5.7 KiB
5.7 KiB
🗺 ЧТО КУДА ЮЗАТЬ — роутер по задачам
Агentic-инструмент №1
REA (our-skills/rea-full-course/) — «реверси что угодно»: Electron/JS бандлы, APK, EVM, Go/Rust. Ставится npx rea-agents@latest setup в Claude Code/Codex/Cursor/Hermes. Полный курс: research-what-we-did/rea-full-course-source.md.
По типу цели
| Цель | Скиллы/тулзы |
|---|---|
| Windows PE (user-mode) | reverse-engineering-malware-with-ghidra (top-level) + win-dev-skills/windbg-user-* (TTD reverse debugging, heap corruption) + performing-static-malware-analysis-with-pe-studio |
| Windows kernel/драйверы | win-dev-skills/windbg-kernel-* + analyzing-windows-driver-malware + dissecting-boot-and-kernel-rootkits (analyst-ai-pack) |
| .NET | reverse-engineering-dotnet-malware-with-dnspy + analyzing-dotnet-malware-internals |
| Android APK | android-reverse-engineering-skill (SimoneAvogadro, jadx/Frida end-to-end) + apk-reverse (7 скиллов: unpacking, dex2jar) + analyzing-android-malware-with-apktool + analyzing-android-dex-malware |
| iOS | reverse-engineering-ios-app-with-frida |
| Linux ELF | analyzing-elf-binaries-on-linux + analyzing-linux-elf-malware + analyzing-linux-kernel-rootkits |
| macOS Mach-O | analyzing-mach-o-binaries-on-macos |
| Go / Rust / Nim / exotic | analyzing-golang-malware-with-ghidra, reverse-engineering-rust-malware, analyzing-rust-malware-internals, reverse-engineering-nim-and-other-exotic-binaries |
| ARM | reverse-engineering-arm-binaries |
| Прошивки / UEFI / PLC / embedded | rev-skills/ (143 скилла: binwalk, EMBA, чипы, протоколы) + performing-firmware-extraction-with-binwalk + auditing-uefi-firmware-with-chipsec + performing-plc-firmware-security-analysis + analyzing-uefi-bootkit-persistence |
| JS/Web реверс (сигнатуры сайтов) | xbsReverseSkill/ (33: xiaohongshu/bilibili/douyin, wasm, sign-алгоритмы) + js-reverse-automation--skill + deobfuscating-javascript-malware |
| Офис/PDF/скрипты | analyzing-macro-malware-in-office-documents, analyzing-pdf-malware-with-pdfid, deobfuscating-powershell-obfuscated-malware, analyzing-malicious-* (analyst-ai-pack) |
По этапу работы
| Этап | Чем |
|---|---|
| Триаж образца | triaging-an-unknown-sample, identifying-file-types-and-formats, measuring-section-entropy-to-detect-packing, extracting-and-classifying-strings, capa: generating-capability-reports-with-capa |
| Распаковка | manually-unpacking-a-packed-binary, unpacking-upx-and-common-packers, analyzing-packed-malware-with-upx-unpacker, dumping-and-rebuilding-a-pe-from-memory |
| Статика | Ghidra: scripting-ghidra-headless-analysis · IDA: scripting-ida-with-idapython · r2/rizin: reverse-engineering-binaries-with-radare2-rizin, automating-analysis-with-r2pipe · Binary Ninja: reverse-engineering-binaries-with-binary-ninja |
| Динамика | performing-dynamic-analysis-in-a-sandbox, analyzing-malware-behavior-with-cuckoo-sandbox, performing-automated-malware-analysis-with-cape, debugging-malware-with-x64dbg, monitoring-process-and-file-behavior, lab: setting-up-an-isolated-malware-analysis-lab |
| Анти-анализ | identifying-anti-debugging-techniques, bypassing-anti-vm-and-sandbox-checks, detecting-sandbox-evasion-behavior, defeating-control-flow-flattening, defeating-string-and-api-obfuscation |
| Шеллкоды/инъекции | emulating-shellcode-with-unicorn, reverse-engineering-shellcode, recovering-injected-code-and-shellcode, resolving-dynamic-api-hashing, analyzing-position-independent-code, analyzing-heap-spray-exploitation |
| Конфиги/C2/ключи | building-config-extractors, decrypting-embedded-configuration, extracting-config-from-a-running-sample, extracting-encryption-keys-from-binaries, extracting-cobalt-strike-beacon-config, reverse-engineering-custom-c2-protocols, analyzing-cobalt-strike-beacon-configuration |
| Память | performing-memory-forensics-with-volatility3(+plugins), analyzing-memory-dumps-with-volatility, analyzing-malware-in-memory-with-volatility3, detecting-process-injection-in-memory |
| Символьное исполнение | solving-malware-with-symbolic-execution |
| Дифф/патч | diffing-malware-samples-to-find-changes, patch-diffing-with-bindiff-and-diaphora |
| YARA/детекты | writing-yara-rules-from-reversed-code, scanning-samples-with-yara, performing-malware-triage-with-yara, performing-yara-rule-development-for-detection |
| Отчёт | writing-a-malware-analysis-report, performing-full-scope-malware-analysis |
| CTF | CTF-Sandbox-Orchestrator (42 сценария) |
| Пентест-интеграция | reverser-pentester, pentest-tools/src-hunter |
MCP-серверы для агента (что подключать)
- REA — универсальный (Electron/Ghidra/JADX/EVM) —
our-skills/rea-full-course - ida-pro-mcp — IDA GUI-attached (
~/.idapro/mcp.json) - GhidraMCP / ghidra-mcp — Ghidra headless/GUI
- x64dbg-mcp / r2ai — динамика Windows / r2
- Каталог + пробы:
research-what-we-did/mcp-catalogs.md
Золотой пайплайн (malware-образец)
DIE/entropy/strings триаж → распаковка → статика (Ghidra/IDA) → динамика (sandbox/x64dbg/Frida) → деобфускация → behavior/конфиг-экстрактор → diff с известными → YARA + отчёт
👻 ииШко