52 lines
5.7 KiB
Markdown
52 lines
5.7 KiB
Markdown
# 🗺 ЧТО КУДА ЮЗАТЬ — роутер по задачам
|
||
|
||
## Агentic-инструмент №1
|
||
**REA** (`our-skills/rea-full-course/`) — «реверси что угодно»: Electron/JS бандлы, APK, EVM, Go/Rust. Ставится `npx rea-agents@latest setup` в Claude Code/Codex/Cursor/Hermes. Полный курс: `research-what-we-did/rea-full-course-source.md`.
|
||
|
||
## По типу цели
|
||
| Цель | Скиллы/тулзы |
|
||
|---|---|
|
||
| Windows PE (user-mode) | `reverse-engineering-malware-with-ghidra` (top-level) + `win-dev-skills/windbg-user-*` (TTD reverse debugging, heap corruption) + `performing-static-malware-analysis-with-pe-studio` |
|
||
| Windows kernel/драйверы | `win-dev-skills/windbg-kernel-*` + `analyzing-windows-driver-malware` + `dissecting-boot-and-kernel-rootkits` (analyst-ai-pack) |
|
||
| .NET | `reverse-engineering-dotnet-malware-with-dnspy` + `analyzing-dotnet-malware-internals` |
|
||
| Android APK | `android-reverse-engineering-skill` (SimoneAvogadro, jadx/Frida end-to-end) + `apk-reverse` (7 скиллов: unpacking, dex2jar) + `analyzing-android-malware-with-apktool` + `analyzing-android-dex-malware` |
|
||
| iOS | `reverse-engineering-ios-app-with-frida` |
|
||
| Linux ELF | `analyzing-elf-binaries-on-linux` + `analyzing-linux-elf-malware` + `analyzing-linux-kernel-rootkits` |
|
||
| macOS Mach-O | `analyzing-mach-o-binaries-on-macos` |
|
||
| Go / Rust / Nim / exotic | `analyzing-golang-malware-with-ghidra`, `reverse-engineering-rust-malware`, `analyzing-rust-malware-internals`, `reverse-engineering-nim-and-other-exotic-binaries` |
|
||
| ARM | `reverse-engineering-arm-binaries` |
|
||
| Прошивки / UEFI / PLC / embedded | `rev-skills/` (143 скилла: binwalk, EMBA, чипы, протоколы) + `performing-firmware-extraction-with-binwalk` + `auditing-uefi-firmware-with-chipsec` + `performing-plc-firmware-security-analysis` + `analyzing-uefi-bootkit-persistence` |
|
||
| JS/Web реверс (сигнатуры сайтов) | `xbsReverseSkill/` (33: xiaohongshu/bilibili/douyin, wasm, sign-алгоритмы) + `js-reverse-automation--skill` + `deobfuscating-javascript-malware` |
|
||
| Офис/PDF/скрипты | `analyzing-macro-malware-in-office-documents`, `analyzing-pdf-malware-with-pdfid`, `deobfuscating-powershell-obfuscated-malware`, `analyzing-malicious-*` (analyst-ai-pack) |
|
||
|
||
## По этапу работы
|
||
| Этап | Чем |
|
||
|---|---|
|
||
| Триаж образца | `triaging-an-unknown-sample`, `identifying-file-types-and-formats`, `measuring-section-entropy-to-detect-packing`, `extracting-and-classifying-strings`, capa: `generating-capability-reports-with-capa` |
|
||
| Распаковка | `manually-unpacking-a-packed-binary`, `unpacking-upx-and-common-packers`, `analyzing-packed-malware-with-upx-unpacker`, `dumping-and-rebuilding-a-pe-from-memory` |
|
||
| Статика | Ghidra: `scripting-ghidra-headless-analysis` · IDA: `scripting-ida-with-idapython` · r2/rizin: `reverse-engineering-binaries-with-radare2-rizin`, `automating-analysis-with-r2pipe` · Binary Ninja: `reverse-engineering-binaries-with-binary-ninja` |
|
||
| Динамика | `performing-dynamic-analysis-in-a-sandbox`, `analyzing-malware-behavior-with-cuckoo-sandbox`, `performing-automated-malware-analysis-with-cape`, `debugging-malware-with-x64dbg`, `monitoring-process-and-file-behavior`, lab: `setting-up-an-isolated-malware-analysis-lab` |
|
||
| Анти-анализ | `identifying-anti-debugging-techniques`, `bypassing-anti-vm-and-sandbox-checks`, `detecting-sandbox-evasion-behavior`, `defeating-control-flow-flattening`, `defeating-string-and-api-obfuscation` |
|
||
| Шеллкоды/инъекции | `emulating-shellcode-with-unicorn`, `reverse-engineering-shellcode`, `recovering-injected-code-and-shellcode`, `resolving-dynamic-api-hashing`, `analyzing-position-independent-code`, `analyzing-heap-spray-exploitation` |
|
||
| Конфиги/C2/ключи | `building-config-extractors`, `decrypting-embedded-configuration`, `extracting-config-from-a-running-sample`, `extracting-encryption-keys-from-binaries`, `extracting-cobalt-strike-beacon-config`, `reverse-engineering-custom-c2-protocols`, `analyzing-cobalt-strike-beacon-configuration` |
|
||
| Память | `performing-memory-forensics-with-volatility3(+plugins)`, `analyzing-memory-dumps-with-volatility`, `analyzing-malware-in-memory-with-volatility3`, `detecting-process-injection-in-memory` |
|
||
| Символьное исполнение | `solving-malware-with-symbolic-execution` |
|
||
| Дифф/патч | `diffing-malware-samples-to-find-changes`, `patch-diffing-with-bindiff-and-diaphora` |
|
||
| YARA/детекты | `writing-yara-rules-from-reversed-code`, `scanning-samples-with-yara`, `performing-malware-triage-with-yara`, `performing-yara-rule-development-for-detection` |
|
||
| Отчёт | `writing-a-malware-analysis-report`, `performing-full-scope-malware-analysis` |
|
||
| CTF | `CTF-Sandbox-Orchestrator` (42 сценария) |
|
||
| Пентест-интеграция | `reverser-pentester`, `pentest-tools/src-hunter` |
|
||
|
||
## MCP-серверы для агента (что подключать)
|
||
- **REA** — универсальный (Electron/Ghidra/JADX/EVM) — `our-skills/rea-full-course`
|
||
- **ida-pro-mcp** — IDA GUI-attached (`~/.idapro/mcp.json`)
|
||
- **GhidraMCP / ghidra-mcp** — Ghidra headless/GUI
|
||
- **x64dbg-mcp / r2ai** — динамика Windows / r2
|
||
- Каталог + пробы: `research-what-we-did/mcp-catalogs.md`
|
||
|
||
## Золотой пайплайн (malware-образец)
|
||
DIE/entropy/strings триаж → распаковка → статика (Ghidra/IDA) → динамика (sandbox/x64dbg/Frida) → деобфускация → behavior/конфиг-экстрактор → diff с известными → YARA + отчёт
|
||
|
||
---
|
||
👻 [ииШко](https://t.me/AlStack)
|