Hacking Android app with Frida

https://android.jlelse.eu/hacking-android-app-with-frida-a85516f4f8b7


https://www.frida.re/docs/android/


https://gsec.hitb.org/materials/sg2016/whitepapers/Hacking%20Soft%20Tokens%20-%20Bernhard%20Mueller.pdf

(Read More..)

Android-Applications-Reversing-101

https://www.evilsocket.net/2017/04/27/Android-Applications-Reversing-101/

(Read More..)

EGESPLOIT : EGESPLOIT is a golang library for malware development

https://github.com/EgeBalci/EGESPLOIT

(Read More..)

Malboxes

https://gosecure.net/2017/02/16/introducing-malboxes-a-tool-to-build-malware-analysis-virtual-machines/

Introducing Malboxes: a Tool to Build Malware Analysis Virtual Machines

(Read More..)

decompile py2exe

[SHARE] Berikut ini adalah 2 repositori script python yang dapat rekan-rekan gunakan untuk proses reverse engineering aplikasi yang dibuat menggunakan py2exe. Repositori pertama adalah untuk py2exe yang dibuat menggunakan python versi 2, sedangkan repositori kedua adalah untuk py2exe yang menggunakan python versi 3.
* https://github.com/matiasb/unpy2exe
* https://github.com/NVISO-BE/decompile-py2exe

(Read More..)

SmartDec : Native code to C/C++ decompiler.

Standalone

• Supports x86 and x86-64 architectures.
• Reads ELF and PE file formats.
• Reconstructs functions, their names and arguments, local and global variables, expressions, integer, pointer and structural types, all types of control-flow structures, including switch.
• Has a nice graphical user interface with one-click navigation between assembler code and reconstructed program.
• The only decompiler that handles 64-bit code.

IDA Pro plug-in

• Enjoys all executable file formats supported by the disassembler.
• Benefits from IDA's signature search, parsers of debug information, and demanglers.
• Push-button decompilation of a chosen function or the whole program.
• Easy jumping between the disassembler and the decompiled code.
• Full GUI integration.

http://derevenets.com/

(Read More..)

Soft Function Hooking with windbg and pykd

http://webstersprodigy.net/2014/01/06/soft-function-hooking-with-windbg-and-pykd/

(Read More..)

Mona 101: a Global Samsung DLL

http://jbremer.org/mona-101-a-global-samsung-dll/

(Read More..)

mona.py – the manual

https://www.corelan.be/index.php/2011/07/14/mona-py-the-manual/

(Read More..)

Introducing Intelligence Into Your Malware Analysis

http://www.irongeek.com/i.php?page=videos/bsidesde2013/1-8-introducing-intelligence-into-your-malware-analysis-brian-baskin

(Read More..)

NetCrypt .NET Executable Packer

http://packetstormsecurity.com/files/123765

(Read More..)

x86 Instruction Encoding Revealed: Bit Twiddling for Fun and Profit

http://www.codeproject.com/Articles/662301/x86-Instruction-Encoding-Revealed-Bit-Twiddling-fo

(Read More..)

ospy

oSpy is a tool which aids in reverse-engineering software running on the Windows platform. With the amount of proprietary systems that exist today (synchronization protocols, instant messaging, etc.), the amount of work required to keep up when developing interoperable solutions will quickly become a big burden when limited to traditional techniques. However, when the sniffing is done on the API level it allows a much more fine-grained view of what's going on. Seeing return-addresses for each recv/send call (for example), can prove useful when you want to look at the processing code at that spot in a debugger or static analysis tool. And if an application uses encrypted communication it's easy to intercept these calls as well. oSpy already intercepts one such API, and is the API used by MSN Messenger, Google Talk, etc. for encrypting/decrypting HTTPS data. Another neat feature is when wanting to see how an application behaves when in a firewalled environment. Normally you would have to simulate such an environment by configuring firewalls etc., which not only is time-consuming, but might also cripple the rest of the applications you've got running. oSpy solves this problem by a feature called softwalling which allows you to set rules based on the type of function-call, the return-address, local/remote address/port, etc., and lets you choose which error to signal back to the application when the rule matches. This way you can make the application think that for example a connect() timed out, connection was refused, there was no route to host, etc.

Getting Involved

Want to help out? oSpy is an open source project and contributions are most appreciated! Whether you want to help out with artwork, code, documentation or anything else, don't hesitate to contact me at oleavr at gmail dot com.

 http://code.google.com/p/ospy/

(Read More..)

HookME 0.2 – API Spying Tool

http://www.sectechno.com/2013/04/28/hookme-0-2-api-spying-tool/

Description

HookME is a software designed for intercepting communications by hooking the desired process and hooking the API calls for sending and receiving network data (even SSL clear data). HookMe provides a nice graphic user interface allowing you to change the packet content in real time, dropping or forwarding the packet. It also has a python system plugin to extend the HookMe functionality.
It can be used for a lot of purposes such as:

1. Analyzing and modifying network protocols
2. Creation of malware or backdoors embebed into network protocols
3. Protocol vulnerability memory patching
4. Firewall at protocol layer
5. As postexplotation tool
6. whatever you can create with plugins using your imagination 

 https://code.google.com/p/hookme/

(Read More..)

frida : Everything in reverse, for free! {python}

😹 Frida is an open-source toolkit for interactive and scriptable ƃuıɹǝǝuıƃuǝ ǝsɹǝʌǝɹ.

😹 You can inspect and manipulate processes running locally, over the network, or across platforms.

😹 You can inject your own scripts into black box processes to execute custom debugging logic.

http://frida.github.io/

(Read More..)

malwr.com and cuckoo sandbox

https://community.rapid7.com/community/open_source/magnificent7/blog/2013/06/21/cuckoo-sandbox-approaching-10

http://www.cuckoosandbox.org/

https://malwr.com/

(Read More..)

Exploiting Powershell's Features (Not Flaws)

http://www.exploit-monday.com/2011/10/exploiting-powershells-features-not.html

(Read More..)

Modern bufferoverflow targets

http://packetstorm.interhost.co.il/papers/general/ModernOverflowTargets.pdf

(Read More..)

Fuzzing: An introduction to Sulley Framework

http://packetstorm.interhost.co.il/papers/general/The-Sulley-Fuzzing-Framework.pdf

(Read More..)

programmer tool

http://protools.narod.ru/index.htm

(Read More..)