mentebinaria/retoolkit

Reverse Engineer's Toolkit

English || Türkçe || Français || 中文简体 || 日本語

Reverse Engineer's Toolkit

What?

This is a collection of tools you may like if you are interested in reverse engineering and/or malware analysis on x86 and x64 Windows systems. After installing this program, you'll have two ways to access the tools:

• Double-click the retoolkit icon in the Desktop.
• Right-click on a file, choose retoolkit. This way the selected file is passed as argument to the desired program.

Why do I need it?

You don't. Obviously, you can download such tools from their own website and install them by yourself in a new VM. But if you download retoolkit, it will probably save you some time. Additionally, the tools come pre-configured so you'll find things like x64dbg with a few plugins, command-line tools working from any directory, etc. You may like it if you're setting up a new analysis VM.

Download

The *.iss files you see here are the source code for our setup program built with Inno Setup. To download the real thing, you have to go to the Releases section and download the setup program.

Included tools

Have a look at the wiki for a detailed list. By the way, you won't find cracked software there.

Is it safe to install it in my environment?

I don't know. Some included tools are not open source and come from shady places. You should use it exclusively in virtual machines and under your own responsibility.

Can you add tool X?

It depends. The idea is to keep it simple. We won't add a tool just because it's not here yet. But if you think there's a good reason to do so, and the license allows us to redistribute the software, please open an issue here if it doesn't exist yet.

Changelog

See CHANGELOG.md.

Similar projects

We're happy retoolkit inspired other people to create their own forks:

• https://github.com/indetectables-net/toolkit is also focused on RE tools and include a nice autoupdater program.
• https://github.com/cristianzsh/forensictools is focused on forensic tools.

retoolkit's Issues

Add VBDec

VBDec is a amazing tool for Visual Basic P-Code disassembling and debugging, it's free and very powerful!

http://sandsprite.com/vbdec/

Add WinObjEx64

WinObjEx64 is a tool that allows you to inspect the Windows Object Manager namespace and information such as list of deployed drivers, process information, callbacks information, etc:

https://github.com/hfiref0x/WinObjEx64

CFF Explorer

A nice freeware tool to navigate and edit PE files

https://ntcore.com/?page_id=388

Remove ASLR Removal plugin

Recent x64dbg versions provide a way to disable memory randomization at Options -> Preferences -> Engine -> Disable ASLR, thus the ASLR Removal plugin can be removed.

Add XOpcodeCalc

XOpcodeCalc is a nice utility tool for opcode calculation. It's useful as a fast assembly reference during RE:

https://github.com/horsicq/XOpcodeCalc

Add license and README file to SendTo+

Only binaries are included in the current release. License and readme file are needed.

Distribute the knowledge base (kb) files with IDR [Feature Request]

In order to IDR works we need the knowledge base (kb) files, the current folder contains the syskb*.bin files but it's missing the kb<version>.bin files, without them the analysis wont work. It can be found here inside the 7zip files.

dex2jar

Consider dex2jar

ref: https://twitter.com/ayatsubzero/status/1370955498170822660

Uninstaller does not uninstall 7-zip

After installing it installs a bunch of applications including 7-zip i believe. But after uninstalling the applications go away except 7-Zip.

Add Fakenet-ng

Fakenet is a very useful tool for C2 emulation, it allows write custom Python scripts and dump packets, it's suspended for it's development but still works pretty well!

https://github.com/mandiant/flare-fakenet-ng

64-bit OS needs 64-bit version retoolkit

I can not open it with window 64bit.

Add 4n4lDetector

4n4lDetector is an analysis tool for Microsoft Windows executable files, libraries, drivers and mdumps for x86 and x64. As of v1.8 an extended use for analyzing anomalies in Linux ELF executables was also included. Its main objective is to collect the necessary information to facilitate the identification of malicious code inside the analyzed files. This tool analyzes, among other things, the PE header and its structure, the content of the sections, the different types of strings, among many other things. It also incorporates a multitude of its own ideas to recognize anomalies in the construction of files and the detection of mechanisms used by current malware.

https://www.enelpc.com/p/4n4ldetector.html
https://github.com/4n0nym0us/4n4lDetector

IDA Pro

Adicione o IDA Pro

entropy

Add entropy for fast entropy calculation.

Rohitab API Monitor

This is a tentative suggestion for a tool addition, because I do not know whether it fits the scope.

