{"id":25855471,"url":"https://github.com/gemesa/malware-analysis-toolkit","last_synced_at":"2026-07-02T11:34:14.759Z","repository":{"id":279832763,"uuid":"940031257","full_name":"gemesa/malware-analysis-toolkit","owner":"gemesa","description":"Setup guides for malware analysis tools.","archived":false,"fork":false,"pushed_at":"2026-03-05T14:36:12.000Z","size":30,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2026-03-05T17:50:32.852Z","etag":null,"topics":["frida","ghidra","inetsim","inetsim-setup","llvm","malware-analysis","malware-detection","malware-research","openssl","openssl-library","qiling","suricata","virtualbox","yara","zeek"],"latest_commit_sha":null,"homepage":"https://shadowshell.io/","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/gemesa.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-02-27T14:00:16.000Z","updated_at":"2026-03-05T14:39:31.000Z","dependencies_parsed_at":"2025-02-28T00:51:51.939Z","dependency_job_id":"1846b75e-c859-4187-8b48-0c2d4e26beb7","html_url":"https://github.com/gemesa/malware-analysis-toolkit","commit_stats":null,"previous_names":["gemesa/malware-analysis-toolkit"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/gemesa/malware-analysis-toolkit","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gemesa%2Fmalware-analysis-toolkit","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gemesa%2Fmalware-analysis-toolkit/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gemesa%2Fmalware-analysis-toolkit/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gemesa%2Fmalware-analysis-toolkit/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/gemesa","download_url":"https://codeload.github.com/gemesa/malware-analysis-toolkit/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gemesa%2Fmalware-analysis-toolkit/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35045922,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-07-02T02:00:06.368Z","response_time":173,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["frida","ghidra","inetsim","inetsim-setup","llvm","malware-analysis","malware-detection","malware-research","openssl","openssl-library","qiling","suricata","virtualbox","yara","zeek"],"created_at":"2025-03-01T17:18:31.155Z","updated_at":"2026-07-02T11:34:14.750Z","avatar_url":"https://github.com/gemesa.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"# malware-analysis-toolkit\nSetup guides for malware analysis tools.\n\nCore tools:\n\n- [Android Studio](#android-studio)\n- [Apktool](#apktool)\n- [Binwalk](#binwalk)\n- [capa](#capa)\n- [DiE](#die)\n- [frida](#frida)\n- [Ghidra](#ghidra)\n- [INetSim](#inetsim)\n- [JADX](#jadx)\n- [Joern](#joern)\n- [LLVM](#llvm)\n- [OpenSSL](#openssl)\n- [Python](#python)\n- [QEMU](#qemu)\n- [Qiling](#qiling)\n- [rbi](#rbi)\n- [shadow-shell](#shadow-shell)\n- [Suricata](#suricata)\n- [VirtualBox](#virtualbox)\n- [Wireshark](#wireshark)\n- [YARA](#yara)\n- [Zeek](#zeek)\n\nmacOS:\n\n- [ILSpy](#ilspy)\n- [ipsw](#ipsw)\n- [pythonnet](#pythonnet)\n\n# Ghidra\n\n## Base\n\n```\ncurl -s \"https://get.sdkman.io\" | bash\nsdk install gradle\nsdk list java\nsdk install java 21.0.7-tem\ngit clone https://github.com/NationalSecurityAgency/ghidra.git\ncd ghidra\ngradle -I gradle/support/fetchDependencies.gradle\ngradle assembleAll\n```\n\nNecessary for Ghidra debugger:\n\n```\npip install psutil\npip install google-api-python-client\n```\n\nPyGhidra:\n\nhttps://pypi.org/project/ghidra-stubs/\n\n```\npip install pyghidra\npip install ghidra-stubs\n```\n\n### Config\n\n- **Edit** --\u003e **Theme** --\u003e **Switch...** --\u003e Flat Dark\n- **Edit** --\u003e **Theme** --\u003e **Configure** --\u003e Fonts --\u003e font.plugin.terminal --\u003e Source Code Pro-BOLD-12\n- **Edit** --\u003e **Theme** --\u003e **Configure** --\u003e Colors --\u003e color.fg.plugin.terminal.normal.blue --\u003e RGB --\u003e Color Code: 00FFFF, Alpha: 255\n- add Python stubs: https://github.com/NationalSecurityAgency/ghidra/issues/8018#issuecomment-2810720052\n- open a domain file, then **File** --\u003e **Configure** --\u003e **BSim**\n\n### Startup\n\n```\ncd ghidra/build/dist/ghidra_11.4_DEV\n./ghidraRun\n```\n\nReferences:\n- https://sdkman.io/\n- https://github.com/NationalSecurityAgency/ghidra?tab=readme-ov-file#build\n- https://github.com/NationalSecurityAgency/ghidra/blob/master/DevGuide.md#common-gradle-tasks\n\n## Ghidra server\n\n```\ncd ghidra/build/dist/ghidra_11.4_DEV\nsudo ./server/svrInstall\n```\n\n### Config\n\n```\ncd ghidra/build/dist/ghidra_11.4_DEV\nsed -i 's|ghidra.repositories.dir=./repositories|ghidra.repositories.dir=/home/gemesa/git-repos/ghidra-server|' server/server.conf\nsed -i 's|wrapper.app.parameter.2|wrapper.app.parameter.2=-u\\nwrapper.app.parameter.3|'\nsudo ./server/ghidraSvr restart\n./server/ghidraSvr status\nsudo ./server/svrAdmin -add gemesa\nsudo ./server/svrAdmin -users\n```\n\n### Startup\n\n```\ncd ghidra/build/dist/ghidra_11.4_DEV\nsudo ./server/ghidraSvr start\n```\n\nReferences:\n- https://github.com/NationalSecurityAgency/ghidra/blob/master/Ghidra/RuntimeScripts/Common/server/svrREADME.html\n\n## BSim\n\n```\ncd ghidra/build/dist/ghidra_11.4_DEV\ncd Ghidra/Features/BSim/support\nsudo dnf install readline-devel\n./make-postgres.sh\n```\n\n### Startup\n\n```\ncd ghidra/build/dist/ghidra_11.4_DEV\n./support/bsim_ctl start ~/git-repos/bsim-db\n```\n\nReferences:\n- https://github.com/NationalSecurityAgency/ghidra/blob/master/GhidraDocs/GhidraClass/BSim/BSimTutorial_Intro.md\n- https://github.com/NationalSecurityAgency/ghidra/tree/master/Ghidra/Features/BSim/src/main/help/help/topics/BSim\n- https://github.com/NationalSecurityAgency/ghidra/pull/7085#issuecomment-2438640305\n\n## Extensions\n- https://github.com/google/binexport\n- https://github.com/ubfx/BinDiffHelper\n- https://github.com/gemesa/ghidra-scripts\n\n# INetSim\n\n```\nwget https://www.inetsim.org/downloads/inetsim-1.3.2.tar.gz\ntar -xzf inetsim-1.3.2.tar.gz\nsudo groupadd inetsim\ncd inetsim-1.3.2\nsudo ./setup.sh\nsudo dnf install perl-Net-Server perl-IPC-Shareable perl-Digest-SHA perl-IO-Socket-SSL\nsudo dnf install perl-CPAN perl-App-cpanminus\n# Net::DNS@1.22 is installed on REMnux (newer versions such as 1.40..1.50 do not work with INetSim)\nsudo cpanm Net::DNS@1.22 --verbose --notest\n```\n\n## Config\n\n```\nsed -i 's|#service_run_as_user inetsim|service_run_as_user gemesa|' conf/inetsim.conf\nsed -i 's|start_service tftp|#start_service tftp|' conf/inetsim.conf\nsed -i 's|start_service irc|#start_service irc|' conf/inetsim.conf\nsed -i 's|start_service ntp|#start_service ntp|' conf/inetsim.conf\nsed -i 's|start_service finger|#start_service finger|' conf/inetsim.conf\nsed -i 's|start_service ident|#start_service ident|' conf/inetsim.conf\nsed -i 's|start_service syslog|#start_service syslog|' conf/inetsim.conf\nsed -i 's|start_service time_tcp|#start_service time_tcp|' conf/inetsim.conf\nsed -i 's|start_service time_udp|#start_service time_udp|' conf/inetsim.conf\nsed -i 's|start_service daytime_tcp|#start_service daytime_tcp|' conf/inetsim.conf\nsed -i 's|start_service daytime_udp|#start_service daytime_udp|' conf/inetsim.conf\nsed -i 's|start_service echo_tcp|#start_service echo_tcp|' conf/inetsim.conf\nsed -i 's|start_service echo_udp|#start_service echo_udp|' conf/inetsim.conf\nsed -i 's|start_service discard_tcp|#start_service discard_tcp|' conf/inetsim.conf\nsed -i 's|start_service discard_udp|#start_service discard_udp|' conf/inetsim.conf\nsed -i 's|start_service quotd_tcp|#start_service quotd_tcp|' conf/inetsim.conf\nsed -i 's|start_service quotd_udp|#start_service quotd_udp|' conf/inetsim.conf\nsed -i 's|start_service chargen_tcp|#start_service chargen_tcp|' conf/inetsim.conf\nsed -i 's|start_service chargen_udp|#start_service chargen_udp|' conf/inetsim.conf\nsed -i 's|start_service dummy_tcp|#start_service dummy_tcp|' conf/inetsim.conf\nsed -i 's|start_service dummy_udp|#start_service dummy_udp|' conf/inetsim.conf\nsed -i 's|#service_bind_address 10.10.10.1|service_bind_address\t192.168.56.128|' conf/inetsim.conf\nsed -i 's|#dns_default_ip 10.10.10.1|dns_default_ip\t\t192.168.56.128|' conf/inetsim.conf\n```\n\nSet static IP and DNS:\n\n```\nnmcli connection show\nsudo nmcli connection modify \"Wired connection 1\" ipv4.method manual ipv4.addresses 192.168.56.128/24 ipv4.gateway 192.168.56.128 ipv4.dns 192.168.56.128\nsudo nmcli connection down \"Wired connection 1\"\nsudo nmcli connection up \"Wired connection 1\"\n```\n\nRevert static IP and DNS (necessary when upgrading or installing new packages):\n\n```\nsudo nmcli connection modify \"Wired connection 1\" ipv4.method auto\nsudo nmcli connection modify \"Wired connection 1\" ipv4.addresses \"\" ipv4.gateway \"\"\nsudo nmcli connection modify \"Wired connection 1\" ipv4.dns \"\"\nsudo nmcli connection down \"Wired connection 1\"\nsudo nmcli connection up \"Wired connection 1\"\n```\n\nUpdate firewall rules:\n\n```\nsudo firewall-cmd --permanent --add-port=80/tcp   # HTTP\nsudo firewall-cmd --permanent --add-port=443/tcp  # HTTPS\nsudo firewall-cmd --permanent --add-port=21/tcp   # FTP\nsudo firewall-cmd --permanent --add-port=25/tcp   # SMTP\nsudo firewall-cmd --permanent --add-port=53/tcp   # DNS (TCP)\nsudo firewall-cmd --permanent --add-port=53/udp   # DNS (UDP)\nsudo firewall-cmd --permanent --add-port=110/tcp  # POP3\nsudo firewall-cmd --permanent --add-port=143/tcp  # IMAP\nsudo firewall-cmd --reload\nsudo firewall-cmd --list-all\n```\n\n## Startup\n\n```\nsudo ./inetsim\n```\n\nCheck services:\n\n```\nnetstat -tuln\nsudo tail -f log/service.log\n```\n\nReferences:\n- https://www.inetsim.org/requirements.html\n- https://www.inetsim.org/documentation.html\n\n# Zeek\n\n```\nsudo dnf config-manager addrepo --from-repofile=https://download.opensuse.org/repositories/security:zeek/Fedora_41/security:zeek.repo\nsudo dnf install zeek\n```\n\n## Config\n\n```\nsudo ln -s /opt/zeek/bin/zeek /usr/local/bin/zeek\nsudo ln -s /opt/zeek/bin/zeekctl /usr/local/bin/zeekctl\nsudo ln -s /opt/zeek/bin/zeek-cut /usr/local/bin/zeek-cut\nip a\nsudo sed -i 's|interface=eth0|interface=enp0s3|' /opt/zeek/etc/node.cfg\n```\n\n## Startup\n\n```\nip a\nsudo zeek -i enp0s3\n```\nOpen an other terminal:\n\n```\ncat http.log | zeek-cut -d ts uid id.orig_h host\n```\n\nReferences:\n- https://github.com/zeek/zeek/wiki/Binary-Packages#fedora-41\n- https://docs.zeek.org/en/master/quickstart.html\n\n\n# Suricata\n\n```\nsudo dnf install dnf-plugins-core\nsudo dnf copr enable @oisf/suricata-7.0\nsudo dnf install suricata\nsudo suricata-update\n```\n\n## Config\n\n```\nip a\nsudo sed -i 's| HOME_NET| #HOME_NET|' /etc/suricata/suricata.yaml\nsudo sed -i 's|#HOME_NET: \"any\"|#HOME_NET: \"any\"\\n    HOME_NET: \"[192.168.56.128/25]\"|' /etc/suricata/suricata.yaml\nsudo cat /etc/suricata/suricata.yaml\n...\n  address-groups:\n    #HOME_NET: \"[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]\"\n    #HOME_NET: \"[192.168.0.0/16]\"\n    #HOME_NET: \"[10.0.0.0/8]\"\n    #HOME_NET: \"[172.16.0.0/12]\"\n    #HOME_NET: \"any\"\n    HOME_NET: \"[192.168.56.128/25]\"\n...\n```\n\n## Startup\n\nCreate some rules:\n```\ncat http.rules \nalert http any any -\u003e any any (msg:\"HTTP GET Request Detected\"; flow:established,to_server; http.method; content:\"GET\"; sid:1000001; rev:1;)\nalert http any any -\u003e any any (msg:\"HTTP POST Request Detected\"; flow:established,to_server; http.method; content:\"POST\"; sid:1000002; rev:1;)\n```\n```\nsuricata -h\nip a\nsudo suricata -s http.rules -i enp0s3\n```\n\nOpen an other terminal:\n\n```\nsudo tail -f /var/log/suricata/fast.log\n```\n\nReferences:\n- https://docs.suricata.io/en/latest/install.html#installing-from-package-repositories\n- https://docs.suricata.io/en/latest/rule-management/adding-your-own-rules.html#\n- https://github.com/OISF/suricata/tree/master/rules\n\n# DiE\n\n```\nsudo dnf install cmake qt5-qtbase-devel qt5-qttools-devel qt5-qtmultimedia-devel qt5-qtsvg-devel qt5-qtwebsockets-devel qt5-qtdeclarative-devel qt5-qtscript-devel qt5-qtquickcontrols2-devel qt5-qtwayland-devel\ngit clone --recursive https://github.com/horsicq/DIE-engine.git\ncd DIE-engine\nmkdir -p build\ncmake . -B build\ncd build\nmake -j4\nsudo make install -j4\n```\n\n## Config\n\n```\nsudo dnf install qt5ct\necho 'export QT_QPA_PLATFORMTHEME=qt5ct' \u003e\u003e ~/.zshrc\nsource ~/.zshrc\n```\n`qt5ct` --\u003e Appearance --\u003e Palette --\u003e Custom --\u003e Color scheme --\u003e darker --\u003e OK then log out and log in\n\n## Startup\n\n```\ndie\n```\n\nor\n\n```\ndiec\n```\n\nReferences:\n- https://github.com/horsicq/Detect-It-Easy/blob/master/docs/BUILD.md#how-to-build-with-cmake\n- https://unix.stackexchange.com/questions/745499/how-to-enable-dark-theme-for-qt-applications\n\n# VirtualBox\n\n```\nsudo dnf install gcc make perl kernel-devel\nwget https://www.virtualbox.org/download/oracle_vbox_2016.asc\nsudo rpm --import oracle_vbox_2016.asc\nwget https://download.virtualbox.org/virtualbox/rpm/fedora/virtualbox.repo\nsudo mv virtualbox.repo /etc/yum.repos.d/\nsudo dnf install VirtualBox-7.0\nsudo usermod -a -G vboxusers $USER\n```\n\nFingerprint:\n\n```\nB9F8 D658 297A F3EF C18D  5CDF A2F6 83C5 2980 AECF\nOracle Corporation (VirtualBox archive signing key) \u003cinfo@virtualbox.org\u003e\n```\n\n## Fedora VM\n\nInstall [Fedora](https://fedoraproject.org/workstation/download).\n\n### Config\n\n- machine settings:\n  - **Settings** --\u003e **System**\n    - --\u003e **Processor** --\u003e Processors: 4\n    - --\u003e **Motherboard** --\u003e Base Memory: 4096\n  - **Devices** --\u003e **Shared Clipboard** --\u003e Bidirectional\n- **Settings**\n  - --\u003e **Display** --\u003e **Resolution** --\u003e 1600 x 900\n  - --\u003e **Appearance** --\u003e **Style** --\u003e Dark\n- `sudo dnf upgrade --refresh -y`\n- install the tools listed [above](#malware-analysis-toolkit)\n- machine settings:\n  - **Settings**\n    - --\u003e **Adapter 1** --\u003e Attached to: Internal Network\n    - --\u003e **Shared Folders** --\u003e add read-only, auto-mount folder, path: `/home/gemesa/malware-bazaar`\n- take VM snapshot\n\n## Troubleshooting\n\n### `VirtualBox can't enable the AMD-V extension. Please disable the KVM kernel extension, recompile your kernel and reboot (VERR_SVM_IN_USE)`\n\n```\nlsmod | grep kvm\n```\n\n```\nsudo modprobe -r kvm_amd\n```\n\nor\n\n```\nsudo modprobe -r kvm_intel\n```\n\nReferences:\n- https://www.virtualbox.org/wiki/Linux_Downloads\n\n# Python\n\n```\nsudo dnf install python pip\n```\n\n# LLVM\n\n```\nsudo dnf install llvm\n```\n\n# OpenSSL\n\n```\nsudo dnf install openssl\n```\n\n# capa\n\n```\nwget https://github.com/mandiant/capa/releases/download/v9.1.0/capa-v9.1.0-linux.zip\nunzip capa-v9.1.0-linux.zip\nsudo mv capa /usr/local/bin/\n```\n\n# frida\n\n```\npip install frida-tools\n```\n\n# rbi\n\n```\ngit clone https://github.com/N0fix/rustbininfo\nsudo dnf install poetry\ncd rustbininfo\npoetry build\npip install dist/*.whl\n```\n# QEMU\n\n```\nsudo dnf install qemu-user\nsudo dnf install qemu-user-static\nsudo dnf install qemu-user-static-aarch64\nsudo