28 个 · 按相关度排序
Code obfuscation analysis and deobfuscation playbook. Use when reversing binaries protected by junk code, opaque predicates, self-modifying code, control flow flattening, VM protection, or string encryption.
中文简介正在准备中。当前显示原文说明。
Code obfuscation analysis and deobfuscation playbook. Use when reversing binaries protected by junk code, opaque predicates, self-modifying code, control flow flattening, VM protection, or string encryption.
中文简介正在准备中。当前显示原文说明。
Deobfuscates malicious JavaScript code used in web-based attacks, phishing pages, and dropper scripts by reversing encoding layers, eval chains, string manipulation, and control flow obfuscation to reveal the original malicious logic. Activates for requests involving JavaScript malware analysis, script deobfuscation, web skimmer analysis, or obfuscated dropper investigation.
中文简介正在准备中。当前显示原文说明。
Deobfuscates malicious JavaScript code used in web-based attacks, phishing pages, and dropper scripts by reversing encoding layers, eval chains, string manipulation, and control flow obfuscation to reveal the original malicious logic. Activates for requests involving JavaScript malware analysis, script deobfuscation, web skimmer analysis, or obfuscated dropper investigation.
中文简介正在准备中。当前显示原文说明。
Deobfuscates malicious JavaScript code used in web-based attacks, phishing pages, and dropper scripts by reversing encoding layers, eval chains, string manipulation, and control flow obfuscation to reveal the original malicious logic. Activates for requests involving JavaScript malware analysis, script deobfuscation, web skimmer analysis, or obfuscated dropper investigation.
中文简介正在准备中。当前显示原文说明。
Unwrap layers of obfuscated PowerShell malware to recover hidden commands, additional malicious code, and server addresses. Combines script structure analysis with execution tracing and decoding tools to support incident investigation and detection work.
中文简介正在准备中。当前显示英语简介。
Analyze malicious JavaScript from phishing pages, payment data theft scripts, and malware downloaders. Unwrap encoded strings and nested execution layers to reveal hidden behavior, identify stolen data fields, and document suspicious destinations for incident response.
中文简介正在准备中。当前显示英语简介。
Examine suspicious Word, Excel, and PowerPoint documents by extracting macros and untangling code designed to hide its purpose. Identify download addresses, execution triggers, and attack steps, then document findings and indicators for detecting related threats.
中文简介正在准备中。当前显示英语简介。
Client-side request-signing and anti-bot token reversal for bug bounty — when a request carries a sign/sig/hmac/token/nonce/timestamp/X-Sensor header that Burp Repeater cannot replay, recover the signer just enough to reproduce the request outside the client. Packet-first staging (capture real request → prove replay works → only reverse if replay fails) across the locate→recover→runtime→validation→replay spine. Covers tracing backward from the signature field (writer→builder→entry→source), isolating user-mutable sign inputs (timestamp/nonce/deviceId/body) vs constants (secret key), hooking fetch/XHR in DevTools, JS deobfuscation basics (webpack/wasm/JSVMP), and the bounty payoff: reach the protected API to then hunt IDOR/auth/business-logic. Use when Burp/mitmproxy replay of a signed or anti-bot-gated request fails and you suspect a client-computed field is blocking you.
中文简介正在准备中。当前显示原文说明。
Domain routing and boundary guidance for authorized reverse engineering analysis, including decompilation, debugging, protocol reversing, firmware extraction, and deobfuscation. Use when a task belongs to the reverse engineering domain and needs scope, evidence, pivot, or exit criteria.
中文简介正在准备中。当前显示原文说明。
Dump DEX files from a running Android app for unpacking/deobfuscation. Activate when the user wants to unpack an Android APK, dump DEX from memory, extract decrypted DEX files, or defeat class-loading packing.
中文简介正在准备中。当前显示原文说明。
Use when reverse-engineering a binary or firmware — static triage + decompilation (Ghidra/IDA/Binary Ninja), dynamic instrumentation (GDB/Frida 17/angr), anti-reversing & packer bypass, OLLVM/VM deobfuscation, UEFI/BIOS RE & Secure Boot research, patch-diffing for n-days
中文简介正在准备中。当前显示原文说明。
Run post-merge release build steps for this repository, including Android tag-driven releases and sequential iOS IPA generation with archival for Transporter upload and Crashlytics deobfuscation. Use after the release PR has been merged.