However, I can firmly recommend the Rohitab API Monitor as one of the best Windows API tracing tools I have ever used:

http://www.rohitab.com/apimonitor

Add xntsv

xntsv is a nice utility tool to inspect process structures such as PEB, TEB, etc using a nice GUI:

https://github.com/horsicq/xntsv

Update x64dbg

Since 2022-10-10 the minidump command was added so you can remove that plugin as well.

Software launcher

The current software management solution is not very aesthetically pleasing and can be optimised by using similar software as in the example below
Website:
https://dawnlauncher.com/
https://github.com/fanchenio/Dawn-Launcher
Advantages: Can create subcategories (this allows for better classification)

Note: The international UI needs to be improved

Bazzar

I wrote this tool a couple time ago, I've been using to download malware samples inside Windows. Maybe can be useful :)

https://github.com/AandersonL/bazzar

Add FileInsight-plugins

FileInsight-plugins: decoding toolbox of McAfee FileInsight hex editor for malware analysis
https://github.com/nmantani/FileInsight-plugins

README.mdTranslation

Why?
Because the current README.md is described in English, this translation was done to facilitate the replacement of non-English users to understand the tool set retoolkit. I hope it can be adopted and improved.
中文简体 (Chinese Simplified):
Please see the uploaded attachment
README_zh_CN.md

Add pe_unmapper

pe_unmapper is a simple but useful tool that works with PE alignments to map/unmap files.

https://github.com/hasherezade/pe_unmapper

Add gftrace

gftrace is a tool I created some time ago. It's a Windows API tracing tool for Golang programs that abuses the Golang runtime to perform the tracing and ignores most part of the Golang runtime noise. It's useful for dynamic analysis of obfuscated and/or trojanized Golang samples:

https://github.com/leandrofroes/gftrace

Add Wireshark

Wireshark (network analysis and capture tool + USB capture) is GPL2. There should be no barrier to redistribution. The protocol analyzers are quite nice. Blah blah blah, everyone knows about Wireshark.

Threadtear

Threadtear
ref: https://twitter.com/kanye2032/status/1370837360775110659

How can I build by myself?

I want to add some other tools in retoolkit and build my own version. But I don't know how to. Where can I download the programs so that I can build retoolkit.exe by myself? Thanks.

Bringing HyperDbg Debugger back to the RE Toolkit

Hi,
Thanks for your great work of gathering these amazing tools together!

Yesterday, we released the first version (v0.1) of the HyperDbg debugger along with its compiled binaries. It would be a pleasure to be in RE Toolkit again.

Thanks,

Add Immunity Degugger, OllyDbg

Debugger

• Immunity Debugger is a powerful new way to write exploits, analyze malware, and reverse engineer binary files. It builds on a solid user interface with function graphing, the industry's first heap analysis tool built specifically for heap creation, and a large and well supported Python API for easy extensibility.
  https://www.immunityinc.com/products/debugger/

• OllyDbg is a 32-bit assembler level analysing debugger for Microsoft® Windows®. Emphasis on binary code analysis makes it particularly useful in cases where source is unavailable.
  https://www.ollydbg.de/

Network

- Wireshark is the world's foremost network protocol analyzer. It lets you see what's happening on your network at a microscopic level. It is the de facto (and often de jure) standard across many industries and educational institutions.

- nmap is a free and open source utility for network discovery and security auditing. https://nmap.org/

PE analyser

• PEiD: https://www.aldeid.com/wiki/PEiD PEiD is old, Exeinfo PE is the replacement.

Disassembler (missing)

- IDA Freeware: https://hex-rays.com/ida-free/

Compile Error

Looks like an .ico is missing

Add mal_unpack

mal_unpack is a dynamic unpacker based on PE-sieve. It's very useful for automated malware unpacking:

https://github.com/hasherezade/mal_unpack

Slow to press "Send to"

wouldn't it be better to just add the retoolkit in the first context menu? it's annoying to have to right click and then click send to everytime

PE-sieve

PE-sieve

ref: https://twitter.com/AlwaysOffMeta/status/1370911200712740865

Add tools to context menu

I've been trying to add a few tools to the right-click menu on Windows but without success. It works for single entries, but I wanted to have them under a retoolkit sub-menu. The later only worked with admin rights. 😢

Add dll_to_exe

dll_to_exe is a simple and useful tool to convert a "dll" into an "exe":

https://github.com/hasherezade/dll_to_exe

Add hollows_hunter

hollows_hunter is a process analysis tool that can be used to recognize and dump malicious implants such as shellcodes, hooks, etc:

https://github.com/hasherezade/hollows_hunter

Jadx

Please consider adding Jadx (https://github.com/skylot/jadx) to the list of decompilers as well.