dnf install qemu-system-aarch64\nsudo dnf install qemu-system-aarch64-core\nsudo dnf install sysroot-aarch64-fc41-glibc\n```\n\n# shadow-shell\n\n```\ngit clone https://github.com/gemesa/shadow-shell\nsudo dnf install mingw64-gcc\nsudo dnf install gcc-aarch64-linux-gnu\nsudo dnf install binutils-aarch64-linux-gnu\nsudo dnf install sysroot-aarch64-fc41-glibc\nsudo dnf install llvm\ncd shadow-shell\n```\n\nThen\n\n```\nmake arm64x\nmake x64\n```\n\n# Qiling\n\n```\npip install qiling\n```\n\nReferences:\n- https://docs.qiling.io/en/latest/install/\n\n# YARA\n\n```\nwget https://github.com/VirusTotal/yara-x/releases/download/v0.13.0/yara-x-v0.13.0-x86_64-unknown-linux-gnu.gz\ntar -xzf yara-x-v0.13.0-x86_64-unknown-linux-gnu.gz\nsudo mv yr /usr/local/bin/\n```\n\nReferences:\n- https://virustotal.github.io/yara-x/docs/intro/installation/\n\n# Wireshark\n\n```\nsudo dnf install wireshark\nsudo usermod -a -G wireshark gemesa\n```\n\n# Joern\n\n```\ngit clone https://github.com/joernio/joern\ncd joern\nsdk install scala\nsdk install sbt\nsbt stage\n```\n\nReferences:\n- https://docs.joern.io/\n\n# ILSpy\n\n```\nbrew install dotnet@8\nexport DOTNET_ROOT=/opt/homebrew/opt/dotnet@8/libexec\nexport PATH=$PATH:/Users/gemesa/.dotnet/tools\ndotnet tool install --global ilspycmd\n```\n\nUsage:\n\n```\nilspycmd -il -t Client.Settings -o Client.Settings.il ~/Downloads/cfe65a88ebc858c083c6bfd48d1caf16128a420d9352b46c3107b8b1a1614639.exe\nilspycmd -p -o ./AsyncRAT ~/Downloads/cfe65a88ebc858c083c6bfd48d1caf16128a420d9352b46c3107b8b1a1614639.exe\n```\n\nBrowse the decompiled project in VS Code (first install the `C# Dev Kit` extension).\n\nAlternatively, use the deprecated [AvaloniaILSpy](https://github.com/icsharpcode/AvaloniaILSpy/) with GUI.\n\nReferences:\n- https://github.com/icsharpcode/ILSpy/blob/master/ICSharpCode.ILSpyCmd/README.md\n\n# ipsw\n\n```\nbrew install ipsw\n```\n\n# pythonnet\n\n```\nbrew install dotnet\nexport DOTNET_ROOT=/opt/homebrew/opt/dotnet/libexec\npip install pythonnet\ncurl -L -o dnlib.nupkg https://www.nuget.org/api/v2/package/dnlib/\nunzip dnlib.nupkg -d dnlib_pkg\ncp dnlib_pkg/lib/netstandard2.0/dnlib.dll .\n```\n\nUsage:\n\n```py\nfrom pythonnet import load\nload(\"coreclr\")\nimport clr\nimport sys\n\nsys.path.append(\".\")\nclr.AddReference(\"dnlib\")\nfrom dnlib.DotNet import ModuleDefMD\n\nmodule = ModuleDefMD.Load(\"dcrat.exe\")\nprint(f\"Module: {module.Name}\")\nfor t in module.Types:\n    if t.Name != \"\u003cModule\u003e\":\n        print(f\"  Class: {t.Namespace}.{t.Name}\")\n```\n\n```\npython3 test.py                          \nModule: ClientJAH.exe\n  Class: Client.Program\n  Class: Client.Settings\n  Class: Client.Connection.ClientSocket\n  Class: Client.Connection.Amsi\n  Class: Client.Connection.Win32\n  Class: Client.Install.NormalStartup\n  Class: Client.Helper.AntiProcess\n  Class: Client.Helper.PROCESSENTRY32\n  Class: Client.Helper.Anti_Analysis\n  Class: Client.Helper.Camera\n  Class: Client.Helper.HwidGen\n  Class: Client.Helper.IdSender\n  