中文简介正在准备中。当前显示原文说明。
Uses symbolic execution (angr) to solve constraint-based malware problems — finding inputs that reach a target branch, recovering keys/passwords from a check routine, and brute-forcing opaque predicates — by generating a ready-to-edit angr harness. Activates for requests to use symbolic execution, solve a malware unlock check with angr, or recover an input that reaches a code path.
中文简介正在准备中。当前显示原文说明。
Resolves dynamically hashed Windows API names by brute-forcing observed hash constants against a wordlist of API/DLL names using common malware hashing algorithms (ROR13, djb2, FNV, CRC32). Activates for requests to resolve API hashes, identify hashed imports, or reverse an API hashing routine.
中文简介正在准备中。当前显示原文说明。
Deobfuscates malicious JavaScript from droppers, web pages, and HTA/scriptlets: unrolling string-array and char-code encodings, resolving eval/Function chains, and statically recovering payloads and URLs without executing untrusted code. Activates for requests to deobfuscate JavaScript, decode obfuscated JS, or analyze a malicious script dropper.
中文简介正在准备中。当前显示原文说明。
Deobfuscates malicious PowerShell by decoding -EncodedCommand, reversing string and format obfuscation, resolving base64/gzip/IEX layers, and recovering the final payload and IOCs. Activates for requests to deobfuscate, decode, or analyze obfuscated PowerShell commands or scripts.
中文简介正在准备中。当前显示原文说明。
Reverses .NET/managed malware: decompiling MSIL back to C#, defeating common .NET protectors and string encryptors, and tracing reflection-based loaders to recover the real payload. Activates for requests to analyze a .NET sample, decompile MSIL, or unpack a managed loader.
中文简介正在准备中。当前显示原文说明。
Analyzes malicious VBScript, WSF, and HTA scripts: parsing WSF/HTA containers, decoding VBScript.Encode (#@~^) and string obfuscation, and identifying WScript.Shell/ActiveX abuse to recover dropper behavior. Activates for requests to analyze VBScript, decode a WSF/HTA, or investigate a Windows Script Host dropper.
中文简介正在准备中。当前显示原文说明。
Defeats control-flow-flattening obfuscation by identifying the dispatcher/state- variable structure and reconstructing the original control flow so the logic becomes readable. Activates for requests to defeat control-flow flattening, deobfuscate an OLLVM-flattened function, or recover original control flow from a dispatcher loop.
中文简介正在准备中。当前显示原文说明。
Recovers obfuscated strings and resolves dynamically loaded APIs in malware: reversing XOR/stack-string/encoding schemes and mapping API-hash lookups back to function names. Activates for requests to deobfuscate strings, decode stack strings, or resolve API hashing in a binary.
中文简介正在准备中。当前显示原文说明。
Plan and run safe reverse engineering, decompilation, disassembly, instrumentation, de-obfuscation, and anti-analysis countermeasures for binaries, firmware, mobile apps, WebAssembly, JavaScript bundles, and .NET assemblies. Use for behavior reconstruction, cross-layer Electron tracing, REA, reversing strategy, decompiler selection, binary analysis, malware-style triage, unpacking, deobfuscation, defeating anti-debug or anti-VM checks, Wakaru, Ghidra, IDA, RetDec, radare2, Rizin, Frida, angr, YARA, or command scripts that capture analysis stats.
中文简介正在准备中。当前显示原文说明。
Systematically deobfuscate multi-layer PowerShell malware using AST analysis, dynamic tracing, and tools like PSDecode and PowerDecode to reveal hidden payloads and C2 infrastructure.
中文简介正在准备中。当前显示原文说明。
Analyzes malicious VBA macros embedded in Microsoft Office documents (Word, Excel, PowerPoint) to identify download cradles, payload execution, persistence mechanisms, and anti-analysis techniques. Uses olevba, oledump, and VBA deobfuscation to extract the attack chain. Activates for requests involving Office macro analysis, VBA malware investigation, maldoc analysis, or document-based threat examination.
中文简介正在准备中。当前显示原文说明。