliLinux/C&C/OWASP/免杀/CobaltStrike/侦查/OSINT/社工/密码/凭证/威胁狩猎/Payload/WifiHacking/无线攻击/后渗透/提权/UAC绕过/...

ReverseEngineering

  • 跟逆向有关的资源收集。当前包括的工具个数4600+，并根据功能进行了粗糙的分类。部分工具添加了中文描述。当前包括文章数600左右。
  • 此页只包含部分内容. 查看完整版

说明

EnglishVersion

TODO

  • 对工具进行更细致的分类
  • 为工具添加详细的中文描述，包括其内部实现原理和使用方式
  • 添加非Github repo
  • 补充文章
  • 修改已添加文章的描述

IDA

插件&&脚本

  • 以Github开源工具为主

新添加的

未分类

  • [1058星][9d] [Py] fireeye/flare-ida 多工具
    • StackStrings 自动恢复手动构造的字符串
    • Struct Typer implements the struct typing described here
    • ApplyCalleeType specify or choose a function type for indirect calls as described here
    • argtracker 识别函数使用的静态参数
    • idb2pat FLIRT签名生成
    • objc2_analyzer 在目标Mach-O可执行文件的与Objective-C运行时相关的部分中定义的选择器引用及其实现之间创建交叉引用
    • MSDN Annotations 从XML文件中提取MSDN信息，添加到IDB数据库中
    • ironstrings 使用代码模拟执行（flare-emu）, 恢复构造的字符串
    • Shellcode Hashes 生成Hash数据库
  • [737星][7m] [Py] devttys0/ida IDA插件/脚本/模块收集
    • wpsearch 查找在MIPS WPS checksum实现中常见的立即数
    • md5hash 纯Python版的MD5 hash实现（IDA的hashlib有问题）
    • alleycat 查找向指定的函数内代码块的路径、查找两个或多个函数之间的路径、生成交互式调用图、可编程
    • codatify 定义IDA自动化分析时miss的ASCII字符串、函数、代码。将data段的所有未定义字节转换为DWORD（于是IDA可识别函数和跳转表指针）
    • fluorescence 高亮函数调用指令
    • leafblower 识别常用的POSIX函数：printf, sprintf, memcmp, strcpy等
    • localxrefs 在当前函数内部查找所有对任意选择文本的引用
    • mipslocalvars 对栈上只用于存储寄存器的变量进行命名，简化栈数据分析（MISP）
    • mipsrop 在MIPS可执行代码中搜寻ROP。查找常见的ROP
    • rizzo 对2个或多个IDB之间的函数进行识别和重命名，基于：函数签名、对唯一字符串/常量的引用、模糊签名、调用图
  • [318星][2m] [C] ohjeongwook/darungrim 软件补丁分析工具
  • [277星][4m] [Py] jpcertcc/aa-tools 多脚本

结构体&&类的检测&&创建&&恢复

未分类

C++类&&虚表

1
2
3
4
5
6
7
8
9
10
11
12
13
## 静态部分:
- 检测非直接调用
- 利用条件断点, Hook非直接调用的值赋值过程
 
## 动态 部分
- 创建虚表结构
- 重命名函数和虚表地址
- 给反汇编非直接调用添加结构偏移
- 给非直接调用到虚表之间添加交叉引用
 
## 使用
- File -> Script File -> Main.py(设置断点) -> IDA调试器执行
</details>

收集

外观&&主题

固件&&嵌入式设备

签名(FLIRT等)&&比较(Diff)&&匹配

未分类

FLIRT签名

FLIRT签名收集
FLIRT签名生成

Diff&&Match工具

Yara

IDB操作

协作逆向&&多人操作相同IDB文件

与调试器同步&&通信&&交互

导入导出&与其他工具交互

未分类

Ghidra

BinNavi

BinaryNinja

Radare2

Frida

IntelPin

针对特定分析目标

未分类

Loader&Processor

GoLang

Windows驱动

PS3&&PS4

PDB

Flash&&SWF

特定样本家族

CTF

IDAPython本身

未分类

cheatsheets

指令参考&文档

辅助脚本编写

未分类

Qt

控制台&&窗口界面

  • [269星][30d] [Py] eset/ipyida 集成IPython控制台

插件模板

其他语言

古老的

调试&&动态运行&动态数据

未分类

DBI数据

调试数据

1
2
3
4
5
6
7
8
9
10
11
12
13
## 静态部分:
- 检测非直接调用
- 利用条件断点, Hook非直接调用的值赋值过程
 
## 动态 部分
- 创建虚表结构
- 重命名函数和虚表地址
- 给反汇编非直接调用添加结构偏移
- 给非直接调用到虚表之间添加交叉引用
 
## 使用
- File -> Script File -> Main.py(设置断点) -> IDA调试器执行
</details>
  • [386星][5m] [Py] ynvb/die 使用IDA调试器收集动态运行信息, 辅助静态分析

