129 lines
3.5 KiB
Markdown
129 lines
3.5 KiB
Markdown
<header>
|
|
<h1>Tools</h1>
|
|
</header>
|
|
|
|
|
|
# Utilities (Linux)
|
|
|
|
## strings
|
|
For each file given, `strings` prints the printable character sequences that are at least 4 characters long (or the
|
|
number given with the options below) and are followed by an unprintable character. By default, it only prints the
|
|
strings from the initialized and loaded sections of object files. For other types of files, it prints the strings
|
|
from the whole file. The main use of `strings` is to find the contents of non-text files.
|
|
|
|
```terminal
|
|
$|strings code/a.out
|
|
The sum of 1 to 63 is %d.
|
|
```
|
|
|
|
## file
|
|
Determine file type
|
|
|
|
```terminal
|
|
$|file /bin/ls
|
|
/bin/ls: ELF 64-bit LSB executable, x86-64, version 1 (SYSV),
|
|
dynamically linked (uses shared libs), for GNU/Linux 2.6.18, stripped
|
|
$|file /bin/ls
|
|
/bin/ls: Mach-O 64-bit executable x86_64
|
|
```
|
|
|
|
## nm
|
|
List the symbols in a object file
|
|
|
|
## readelf
|
|
Displays information about ELF files
|
|
|
|
## ldd
|
|
Displays the shared objects dependencies
|
|
|
|
## lsof
|
|
Lists files and other system ressources opened by a process
|
|
|
|
## ltrace
|
|
Traces the calls of a process to functions in dynamic libraries
|
|
|
|
## strace
|
|
Traces the systems calls of a process
|
|
|
|
# Disassemblers
|
|
|
|
## objdump, otool on macOS
|
|
Open-source tools for showing different types of information about object files on Unix-based operating systems.
|
|
|
|
## disassemble
|
|
Internal command of gdb
|
|
|
|
## [radare2](https://rada.re/n/radare2.html)
|
|
Open source portable reversing framework
|
|
|
|
## [Capstone](https://www.capstone-engine.org/)
|
|
Open source lightweight multi-platform, multi-architecture disassembly framework
|
|
|
|
## [Ghidra](https://ghidra-sre.org/)
|
|
Free and open source reverse engineering toolset, released by the NSA
|
|
|
|
## [Binary Ninja](https://binary.ninja/)
|
|
Commercial, cloud and limited trial versions
|
|
|
|
## [IDA Pro](https://hex-rays.com/ida-pro/)
|
|
Free and commercial versions
|
|
|
|
## [Hopper](https://www.hopperapp.com/)
|
|
Commercial, free trial versions
|
|
|
|
# Decompilers
|
|
Hopper, Binary Ninja and Ghidra have embedded decompilers
|
|
|
|
## [Hexrays](https://hex-rays.com/decompiler/)
|
|
Commercial plugin for IDA Pro
|
|
|
|
## [.NET Reflector](https://www.red-gate.com/products/dotnet-development/reflector/)
|
|
Commercial, free trial versions
|
|
|
|
## [JD](http://java-decompiler.github.io/)
|
|
Free and open source Java decompiler
|
|
|
|
## [uncompyle6](https://pypi.org/project/uncompyle6/)
|
|
Free and open source Python bytecode decompiler
|
|
|
|
# Debuggers
|
|
|
|
## gdb
|
|
open source GNU debugger
|
|
|
|
## [LLDB](https://lldb.llvm.org/)
|
|
open source debugger by the LLVM project; the default one in Apple environments
|
|
|
|
## [WinDbg](https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/debugger-download-tools)
|
|
multipurpose debugger for the Microsoft Windows computer operating system, distributed by Microsoft
|
|
|
|
## [x64dbg](https://x64dbg.com/)
|
|
open source debugger for Microsoft Windows
|
|
|
|
# Emulators
|
|
|
|
## [qemu](https://www.qemu.org/)
|
|
generic and open source machine emulator and virtualizer
|
|
|
|
## [Bochs](https://bochs.sourceforge.io/)
|
|
highly portable open source IA-32 emulator
|
|
|
|
# Binary Instrumentation Frameworks
|
|
Various compilers offer instrumentation capabilities.
|
|
|
|
## [PIN](https://www.intel.com/content/www/us/en/developer/articles/tool/pin-a-dynamic-binary-instrumentation-tool.html)
|
|
free, closed-source instrumentation framework provided by Intel
|
|
|
|
## [Triton](https://github.com/JonathanSalwan/Triton)
|
|
open-source dynamic binary analysis framework
|
|
|
|
## [Frida](https://frida.re/)
|
|
open-source dynamic instrumentation toolkit for developers, reverse-engineers, and security researchers
|
|
|
|
## [QBDI](https://qbdi.quarkslab.com/)
|
|
modular, cross-platform and cross-architecture DBI framework
|
|
|
|
|
|
```terminal
|
|
|
|
``` |