:wrench: Tools

• Before 2000

  • OllyDbg Scripts - Collection of OllyDbg scripts for unpacking many different packers.
  • OmniUnpack - New technique for fast, generic, and safe unpacking of malware by monitoring the execution in real-time and detecting the removed layers of packing.
  • PackerAttacker - Tool that uses memory and code hooks to detect packers.
  • PackerBreaker - Tool for helping unpack, decompress and decrypt most of the programs packed, compressed or encrypted using advanced emulation technology.
  • PackerGrind - Adaptive unpacking tool for tracking packing bahaviors and unpacking Android packed apps.
  • PackerID - Fork of packerid.py using PEid signatures and featuring additional output types, formats, digital signature extraction, and disassembly support.
  • PackID - Packer identification multiplatform tool/library using the same database syntax as PEiD.
  • Packing-Box - Docker image gathering many packing-related tools and for making datasets of packed executables for use with machine learning.
  • PANDA - Platform for Architecture-Neutral Dynamic Analysis.
  • PE Compression Test - List of packers tested on a few sample executables for comparing compressed sizes.
  • PE-bear - Freeware reversing tool for PE files aimed to deliver fast and flexible “first view” for malware analysts, stable and capable to handle malformed PE files.
  • Pefile - Multi-platform Python module to parse and work with Portable Executable files.
  • PEFrame - Tool for performing static analysis on PE malware and generic suspicious files.
  • PEiD - Packed Executable iDentifier.
  • PEiD (CLI) - Python implementation of PEiD featuring an additional tool for making new signatures.
  • PEiD (yara) - Yet another implementation of PEiD with yara.
  • PeLib - PE file manipulation library.
  • PEPack - PE file packer detection tool, part of the Unix package "pev".
  • PETools - Old-school reverse engineering tool (with a long history since 2002) for manipulating PE files.
  • PINdemonium - Unpacker for PE files exploiting the capabilities of PIN.
  • PolyUnpack - Implemention attempt of the general approach for extracting the original hidden code of PE files without any heuristic assumptions.
  • PROTECTiON iD - PE file signature-based scanner.
  • PyPackerDetect - Small Python script/library to detect whether an executable is packed.
  • PyPackerDetect (refactored) - A complete refactoring of the original project to a Python package with a console script to detect whether an executable is packed.
  • PyPeid - Yet another implementation of PEiD with yara-python.
  • Quick Unpack - Generic unpacker that facilitates the unpacking process.
  • RDG Packer Detector - Packer detection tool.
  • Reko - Free decompiler for machine code binaries.
  • REMINDer - Packing detection tool based on the entropy value of the entry point section and the WRITE attribute.
  • Renovo - Detection tool built on top of TEMU (dynamic analysis component of BitBlaze) based on the execution of newly-generated code and monitoring memory writes after the program starts.
  • RetDec - Retargetable machine-code decompiler based on LLVM.
  • SecML Malware - Create adversarial attacks against machine learning Windows malware detectors.
  • ShowStopper - Tool to help malware researchers explore and test anti-debug techniques or verify debugger plugins or other solutions that clash with standard anti-debug methods.
  • StudPE - PE viewer and editor (32/64 bit).
  • Triton - Dynamic binary analysis library.
  • Unipacker - Automatic and platform-independent unpacker for Windows binaries based on emulation.
  • VMHunt - Set of tools for analyzing virtualized binary code ; now only supports 32 bit traces.
  • VMUnpacker - Unpacker based on the technology of virtual machine.
  • Winbindex - An index of Windows binaries, including download links for executables such as EXE, DLL and SYS files.
  • yarGen - Generator for YARA rules - The main principle is the creation of yara rules from strings found in malware files while removing all strings that also appear in goodware files.
  • MRC - (Mandiant Red Curtain) Free software for Incident Responders that assists with the analysis of malware ; it examines executable files (e.g., .exe, .dll, and so on) to determine how suspicious they are based on a set of criteria.
  • Binutils - The GNU Binutils are a collection of binary tools for Linux (it namely includes Readelf).
  • Eureka - Binary static analysis preparation framework implementing a novel binary unpacking strategy based on statistical bigram analysis and coarse-grained execution tracing.
  • de4dot - .NET deobfuscator and unpacker.
  • PROTECTiON iD - PE file signature-based scanner.
  • PE Compression Test - List of packers tested on a few sample executables for comparing compressed sizes.
  • PEiD - Packed Executable iDentifier.
  • PANDI - Dynamic packing detection solution built on top of PANDA.
  • EXETools - Forum for reverse engineering and executale packing related topics.
  • ChkEXE - Identifies almost any EXE/COM packer, crypter or protector.
  • COM2EXE - Free tool for converting COM files to EXE format.
  • Bintropy - Prototype analysis tool that estimates the likelihood that a binary file contains compressed or encrypted bytes.
  • Capstone - Lightweight multi-platform, multi-architecture disassembly framework.
  • CFF Explorer - PE32/64 and .NET editor, part of the Explorer Suite.
  • Clamscan Unpacker - Unpacker derived from ClamAV.
  • DynamoRIO - Runtime code manipulation system that supports code transformations on any part of a program, while it executes.
  • EtherUnpack - Precision universal automated unpacker (successor of PolyUnpack).
  • Language 2000 - Ultimate compiler detection utility.
  • Packing-Box - Docker image gathering many packing-related tools and for making datasets of packed executables for use with machine learning.
  • PE Detective - This GUI tool can scan single PE files or entire directories (also recursevely) and generate complete reports.
  • PEiD (CLI) - Python implementation of PEiD featuring an additional tool for making new signatures.
  • PEview - Provides a quick and easy way to view the structure and content of 32-bit Portable Executable (PE) and Component Object File Format (COFF) files.
  • PExplorer - Most feature-packed program for inspecting the inner workings of your own software, and more importantly, third party Windows applications and libraries for which you do not have source code.
  • ProTools - Programmer's Tools, a web site dedicated for all kinds of tools and utilities for the true WinBloze programmer, including packers, crypters, etc.
  • REMnux - Linux toolkit for reverse-engineering and analyzing malicious software.
  • Tuts 4 You - Non-commercial, independent community dedicated to the sharing of knowledge and information on reverse code engineering.
  • UnpacMe - Automated malware unpacking service.
  • Uunp (IDA Pro plugin) - IDA Pro debugger plug-in module automating the analysis and unpacking of packed binaries.