反编译器&&AST

1
2
3
4
5
- 自动类型重建
- 虚表识别/导航(反编译窗口)
- C-tree可视化与导出
- 对象浏览
</details>

反混淆

效率&&导航&&快速访问&&图形&&图像&&可视化

其他

1
2
3
4
5
- 自动类型重建
- 虚表识别/导航(反编译窗口)
- C-tree可视化与导出
- 对象浏览
</details>
1
2
3
4
5
6
7
### 功能
- 快速移除函数返回类型
- 数据格式(format)快速转换
- 扫描字符串格式化漏洞
- 双击跳转vtable函数
- 快捷键: w/c/v
</details>

显示增强

图形&&图像

  • [2569星][5m] [Java] google/binnavi 二进制分析IDE, 对反汇编代码的控制流程图和调用图进行探查/导航/编辑/注释.(IDA插件的作用是导出反汇编)

搜索

Android

Apple&&macOS&&iXxx&&Objective-C&&SWift&&Mach-O

未分类

内核缓存

Mach-O

Swift

ELF

Microcode

模拟器集成

作为辅助&&构成其他的一环

漏洞

未分类

1
2
3
4
5
6
7
### 功能
- 快速移除函数返回类型
- 数据格式(format)快速转换
- 扫描字符串格式化漏洞
- 双击跳转vtable函数
- 快捷键: w/c/v
</details>

ROP

补丁&&Patch

其他

函数相关

未分类

重命名&&前缀&&标记

导航&&查看&&查找

demangle

污点分析&&符号执行

字符串

1
2
3
4
5
6
7
### 功能
- 快速移除函数返回类型
- 数据格式(format)快速转换
- 扫描字符串格式化漏洞
- 双击跳转vtable函数
- 快捷键: w/c/v
</details>

