Choose a target and follow source-linked tools, learning paths, REA workflows, case studies and research.
Choose the software or artifact you want to understand before choosing a tool. A Windows executable, Android package, managed assembly, website and network capture expose different kinds of evidence. Each task path below starts with a concrete question, explains the likely prerequisites and links to tools and learning material. Unknown costs, platforms and release compatibility stay labelled Unknown until a source supports them.
This hub combines original guidance with source-linked records. Begin with read-only inspection of an authorized sample, preserve its version and hash, and test important conclusions against raw evidence or a controlled run. AI-assisted analysis can organize observations, but generated prose and decompiled strings need independent verification. Use the comparison pages to choose by task fit rather than a universal ranking.
56 resources · Page 5 of 5
The official REA Touhou 4 showcase studies an aimed bullet-ring angle helper in a PC-98 DOS game. It is a focused example of combining assembly inspection with behavior reconstruction and compiler-oriented checks. Read the original case for the specific function and validation boundary; a successful reconstruction of this helper does not imply that the entire game has been recovered.
View evidence & requirementsUnblob extracts recognized file formats from firmware and other composite files. Choose it when you need a bounded map of nested components before inspecting code or configuration. Keep the original image and the extracted file lineage. Extraction identifies candidates for review; it does not establish device behavior, firmware authenticity or the safety of executing any recovered file.
View evidence & requirementsVolatility 3 examines memory images for forensic questions about processes, modules and system state. Use it when you have an authorized capture and a specific question about what was present in that snapshot. Preserve acquisition details and image integrity. A memory image is incomplete by nature, and a plugin result should be traced back to the structures it interpreted.
View evidence & requirementsREA organizes evidence from several analysis paths through a CLI and MCP interface. The available questions depend on the target, installed providers and released package version. A native pseudocode task may need Ghidra, Hopper or IDA; an Android method task may need JADX. REA helps coordinate those reads, but the underlying observations and their limits still matter.
View evidence & requirementsWireshark inspects captured network packets and protocol fields. It is useful when you need to understand a bounded exchange, identify endpoints or test a hypothesis about message framing. Keep the capture origin, time window and permissions with the analysis. A packet trace covers the traffic that was actually recorded; encryption and missing sessions limit what it can show.
View evidence & requirementsx64dbg is a Windows user-mode debugger for inspecting a native program while it runs. Use it after a static question has produced a likely address or event to observe. Breakpoints and traces can show values in one controlled scenario, while later paths may differ. The repository's modified GPL text needs exact license review, so this catalog leaves its license as Unknown.
View evidence & requirementsYARA applies pattern rules to files or other data in defensive analysis. Choose it when you can describe observable features of a family or sample set and want reproducible matches. Test rules against positive and negative examples, then review every hit. A match supports a classification hypothesis; it does not prove intent, safety or a complete malware family identity.
View evidence & requirementsYARA-X is a rule engine in the YARA ecosystem. It is relevant when you need to evaluate rule processing with the newer implementation, but the compatibility boundary must be checked for the exact syntax and version you use. Preserve the rules and test corpus. A successful scan returns matches for that input; it is not a general certification of detection quality.
View evidence & requirements