Class: Client.Helper.Methods\n  Class: Client.Helper.MutexControl\n  Class: Client.Helper.NativeMethods\n  Class: Client.Helper.ProcessCritical\n  Class: Client.Helper.SetRegistry\n  Class: Client.Algorithm.Aes256\n  Class: MessagePackLib.MessagePack.BytesTools\n  Class: MessagePackLib.MessagePack.MsgPackEnum\n  Class: MessagePackLib.MessagePack.MsgPackArray\n  Class: MessagePackLib.MessagePack.MsgPack\n  Class: MessagePackLib.MessagePack.MsgPackType\n  Class: MessagePackLib.MessagePack.ReadTools\n  Class: MessagePackLib.MessagePack.WriteTools\n  Class: MessagePackLib.MessagePack.Zip\n  Class: .\u003cPrivateImplementationDetails\u003e\n```\n\n# JADX\n\n```\ngit clone https://github.com/skylot/jadx.git\ncd jadx\n./gradlew dist\nsudo cp build/jadx/bin/jadx /usr/local/bin/\nsudo cp build/jadx/bin/jadx-gui /usr/local/bin/\nsudo cp build/jadx/lib/jadx-dev-all.jar /usr/local/lib/\n```\n\nFedora:\n\n```\nsudo dnf install google-noto-sans-cjk-fonts google-noto-serif-cjk-fonts\n```\n\nNote: This is required for apps with Chinese/Japanese/Korean characters.\n\n# Android Studio\n\nDownload `android-studio-*-linux.tar.gz` from https://developer.android.com/studio.\n\n```\nsudo dnf install zlib.i686 ncurses-libs.i686 bzip2-libs.i686\nsudo tar -xzf android-studio-*-linux.tar.gz -C /opt/\nsudo ln -sf /opt/android-studio/bin/studio /usr/local/bin/android-studio\n```\n```\necho 'export ANDROID_HOME=$HOME/Android/Sdk' \u003e\u003e ~/.zshrc\necho 'export PATH=$PATH:$ANDROID_HOME/platform-tools' \u003e\u003e ~/.zshrc\necho 'export PATH=$PATH:$ANDROID_HOME/emulator' \u003e\u003e ~/.zshrc\necho 'export PATH=$PATH:$ANDROID_HOME/cmdline-tools/latest/bin' \u003e\u003e ~/.zshrc\necho 'export PATH=$PATH:$ANDROID_HOME/build-tools/$(ls $ANDROID_HOME/build-tools | tail -1)' \u003e\u003e ~/.zshrc\nsource ~/.zshrc\n```\n\nAfter startup install command-line tools:\n- **More Actions** --\u003e **SDK Manager** --\u003e **SDK Tools** --\u003e **Android SDK Command-line Tools (latest)**\n\n## Startup\n\n```\nandroid-studio\n```\n\nReferences:\n- https://developer.android.com/studio/install#linux\n\n# Apktool\n\n```\ngit clone https://github.com/iBotPeaches/Apktool\ncd Apktool\n./gradlew build shadowJar proguard\nsudo cp scripts/osx/apktool /usr/local/bin/\nsudo cp brut.apktool/apktool-cli/build/libs/apktool-v2.12.1-27-255a875a-SNAPSHOT.jar /usr/local/bin/apktool.jar\n```\n\nNote: `objection` needs a stable version:\n\n```\n$ objection patchapk -s com.facebook.katana_x86_64.patched.apk\nNo architecture specified. Determining it using `adb`...\nDetected target device architecture as: x86_64\nUsing latest Github gadget version: 17.7.3\nRemote FridaGadget version is v17.7.3, local is v0. Downloading...\nDownloading from: https://github.com/frida/frida/releases/download/17.7.3/frida-gadget-17.7.3-android-x86_64.so.xz\nDownloading x86_64 library to /home/gemesa/.objection/android/x86_64/libfrida-gadget.so.xz...\nUnpacking /home/gemesa/.objection/android/x86_64/libfrida-gadget.so.xz...