ref: https://twitter.com/ThatAndroidUser/status/1379244013308502017

Add CodeCrackers Tools

Some of these are not open source but he is okay with sharing them and you can see the code with dnspy, they are not obfuscated.
https://github.com/CodeCracker-Tools
https://github.com/CodeCrackerSND
https://gitlab.com/CodeCracker

and here is a list of a lot .Net Tools for reverse engineering
https://github.com/NotPrab/.NET-Deobfuscator

I also have more tools on my repo which can be found here, however I don't have the source code : https://github.com/InstinctEx/deobfuscatetools/
I'm not asking for every single bit of those tools to get added but some of them are really useful.
Making this issue so you can check them out.

hyperdbg now has binary

https://github.com/HyperDbg/HyperDbg/releases

BinDiff

ref: https://twitter.com/AdmVonSchneider/status/1370849597170585600

Add ExtremeDumper

It would be nice to see ExtremeDumper as part of the toolkit. By far the easiest way to dump .NET assemblies from memory while they are running. As far as I know, none of the current tools are capable of doing that.

oletools

Nice cli to work with OLE files https://github.com/decalage2/oletools

Originally posted by @AandersonL in https://github.com/mentebinaria/retoolkit/discussions/30

PEiD

Tool Request

Can you add PEiD, please?

For malware analysis, peid and its plugin Kanal are very useful

Thanks in advance!

Add Python into user PATH [Feature request]

The current version does not add Python to the PATH variable, also if one types only python.exe a MS store pop-up will open, so it's good to remove the python.exe wrapper that MS uses to open the store.

del %localappdata%\Microsoft\WindowsApps\python.exe

The same also happen if type python3.exe and python3.7.

Ajout de fonctionnalité : SynsinternalSuite

https://learn.microsoft.com/en-us/sysinternals/downloads/sysinternals-suite

OllyDumpEx

Tool Request

The OllyDumpEx plugin supports x64dbg and is a fantastic plugin to dump payloads from memory:

https://low-priority.appspot.com/ollydumpex/#download

I feel like this would be very useful to include this with the x64dbg that comes with retoolkit.
OllyDumpEx can be downloaded from the following location:

https://low-priority.appspot.com/ollydumpex/OllyDumpEx.zip

Move Cutter to decompiler section [Feature request]

Currently Cutter debugger is on Beta and is not considered stable enough like x64dbg, so it's fit better in the decompiler/disassembler section as this is his main purpose.

"Reproducible builds"

Salve, Mercês. Obrigado pelo pacote disponibilizado neste repositório.

Apenas uma sugestão para que fosse possível "Reproducible builds":
Uma vez que temos o seu fonte do instalador, o ideal era que você também disponibilizasse a origem ou pelo menos a hash das ferramentas que você utiliza em cada release do retoolkit para que tivéssemos a plena certeza de que o instalador esteja de acordo com as fontes.

Até pelo aviso que você colocou, eu entendo que não tem como colocar exatamente a origem de certas ferramentas que você inclui. Mas o que estou sugerindo é que nesses casos extremos a hash sirva para quem deseja fazer a verificação (ou o "reproducible build").

Quem me garante que um dia você (conscientemente ou não) resolva colocar um spyware no meio da release? =) Justamente para evitar a confiança cega, sugiro essa mudança. Na minha opinião, você tem uma excelente reputação e eu confio que você não faria algo do tipo. Mas vai que? E se um dia tua conta aqui do Github é invadida e lançam sorrateiramente uma nova release com um malware?

Mais uma vez, eu sei que você avisou que talvez não seja seguro usar essas ferramentas mesmo que numa VM temporária. Mas o que estou sugerindo é uma forma de pegarmos seus fontes + arquivos das ferramentas = instalador "limpo" criado pelo usuário, tirando da equação a confiança em uma pessoa.

Obrigado

Missing the issue templates

The project is currently missing the issue templates which might help the users to submit category-based issues. If you would like to add them, then I would like to submit a Pull Request with some relevant issue templates.

Thanks.

Add dumpulator

dumpulator is an amazing tool that emulates process dumps. It's very useful for string decryption, desobfuscation, etc:

https://github.com/mrexodia/dumpulator

Add GoReSym

GoReSym is a Golang symbol recovery tool, it's useful against obfuscated Golang samples:

https://github.com/mandiant/GoReSym