加密解密

文章

新添加的

未分类

Tips&&Tricks

系列文章-Labeless插件介绍

系列文章-使用IDA从零开始学逆向

系列文章-IDAPython-让你的生活更美好

原文

译文

系列文章-使用IDA逆向C代码

工具&&插件&&脚本介绍

未分类

Loader&&Processor

与其他工具交互

翻译-TheIDAProBook

翻译-ReverseEngineeringCodeWithIDAPro

IDA本身

逆向实战

未分类

恶意代码分析

漏洞分析&&挖掘

Microcode

IDA对抗

Ghidra

插件&&脚本

Ghidra

新添加的

特定分析目标

未分类

Loader&&Processor

Xbox

与其他工具交互

未分类

Radare2

IDA

DBI

调试器

外观&&主题

脚本编写

其他

编程语言

文章&&视频

新添加的1

新添加的

Ghidra漏洞

实战分析

未分类

漏洞分析&&挖掘

恶意代码

其他

Tips&&Tricks

工具&&插件&&脚本

x64dbg

插件&&脚本

x64dbg

  • [34576星][26d] [C++] x64dbg/x64dbg Windows平台x32/x64调试器

新添加的

文章&&视频

OllyDbg

插件&&脚本

新添加的

文章&&视频

WinDBG

插件&&脚本

新添加的

文章&&视频

Android

工具

新添加的1

  • [6101星][2m] [Java] google/android-classyshark 分析基于Android/Java的App或游戏
  • [6094星][5m] [Java] qihoo360/replugin RePlugin - A flexible, stable, easy-to-use Android Plug-in Framework
  • [5195星][11d] [Py] mobsf/mobile-security-framework-mobsf Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.
  • [5084星][7d] [HTML] owasp/owasp-mstg 关于移动App安全开发、测试和逆向的相近手册
  • [4882星][16d] [Java] guardianproject/haven 通过Android应用和设备上的传感器保护自己的个人空间和财产而又不损害
  • [4776星][4d] [C++] facebook/redex Android App字节码优化器
  • [4306星][7d] [Shell] ashishb/android-security-awesome A collection of android security related resources
  • [3649星][1m] [C++] anbox/anbox 在常规GNU / Linux系统上引导完整的Android系统，基于容器
  • [2314星][1y] [Java] csploit/android cSploit - The most complete and advanced IT security professional toolkit on Android.
  • [2120星][9m] [Py] linkedin/qark 查找Android App的漏洞, 支持源码或APK文件
  • [2095星][10m] jermic/android-crack-tool
  • [2051星][13d] [Py] sensepost/objection runtimemobile exploration
  • [2011星][7m] [Py] fsecurelabs/drozer The Leading Security Assessment Framework for Android.
  • [1976星][] [Java] kyson/androidgodeye AndroidGodEye:A performance monitor tool , like "Android Studio profiler" for Android , you can easily monitor the performance of your app real time in pc browser
  • [1925星][7m] [Java] fuzion24/justtrustme An xposed module that disables SSL certificate checking for the purposes of auditing an app with cert pinning
  • [1430星][11m] [Java] aslody/legend (Android)无需Root即可Hook Java方法的框架, 支持Dalvik和Art环境
  • [1417星][1m] [Java] chrisk44/hijacker Aircrack, Airodump, Aireplay, MDK3 and Reaver GUI Application for Android
  • [1241星][3m] [Java] whataa/pandora an android library for debugging what we care about directly in app.
  • [1235星][1m] [Java] find-sec-bugs/find-sec-bugs The SpotBugs plugin for security audits of Java web applications and Android applications. (Also work with Kotlin, Groovy and Scala projects)
  • [1213星][1m] [JS] megatronking/httpcanary A powerful capture and injection tool for the Android platform
  • [1208星][3m] [Java] javiersantos/piracychecker An Android library that prevents your app from being pirated / cracked using Google Play Licensing (LVL), APK signature protection and more. API 14+ required.
  • [1134星][24d] [Java] huangyz0918/androidwm 一个支持不可见数字水印（隐写术）的android图像水印库。
  • [885星][2m] [C] 504ensicslabs/lime LiME (formerly DMD) is a Loadable Kernel Module (LKM), which allows the acquisition of volatile memory from Linux and Linux-based devices, such as those powered by Android. The tool supports acquiring memory either to the file system of the device or over the network. LiME is unique in that it is the first tool that allows full memory captures f…
  • [820星][3d] proxymanapp/proxyman Modern and Delightful HTTP Debugging Proxy for macOS, iOS and Android
  • [810星][4m] [Scala] antox/antox Android client for Project Tox - Secure Peer to Peer Messaging
  • [800星][3m] sh4hin/androl4b 用于评估Android应用程序，逆向工程和恶意软件分析的虚拟机
  • [769星][1y] [C] ele7enxxh/android-inline-hook thumb16 thumb32 arm32 inlineHook in Android
  • [668星][1m] doridori/android-security-reference A W.I.P Android Security Ref
  • [608星][7m] [JS] vincentcox/stacoan StaCoAn is a crossplatform tool which aids developers, bugbounty hunters and ethical hackers performing static code analysis on mobile applications.
  • [559星][6d] [Shell] owasp/owasp-masvs OWASP 移动App安全标准
  • [546星][1m] nordicsemiconductor/android-nrf-connect Documentation and issue tracker for nRF Connect for Android.
  • [541星][1y] [Java] jaredrummler/apkparser APK parser for Android
  • [527星][4m] [JS] wooyundota/droidsslunpinning Android certificate pinning disable tools
  • [518星][3m] [Java] megatronking/stringfog 一款自动对字节码中的字符串进行加密Android插件工具
  • [511星][] [Java] happylishang/cacheemulatorchecker Android模拟器检测，检测Android模拟器 ，获取相对真实的IMEI AndroidId 序列号 MAC地址等，作为DeviceID，应对防刷需求等
  • [482星][1m] [JS] lyxhh/lxhtoolhttpdecrypt Simple Android/iOS protocol analysis and utilization tool
  • [450星][12m] [Kotlin] shadowsocks/kcptun-android kcptun for Android.
  • [443星][23d] [TS] shroudedcode/apk-mitm
  • [431星][5d] [C] guardianproject/orbot The Github home of Orbot: Tor on Android (Also available on gitlab!)
  • [426星][11d] [Py] thehackingsage/hacktronian All in One Hacking Tool for Linux & Android
  • [412星][4m] [Java] megatronking/netbare Net packets capture & injection library designed for Android
  • [409星][3m] [CSS] angea/pocorgtfo a "Proof of Concept or GTFO" mirror with extra article index, direct links and clean PDFs.
  • [408星][1y] [Java] testwhat/smaliex A wrapper to get de-optimized dex from odex/oat/vdex.
  • [379星][5m] [Makefile] crifan/android_app_security_crack 安卓应用的安全和破解
  • [379星][1y] [CSS] nowsecure/secure-mobile-development A Collection of Secure Mobile Development Best Practices
  • [358星][5m] b3nac/android-reports-and-resources A big list of Android Hackerone disclosed reports and other resources.
  • [358星][5m] [C] the-cracker-technology/andrax-mobile-pentest ANDRAX The first and unique Penetration Testing platform for Android smartphones
  • [333星][17d] [Java] datatheorem/trustkit-android Easy SSL pinning validation and reporting for Android.
  • [284星][9m] [Py] micropyramid/forex-python Foreign exchange rates, Bitcoin price index and currency conversion using ratesapi.io
  • [267星][4m] [Py] amimo/dcc DCC (Dex-to-C Compiler) is method-based aot compiler that can translate DEX code to C code.
  • [265星][3d] [Py] den4uk/andriller Andriller - is software utility with a collection of forensic tools for smartphones. It performs read-only, forensically sound, non-destructive acquisition from Android devices.
  • [251星][10m] [C] chef-koch/android-vulnerabilities-overview An small overview of known Android vulnerabilities
  • [234星][2m] [C] grant-h/qu1ckr00t A PoC application demonstrating the power of an Android kernel arbitrary R/W.
  • [234星][1y] [Ruby] hahwul/droid-hunter (deprecated) Android application vulnerability analysis and Android pentest tool
  • [229星][8m] [Java] jieyushi/luffy Android字节码插件，编译期间动态修改代码，改造添加全埋点日志采集功能模块，对常见控件进行监听处理
  • [225星][3m] [Java] virb3/trustmealready Disable SSL verification and pinning on Android, system-wide
  • [208星][18d] [C] derrekr/fastboot3ds A homebrew bootloader for the Nintendo 3DS that is similar to android's fastboot.