\nCleaning up downloaded archives...\nPatcher will be using Gadget version: 17.7.3\nDetected apktool version as: v2.12.1-33-0df4f393-SNAPSHOT\nTraceback (most recent call last):\n  File \"/home/gemesa/.local/bin/objection\", line 8, in \u003cmodule\u003e\n    sys.exit(cli())\n             ~~~^^\n  File \"/home/gemesa/.local/lib/python3.14/site-packages/click/core.py\", line 1485, in __call__\n    return self.main(*args, **kwargs)\n           ~~~~~~~~~^^^^^^^^^^^^^^^^^\n  File \"/home/gemesa/.local/lib/python3.14/site-packages/click/core.py\", line 1406, in main\n    rv = self.invoke(ctx)\n  File \"/home/gemesa/.local/lib/python3.14/site-packages/click/core.py\", line 1873, in invoke\n    return _process_result(sub_ctx.command.invoke(sub_ctx))\n                           ~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^\n  File \"/home/gemesa/.local/lib/python3.14/site-packages/click/core.py\", line 1269, in invoke\n    return ctx.invoke(self.callback, **ctx.params)\n           ~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n  File \"/home/gemesa/.local/lib/python3.14/site-packages/click/core.py\", line 824, in invoke\n    return callback(*args, **kwargs)\n  File \"/home/gemesa/.local/lib/python3.14/site-packages/objection/console/cli.py\", line 344, in patchapk\n    patch_android_apk(**locals())\n    ~~~~~~~~~~~~~~~~~^^^^^^^^^^^^\n  File \"/home/gemesa/.local/lib/python3.14/site-packages/objection/commands/mobile_packages.py\", line 190, in patch_android_apk\n    if not patcher.is_apktool_ready():\n           ~~~~~~~~~~~~~~~~~~~~~~~~^^\n  File \"/home/gemesa/.local/lib/python3.14/site-packages/objection/utils/patchers/android.py\", line 252, in is_apktool_ready\n    if semver.compare(o, min_version) \u003c 0:\n       ~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^\n  File \"/home/gemesa/.local/lib/python3.14/site-packages/semver/_deprecated.py\", line 81, in wrapper\n    return func(*args, **kwargs)  # type: ignore\n  File \"/home/gemesa/.local/lib/python3.14/site-packages/semver/_deprecated.py\", line 113, in compare\n    return Version.parse(ver1).compare(ver2)\n           ~~~~~~~~~~~~~^^^^^^\n  File \"/home/gemesa/.local/lib/python3.14/site-packages/semver/version.py\", line 644, in parse\n    raise ValueError(f\"{version} is not valid SemVer string\")\nValueError: v2.12.1-33-0df4f393-SNAPSHOT is not valid SemVer string\nCleaning up temp files...\n```\n\nReferences:\n- https://apktool.org/docs/build\n\n# Binwalk\n\n```\ngit clone https://github.com/ReFirmLabs/binwalk\ncd binwalk\nsudo ./build_docker.sh\n```\n\n## Startup\n\n```\nsudo docker run -t -v \"$PWD\":/analysis binwalkv3 -Me firmware.bin\n```\n\nReferences:\n- https://github.com/ReFirmLabs/binwalk/wiki/Building-A-Binwalk-Docker-Image\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgemesa%2Fmalware-analysis-toolkit","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fgemesa%2Fmalware-analysis-toolkit","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgemesa%2Fmalware-analysis-toolkit/lists"}