Software Tools: Difference between revisions
Polymorphic7 (talk | contribs) m SSLUnpinning_Xposed added |
→Debugger / disassembler for unmanged binaries: added radare2 and Rizin |
||
| Line 77: | Line 77: | ||
*[https://github.com/uxmal/reko Reko] - Reko is a binary decompiler for static analysis (ARM, x86-64, M68K, Aarch65, RISC-V and dotnet) | *[https://github.com/uxmal/reko Reko] - Reko is a binary decompiler for static analysis (ARM, x86-64, M68K, Aarch65, RISC-V and dotnet) | ||
*[https://rada.re/ radare2] and [https://rizin.re/ Rizin] - radare2 and its fork Rizin are open source reverse engineering frameworks. Both are primarily used through a shell-like text UI, but also offer a GUI called [https://rada.re/n/iaito.html iato] and [https://cutter.re/ Cutter] respectively. | |||
====Debugging and Profiling dynamic analysis (Linux)==== | ====Debugging and Profiling dynamic analysis (Linux)==== | ||
| Line 154: | Line 155: | ||
*[https://github.com/ElderDrivers/EdXposed Xposed Framework] - is a framework for mobile exploration hooking and modifying code on the fly. [https://binderfilter.github.io/xposed/ Inline API hooking example]. | *[https://github.com/ElderDrivers/EdXposed Xposed Framework] - is a framework for mobile exploration hooking and modifying code on the fly. [https://binderfilter.github.io/xposed/ Inline API hooking example]. | ||
:: Xposed modules | |||
::Xposed modules | |||
:::*[https://github.com/Fuzion24/JustTrustMe JustTrustMe] - Art framework hook to patch okHTTP and other common libs to fool the CERT chain in order for Mitmproxy to capture TLS traffic in cleartext. | :::*[https://github.com/Fuzion24/JustTrustMe JustTrustMe] - Art framework hook to patch okHTTP and other common libs to fool the CERT chain in order for Mitmproxy to capture TLS traffic in cleartext. | ||
:::*[https://github.com/sanfengAndroid/FakeXposed FakeXposed] - Hide xposed, root, file redirection, two-way shielding data detection. | :::*[https://github.com/sanfengAndroid/FakeXposed FakeXposed] - Hide xposed, root, file redirection, two-way shielding data detection. | ||
| Line 160: | Line 162: | ||
====Promiscuous mode eavesdropping TCP/UDP==== | ====Promiscuous mode eavesdropping TCP/UDP==== | ||
::*[https://github.com/mitmproxy/mitmproxy mitmproxy] - is an interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers. | ::*[https://github.com/mitmproxy/mitmproxy mitmproxy] - is an interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers. | ||
| Line 169: | Line 172: | ||
====Unified Extensible Firmware Interface (UEFI) & legacy PC BIOS Tools==== | ====Unified Extensible Firmware Interface (UEFI) & legacy PC BIOS Tools==== | ||
::'''UEFI''' | ::'''UEFI''' | ||
::*[https://github.com/LongSoft/UEFITool UEFITool / UEFIExtract / UEFIFind] - is a UEFI firmware image viewer and editor. | ::*[https://github.com/LongSoft/UEFITool UEFITool / UEFIExtract / UEFIFind] - is a UEFI firmware image viewer and editor. | ||
::*[https://github.com/LongSoft/IFRExtractor-RS IFRExtractor-RS] - is a Rust utility to extract UEFI IFR (Internal Form Representation) data found in a binary file into human-readable text. | ::*[https://github.com/LongSoft/IFRExtractor-RS IFRExtractor-RS] - is a Rust utility to extract UEFI IFR (Internal Form Representation) data found in a binary file into human-readable text. | ||
::*[https://github.com/direstraits96/BIOS-MOD-TOOLS/blob/main/AMI/AMIBCP/AMIBCP_5.01_x64.exe AMIBCP_5.01_x64] - AMI BIOS Configuration Program (AMIBCP) is a powerful customization utility that enables OEMs/ODMs to customize the Aptio® ROM image without intervening on the source code. [https://www.virustotal.com/gui/file/58f822028c24bb452e4c0af60118b3db2a492d91dbf477960ac4f595cfded91b VT link] | ::*[https://github.com/direstraits96/BIOS-MOD-TOOLS/blob/main/AMI/AMIBCP/AMIBCP_5.01_x64.exe AMIBCP_5.01_x64] - AMI BIOS Configuration Program (AMIBCP) is a powerful customization utility that enables OEMs/ODMs to customize the Aptio® ROM image without intervening on the source code. [https://www.virustotal.com/gui/file/58f822028c24bb452e4c0af60118b3db2a492d91dbf477960ac4f595cfded91b VT link] | ||
::*[https://github.com/tylernguyen/razer15-hackintosh/blob/master/tools/AMIBCP64/AMIBCP64.exe AMIBCP 5.01.0014 x64] [https://www.virustotal.com/gui/file/58f822028c24bb452e4c0af60118b3db2a492d91dbf477960ac4f595cfded91b/details VT link] | ::*[https://github.com/tylernguyen/razer15-hackintosh/blob/master/tools/AMIBCP64/AMIBCP64.exe AMIBCP 5.01.0014 x64] [https://www.virustotal.com/gui/file/58f822028c24bb452e4c0af60118b3db2a492d91dbf477960ac4f595cfded91b/details VT link] | ||