mirror of
https://github.com/gmh5225/awesome-game-security
synced 2026-06-21 13:56:22 +00:00
archive: add 5 repo prompt(s) [skip ci]
This commit is contained in:
github-actions[bot]
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,192 @@
|
||||
Project Path: arc_gmh5225_WeirdAntiCheatIdeas_jnfdbgup
|
||||
|
||||
Source Tree:
|
||||
|
||||
```txt
|
||||
arc_gmh5225_WeirdAntiCheatIdeas_jnfdbgup
|
||||
└── README.md
|
||||
|
||||
```
|
||||
|
||||
`README.md`:
|
||||
|
||||
```md
|
||||
# Weird Anti-Cheat Ideas
|
||||
## Objective:
|
||||
- Minimize the impact of cheaters in FPS games by 2025
|
||||
|
||||
## Key Ideas:
|
||||
- Some anti-cheat systems are more resilient to the arms race
|
||||
- ML detection frameworks can robustly model cheats
|
||||
- Occlusion culling systems prevent hard-to-detect wallhacks and are guaranteed to be secure
|
||||
- Automatic server side detections must be highly explainable anbd/or integrate with orthogonal methods
|
||||
- Proctoring tournaments with a camera for mouse and monitor
|
||||
- Tie efforts with anti-harassment work
|
||||
|
||||
### Detection:
|
||||
- Quantifying impact of cheaters
|
||||
- Reports / game? Stratify data by player skill, trust, spending?
|
||||
- Player retention
|
||||
- Quantifying perception across many games
|
||||
- Quantifying distribution of types of cheaters and tools to prioritize targets
|
||||
- Proctoring major online tournaments
|
||||
- "Help, he's definitely spinbotting" button
|
||||
- Implement efficient replay system
|
||||
- Tweak systems to catch cheaters red-handed
|
||||
- Improved labels provided to deep network
|
||||
- Labels in time
|
||||
- Labels with type of hack and degree of certainty/severity
|
||||
- Record abusive text and voice (legality?)
|
||||
- Kaggle competition for classifiers. Why crowdsource just the labels?
|
||||
- Manually generated aimbot data, or clean labels extracted from client-side anti-cheat
|
||||
- Cool features:
|
||||
- Trust factor
|
||||
- Lack of non-aim skills (movement, decision making, pre aim, discipline)
|
||||
- Drastic changes in skill
|
||||
- Network access patterns
|
||||
- Knowledge of enemy positions, never looking in a direction without enemies
|
||||
- Burst DPS
|
||||
- Inspiring architectures:
|
||||
- Valve's GRU on raw mouse dynamics
|
||||
- Transformers to improve skill encoding
|
||||
- Stack or average predictions of per-engagement models?
|
||||
- https://d4mucfpksywv.cloudfront.net/emergent-tool-use/images/multi-agent-policy-architecture-20190904a.png
|
||||
- Graph neural networks for unsupervised clustering of social graphs
|
||||
- Generating artificial aimbot data. Will basic smoothing aimbots be classified as abnormal?
|
||||
- Generating aimbot data from constrained self-play
|
||||
- https://openai.com/blog/more-on-dota-2/
|
||||
|
||||
### Prevention:
|
||||
- Occlusion culling/fog of war
|
||||
- Increasing cheater cost of reentry--2FA, trust factor, time requirements
|
||||
- Protecting high-profile streamers from playing against suspicious accounts
|
||||
- Securing the client
|
||||
- Quantify effectivness to determine development focus
|
||||
- What can you do against adversaries with physical access?
|
||||
- Sandbox highly skilled new accounts, accounts with recently changed passwords or IP
|
||||
- Stricter identification requirements for top ~1% ranks
|
||||
- Messing with pixel bots by tweaking in-game colors. Noise or replacing red outlines with a lack of blue outlines.
|
||||
- Feasibility of hardware security, root of trust, enclaves
|
||||
|
||||
### Deterence:
|
||||
- False-positive quantification, defining and constraining error budget
|
||||
- Tiered sanctions, tets, and punishments--increasing with severity and probability of hacking
|
||||
- Integrate with VAC
|
||||
- Ban alternatives
|
||||
- Shadowban, use bots to supplement population
|
||||
- Make shadow pool engaging to cheaters with leaderboards and features. Unlikely to stop malicious types.
|
||||
- Spyro DRM. Pester cheaters in subtle ways that make them blame the game or the hack.
|
||||
|
||||
### Behavioral:
|
||||
- Compensate players for running into cheaters, without making the system gameable
|
||||
- Rollback competitive game changes if a cheater is detected
|
||||
- Freeze the ranking updates of a suspicious game for manual approval
|
||||
- Thank them for reporting cheaters
|
||||
- Incentivize players to help fight cheaters
|
||||
- Again, incentivize cheaters to stay in isolated lobbies
|
||||
|
||||
### Anti-Harassment
|
||||
- Harassment likely causes more damage than cheaters
|
||||
- Really easy to get organizational support
|
||||
- Best damage control and rehabilitation policies?
|
||||
- Harassment and hatred aren't specific to gaming, but it's enhanced by it.
|
||||
- How to cultivate a community that brings out the goodness in everyone?
|
||||
|
||||
### Industry Goals:
|
||||
- Encourage collaboration, publications, and conferences
|
||||
- Individual developers often like to share ideas
|
||||
- Large-scale efforts hampered by organizational pursuit of competitive advantage
|
||||
- Simple, open-source tools to help small developers protect themselves.
|
||||
- Incorporating ideas from many genres? FPS, MMO, RTS, MOBA, table-top.
|
||||
- Consulting with former and current cheat creators
|
||||
- Specific companies to reach out to (in loose order):
|
||||
- Valve
|
||||
- Riot
|
||||
- Tencent
|
||||
- EA / EAP
|
||||
- Denuvo, EAC, BattleEye
|
||||
- Epic Games
|
||||
- PUBGC
|
||||
- Blizzard / Activision
|
||||
- Jagex
|
||||
- Chess.com and poker sites
|
||||
- Bungie
|
||||
- Ubisoft
|
||||
- Bohemia Interactive
|
||||
- New World Interactive
|
||||
- Other indies
|
||||
- ESA, Fair Play Alliance
|
||||
|
||||
### Economic:
|
||||
- Measure economic impact of cheaters on current and past games
|
||||
- Consider studies on economics of drug industry
|
||||
- Measuring elasticity of cheat demand
|
||||
- Possible to undercut cheat providers? Or does supply just create more demand?
|
||||
|
||||
### Developer Practices:
|
||||
- EAC dev recommends to not announce ban waves (small number looks lazy, big number normalizes cheating)
|
||||
- