Malware Analysis Tools

Content Leader: Jess Garcia - Last Updated: December 24, 2006

Hex Editors

• Windows
  • WinHex
  • HView
  • XVI32
  • Hex Workshop
  • UltraEdit-32
• UNIX
  • KHexedit (KDE)
  • HexCurse
• Mac
  • HexEdit

Debuggers

• Fakebust - Fake Exploit Code Detector - Description - Download
  Interactive "bounding box" debugger, under which the program is allowed to run for as long as certain boundary I/O conditions are not violated. Whenever the program attempts to gain access to a new, security-relevant resource, or tries to otherwise extend its permissions to a degree that would affect the system, the code is stopped, and the user is presented with an informative description and a choice what to do next.