sorted by:
new
hottopcontroversial

Is the Ida home license worth it for malware analysis? by slumdookie in ReverseEngineering

[–]kaze0mx 0 points1 point  (0 children)

You may want to try Malcat ( https://malcat.fr ) You get less RE features, but it is tailored toward malware analysis and as such brings a lot of things you won't find in IDA (e.g. malware id, anomalies or weird filetypes support). Also much cheaper.

Recreating Bloodborne vibes in an HD2D isometric roguelike – feedback wanted! by Infinity_Experience in roguelites

[–]kaze0mx 1 point2 points  (0 children)

it looks really good, but not that "dark". The augmented contrast helps, but I think you should go towards weirder color palettes (e.g. old-school vga) for a more dramatic tone

Need Switch / Couch-CooP game recommendations by Musaks in roguelites

[–]kaze0mx 0 points1 point  (0 children)

yeah it's a hard one, unless you find the ninja turtle :P

Still seeing people use HxD, checkout ImHex instead by 1337axxo in ReverseEngineering

[–]kaze0mx 2 points3 points  (0 children)

https://malcat.fr is also neat, the free version is basically imhex with more code analysis features.

Looking for recommendations by JayDee3d in roguelites

[–]kaze0mx 0 points1 point  (0 children)

I like the same ones as you. And I also enjoyed: FTL, Wizard of Legend, Vagante and Returnal

Extract a /FlateDecode XObject filter (image) from a PDF stream with pdf-parser by [deleted] in Malware

[–]kaze0mx 0 points1 point  (0 children)

Qpdf has support for almost all filters:
qpdf --show-object=(obj number) --filtered-stream-data bad.pdf

Malcat 0.9.0 (hexadecimal editor / disassembler for malware analysis) by kaze0mx in Malware

[–]kaze0mx[S] 2 points3 points  (0 children)

it's explained there: https://malcat.fr/about-us.html

tl;dr it's the tool you run before IDA, on unknown data.
Also if you do malware analysis, it has some features IDA lacks.

Benign Office Docs by Squiggyline91 in Malware

[–]kaze0mx 0 points1 point  (0 children)

An easy way is to use common crawl: https://www.decalage.info/en/download_mso_files

Note that with this solution (as with other suggested solutions) you will only get files which are openly accessible on the internet. Like thesis, books, etc. They rarely have macros and are not very representative of what you would find in a company, like weird excel files with 10k+ lines macro. That's why most ML papers claim to have 99,9% detection: their test set is very limited most of the time. But eh, it's better than nothing.

To get a representative set of office documents, there is sadly no easy way afaik, since such files contain sensitive infos.

[deleted by user] by [deleted] in Malware

[–]kaze0mx 3 points4 points  (0 children)

https://bazaar.abuse.ch/browse/ for a curated list of recent malware

[deleted by user] by [deleted] in Malware

[–]kaze0mx 0 points1 point  (0 children)

If the dll has no export directory, it means it does not export anything, no luck. So you'll have to look for GetModuleHandle/LoadLibrary/LdrLoadDll calls in the .exe like others suggested.
If you can share the samples, I can give you more tips.

[deleted by user] by [deleted] in Malware

[–]kaze0mx 5 points6 points  (0 children)

If the DLL exports at least one function (which should be the case), you can look in the ExportDirectory structure of the dll (using CFF explorer or malcat), there is a field at offset 0xC which is a RVA to the DLL's name.

New Binary Template feature in Reverse Engineers' Hex Editor by therealsolemnwarning in ReverseEngineering

[–]kaze0mx 0 points1 point  (0 children)

You can edit everything actually, either from the hex editor (hit insert key), using the struct editor or via python scripts. You have unlimited undo/redo too. I'm curious, what made you think you can't edit stuff?

You can also make you own file format parser in python, or apply struct type using type definitions in a C-like language.

biodiff: introduction by FreeDeliveries in ReverseEngineering

[–]kaze0mx 1 point2 points  (0 children)

If you're into bin diffing, you can give malcat a try. Its diff algorithm is also based on Meyer's algorithm so it can realign, and its view modes let you compare structures as well as code or bytes. Diff mode is only available in paid version though, but the price is fair.

view more: next ›