新添加的

HotFix

  • [14557星][5d] [Java] tencent/tinker Tinker is a hot-fix solution library for Android, it supports dex, library and resources update without reinstall apk.
  • [3462星][19d] [Java] meituan-dianping/robust Robust is an Android HotFix solution with high compatibility and high stability. Robust can fix bugs immediately without a reboot.
  • [1117星][5m] [Java] manbanggroup/phantom 唯一零 Hook 稳定占坑类 Android 热更新插件化方案

打包

  • [5080星][2m] [Java] meituan-dianping/walle Android Signature V2 Scheme签名下的新一代渠道包打包神器

收集

各类App

Xposed

  • [8756星][1m] [Java] android-hacker/virtualxposed A simple app to use Xposed without root, unlock the bootloader or modify system image, etc.
  • [2559星][7m] taichi-framework/taichi A framework to use Xposed module with or without Root/Unlock bootloader, supportting Android 5.0 ~ 10.0
  • [2034星][4d] [Java] elderdrivers/edxposed Elder driver Xposed Framework.
  • [1726星][1y] [Java] ac-pm/inspeckage Android Package Inspector - dynamic analysis with api hooks, start unexported activities and more. (Xposed Module)
  • [1655星][1m] [Java] tiann/epic Dynamic java method AOP hook for Android(continution of Dexposed on ART), Supporting 4.0~10.0
  • [1296星][1m] [Java] android-hacker/exposed A library to use Xposed without root or recovery(or modify system image etc..).
  • [790星][8m] [Java] blankeer/mdwechat 一个能让微信 Material Design 化的 Xposed 模块
  • [669星][4d] [Java] ganyao114/sandhook Android ART Hook/Native Inline Hook/Single Instruction Hook - support 4.4 - 10.0 32/64 bit - Xposed API Compat
  • [478星][2m] [Java] tornaco/x-apm 应用管理 Xposed
  • [322星][1y] [C] smartdone/dexdump 一个用来快速脱一代壳的工具（稍微改下就可以脱类抽取那种壳）（Android）
  • [309星][25d] bigsinger/androididchanger Xposed Module for Changing Android Device Info
  • [309星][5d] [Java] ganyao114/sandvxposed Xposed environment without root (OS 5.0 - 10.0)
  • [204星][1y] [C] gtoad/android_inline_hook Build an so file to automatically do the android_native_hook work. Supports thumb-2/arm32 and ARM64 ! With this, tools like Xposed can do android native hook.

