Reverse Engineering

X86 assembly/instructions https://www.aldeid.com/wiki/X86-assembly/Instructions

Dealing with ASLR When Analyzing Malware https://digital-forensics.sans.org/blog/2014/02/17/malware-analysis-and-aslr-on-windows-8-1

R2dec radare2 decompiler ~# r2pm -i r2dec

Angrgdb, Create an angr state from the current debugger state. https://github.com/andreafioraldi/angrgdb

AutoIt Malware: From Compiled Binary to Plain-Text Script https://r3mrum.wordpress.com/2017/07/10/autoit-malware-from-compiled-binary-to-plain-text-script/

Analyzing Malicious Documents Cheat Sheet https://zeltser.com/analyzing-malicious-documents/

Malware analysis cheat sheet https://zeltser.com/malware-analysis-cheat-sheet/

Cutter & EDB for complete GUI static & dynamic analysis within linux

Representing assembly algorithm using python

Dnspy .net decompiler & debugger

Ponce plugin for one click taint analysis and symbolic execution https://github.com/illera88/Ponce

Pwntools simple shell

IDA pro source code debugging

X64dbg function locals

IDA pro python interpreter

R2pipe automated debugging

Z3 SMT solver

Sonic visualiser

HxD can inspect process memory directly Tools -> open RAM -> proc name Or use tools like process hacker to dump process memory

R2 backtrace => dbt R2 memoy map => dm