“hex”的搜索结果

Defeats control-flow-flattening obfuscation by identifying the dispatcher/state- variable structure and reconstructing the original control flow so the logic becomes readable. Activates for requests to defeat control-flow flattening, deobfuscate an OLLVM-flattened function, or recover original control flow from a dispatcher loop.

中文简介正在准备中。当前显示原文说明。

Prepares indicators of compromise for safe sharing: defanging URLs, domains, IPs, and emails so they cannot be accidentally clicked or resolved, and formatting them into STIX/CSV/MISP-friendly output. Activates for requests to defang IOCs, sanitize indicators for a report, or export indicators for sharing.

中文简介正在准备中。当前显示原文说明。

Decrypts statically embedded malware configuration blobs by trying common schemes (single-byte and multi-byte XOR, RC4, base64 layers) and scoring decoded output for config-like content. Activates for requests to decrypt an embedded config, recover hardcoded settings from a blob, or brute-force a configuration encryption scheme.

中文简介正在准备中。当前显示原文说明。

Uses x64dbg to dynamically debug Windows malware: setting strategic breakpoints on APIs, stepping through unpacking and decryption, dumping memory at the right moment, and manipulating execution to reach hidden code. Activates for requests to debug malware with x64dbg, set API breakpoints, or step through unpacking in a debugger.

中文简介正在准备中。当前显示原文说明。

Analyzes the PE Rich header and related compiler artifacts to fingerprint the build toolchain, cluster related samples, and detect inconsistencies that suggest tampering. Activates for requests to analyze a Rich header, fingerprint the compiler/linker, or cluster samples by build toolchain.

中文简介正在准备中。当前显示原文说明。

Analyzes Rust-compiled malware by detecting the Rust toolchain signature, demangling Rust v0/legacy symbol names, and identifying crate dependencies from embedded paths. Activates for requests to analyze Rust malware, demangle Rust symbols, or identify a Rust binary build and its crates.

中文简介正在准备中。当前显示原文说明。

Collects volatile evidence from a potentially compromised host in correct order of volatility: memory, network state, running processes, logged-on users, and open handles, while preserving integrity and minimizing footprint. Activates for requests to collect volatile evidence, perform live response, or capture host state before shutdown.

中文简介正在准备中。当前显示原文说明。

Captures and analyzes malware network traffic from a detonation: extracting C2 endpoints, HTTP/DNS patterns, TLS metadata (JA3/SNI), and beaconing from a PCAP to build network IOCs and detection. Activates for requests to analyze malware PCAP, extract C2 from traffic, or study network behavior.

中文简介正在准备中。当前显示原文说明。

Detects process injection in a memory image by identifying private executable regions with no file backing, RWX protections, and modified entry points using Volatility 3 malfind-style analysis. Activates for requests to detect process injection, find injected code in memory, or triage suspicious executable regions in a memory image.

中文简介正在准备中。当前显示原文说明。

Detects sandbox and analysis evasion techniques in a sample by scanning static strings, imports, and API traces for VM artifact checks, timing/sleep stalls, anti-debug calls, and environment fingerprinting. Activates for requests to detect sandbox evasion, find anti-VM or anti-debug checks, or explain why a sample did not detonate.

中文简介正在准备中。当前显示原文说明。

Analyzes suspected webshells (PHP, ASPX/ASP, JSP) by detecting dynamic-execution sinks, input-to-sink data flow, and common encoder/obfuscation chains, then decoding obvious layers to reveal the command interface. Activates for requests to analyze a webshell, identify a PHP/ASPX/JSP backdoor, or deobfuscate server-side malicious scripts.

中文简介正在准备中。当前显示原文说明。

Analyzes malicious and vulnerable Windows kernel drivers (.sys) by parsing the PE for the native subsystem, identifying DriverEntry/IRP dispatch and IOCTL handlers, and flagging BYOVD and kernel-callback abuse. Activates for requests to analyze a Windows driver, examine a .sys sample, or assess a BYOVD/kernel driver threat.

中文简介正在准备中。当前显示原文说明。

Analyzes bootkit and rootkit samples by identifying boot-process tampering (MBR/VBR/ UEFI), kernel-mode components, and stealth hooking techniques from static indicators. Activates for requests to analyze a bootkit or rootkit, examine MBR/UEFI tampering, or identify kernel-mode stealth components.

中文简介正在准备中。当前显示原文说明。

Builds Zeek-based network hunting analytics by writing scripts and analyzing Zeek logs (conn, dns, http, ssl, files) to surface long connections, rare JA3s, suspicious downloads, and beaconing. Activates for requests to build Zeek analytics, write a Zeek hunting script, or analyze Zeek logs for threats.

中文简介正在准备中。当前显示原文说明。

Reverses Android malware: unpacking APKs, decompiling DEX bytecode to readable Java, auditing the manifest for abused permissions and components, and locating dynamically loaded or native payloads. Activates for requests to analyze an APK, decompile DEX, or investigate a suspicious Android app.

中文简介正在准备中。当前显示原文说明。

Builds reusable malware configuration extractors by applying a declarative JSON spec (offsets, decode layers, field definitions) to a sample to produce structured, defanged config. Activates for requests to build a config extractor, write a reusable family config parser, or run a spec-driven configuration extraction.

中文简介正在准备中。当前显示原文说明。

Automates radare2/rizin analysis through r2pipe to script function enumeration, string and import extraction, and cross-reference queries across samples programmatically. Activates for requests to automate radare2 with r2pipe, script rizin analysis, or batch-extract functions and xrefs from binaries.

中文简介正在准备中。当前显示原文说明。

Frames a structured, testable threat-hunting hypothesis: grounding it in adversary behavior and available telemetry, defining the data sources and detection logic, and setting success criteria and outcomes. Activates for requests to start a threat hunt, write a hunt hypothesis, or plan a hypothesis-driven hunt.

中文简介正在准备中。当前显示原文说明。

I Ching (易經) expert covering hexagram interpretation, traditional wisdom, and consultation methods

中文简介正在准备中。当前显示原文说明。

Search for raw byte patterns (hex sequences, opcodes) in binary code. Use when looking for specific instruction sequences, machine code patterns, UEFI SMI handlers, or known vulnerability signatures by their byte representation.

中文简介正在准备中。当前显示原文说明。

Implement proven backend architecture patterns including Clean Architecture, Hexagonal Architecture, and Domain-Driven Design. Use when architecting complex backend systems or refactoring existing applications for better maintainability.

中文简介正在准备中。当前显示原文说明。

Implement proven backend architecture patterns including Clean Architecture, Hexagonal Architecture, and Domain-Driven Design. Use when architecting complex backend systems or refactoring existing applications for better maintainability.

中文简介正在准备中。当前显示原文说明。

Master proven backend architecture patterns including Clean Architecture, Hexagonal Architecture, and Domain-Driven Design to build maintainable, testable, and scalable systems.

中文简介正在准备中。当前显示原文说明。

Domain-Driven Design system for software development. Use when designing new systems with DDD principles, refactoring existing codebases toward DDD, generating code scaffolding (entities, aggregates, repositories, domain events), facilitating Event Storming sessions, creating bounded context maps, or performing code reviews with a DDD lens. Covers both strategic design (bounded contexts, subdomains, context maps, ubiquitous language) and tactical design (entities, value objects, aggregates, domain services, repositories). Supports all major architecture patterns (Hexagonal/Ports & Adapters, CQRS, Event Sourcing, Clean Architecture) with language-agnostic guidance and concrete examples in Python and TypeScript.

中文简介正在准备中。当前显示原文说明。