加壳&&脱壳

  • [1793星][8m] [C++] wrbug/dumpdex Android脱壳
  • [1465星][3m] [C++] vaibhavpandeyvpz/apkstudio Open-source, cross platform Qt based IDE for reverse-engineering Android application packages.
  • [811星][4m] [C] strazzere/android-unpacker Android Unpacker presented at Defcon 22: Android Hacker Protection Level 0
  • [712星][2m] [YARA] rednaga/apkid Android Application Identifier for Packers, Protectors, Obfuscators and Oddities - PEiD for Android
  • [366星][3m] [Java] patrickfav/uber-apk-signer A cli tool that helps signing and zip aligning single or multiple Android application packages (APKs) with either debug or provided release certificates. It supports v1, v2 and v3 Android signing scheme has an embedded debug keystore and auto verifies after signing.
  • [322星][6m] [Shell] 1n3/reverseapk Quickly analyze and reverse engineer Android packages

HOOK

  • [1500星][19d] [C] iqiyi/xhook a PLT (Procedure Linkage Table) hook library for Android native ELF
  • [1494星][t] [C++] jmpews/dobby a lightweight, multi-platform, multi-architecture hook framework.
  • [804星][17d] [C++] aslody/whale Hook Framework for Android/IOS/Linux/MacOS
  • [530星][7m] [Java] aslody/andhook Android dynamic instrumentation framework
  • [361星][8m] [C] turing-technician/fasthook Android ART Hook

Emulator&&模拟器

IDA

Debug&&调试

Malware&&恶意代码

Obfuscate&&混淆

ReverseEngineering

文章&&视频

Apple&&iOS&&iXxx

工具

新添加的

  • [10966星][2d] [ObjC] flipboard/flex An in-app debugging and exploration tool for iOS
  • [8031星][2m] [Py] facebook/chisel Chisel is a collection of LLDB commands to assist debugging iOS apps.
  • [5775星][3m] [ObjC] square/ponydebugger Remote network and data debugging for your native iOS app using Chrome Developer Tools
  • [5451星][3m] [Py] axi0mx/ipwndfu open-source jailbreaking tool for many iOS devices
  • [5390星][5m] [C] pwn20wndstuff/undecimus unc0ver jailbreak for iOS 11.0 - 12.4
  • [4663星][29d] [C] google/ios-webkit-debug-proxy A DevTools proxy (Chrome Remote Debugging Protocol) for iOS devices (Safari Remote Web Inspector).
  • [4397星][4d] [Swift] signalapp/signal-ios A private messenger for iOS.
  • [4248星][8m] [ObjC] alonemonkey/monkeydev CaptainHook Tweak、Logos Tweak and Command-line Tool、Patch iOS Apps, Without Jailbreak.
  • [3686星][4m] [C] facebook/fishhook A library that enables dynamically rebinding symbols in Mach-O binaries running on iOS.
  • [3414星][1m] icodesign/potatso Potatso is an iOS client that implements different proxies with the leverage of NetworkExtension framework in iOS 10+.
  • [3327星][3m] [Swift] yagiz/bagel a little native network debugging tool for iOS
  • [3071星][10m] [JS] jipegit/osxauditor OS X Auditor is a free Mac OS X computer forensics tool
  • [2867星][4d] [ObjC] facebook/idb idb is a flexible command line interface for automating iOS simulators and devices
  • [2795星][16d] [Swift] kasketis/netfox A lightweight, one line setup, iOS / OSX network debugging library!
  • [2753星][1m] [Makefile] theos/theos A cross-platform suite of tools for building and deploying software for iOS and other platforms.
  • [2733星][18d] [ObjC] dantheman827/ios-app-signer This is an app for OS X that can (re)sign apps and bundle them into ipa files that are ready to be installed on an iOS device.
  • [2708星][2m] [ObjC] kjcracks/clutch Fast iOS executable dumper
  • [2057星][11d] [ObjC] ios-control/ios-deploy Install and debug iPhone apps from the command line, without using Xcode
  • [1801星][1y] aozhimin/ios-monitor-platform
  • [1695星][6m] [Py] yelp/osxcollector A forensic evidence collection & analysis toolkit for OS X
  • [1683星][1m] [Swift] pmusolino/wormholy iOS network debugging, like a wizard

[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课

最后于 2020-10-31 18:28 被梦幻的彼岸编辑 ，原因：
上传的附件：
收藏
免费 ・4
支持
分享
最新回复 (2)
编程小白
雪    币： 441
活跃值： (1060)
能力值： ( LV2，RANK：15 )
在线值：
发帖
回帖
粉丝
私信
2 楼
怎么踩？
2020-10-31 17:19
0
tank小王子
雪    币： 12497
活跃值： (9432)
能力值： ( LV2，RANK：10 )
在线值：
发帖
回帖
粉丝
私信
3 楼
天融信α实验室总结的。。。
2020-10-31 23:31
0
游客
登录 | 注册 方可回帖
回帖 表情 雪币赚取及消费
高级回复
返回
//