PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Writing your own Analyzer for the Open-Source Multi-Scanner IRMA

blog.quarkslab.com | tool | #open-source | #malware-analysis | #tutorial | #irma | #probe
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Step-by-step guide to writing a new IRMA probe, using a TrID file-type module as the example: setting up the dev environment with Vagrant and Ansible, then contributing the analyzer upstream.
Published
Collected

Related coverage

research · volexity.com
Go Get ‘Em: Updates to Volexity Golang Tooling
# Go Get ‘Em: Updates to Volexity Golang Tooling August 11, 2025 Ivan Mladenov _This blog post was the final deliverable for asummer internship project, which was completed under the direction of...
research · volexity.com
GoResolver: Using Control-flow Graph Similarity to Deobfuscate Golang Binaries, Automatically
# GoResolver: Using Control-flow Graph Similarity to Deobfuscate Golang Binaries, Automatically April 1, 2025 Killian Raimbaud and Paul Rascagneres In the course of its investigations, Volexity...
tool · github.com
Peach: Single-user, Local-first Personal Media Library and Management System
Offers a privacy-respecting, local-first alternative for media library indexing and playback, combining cloud-drive integration with automated scraping while keeping sensitive viewing data strictly local.
tool · github.com
LogonStealer: Windows Credential Provider DLL for Stealing Plaintext Passwords via CredProvDataModel Hooks
Demonstrates an effective post-exploitation technique targeting the modern Windows 11 WinRT logon architecture to harvest plaintext credentials while bypassing PPL.
tool · github.com
Droid ASC: High-Performance On-Demand Android Decompiler Front-End for Mobile Security & AI Agents
Radically reduces Android reverse-engineering overhead from tens of minutes and gigabytes of memory to milliseconds and megabytes, providing an ideal, stateless code analysis primitive for autonomous security agents and vulnerability researchers.
tool · github.com
x64dbg-MCP Server: MCP-powered agentic reverse engineering for x64dbg
The project gives AI assistants a broad, scriptable interface to x64dbg for binary analysis and malware research. Because it can read and write debugged-process memory and execute debugger actions over HTTP, keep the server bound to trusted interfaces, retain bearer authentication, and avoid exposing its unencrypted endpoints to untrusted networks.
Back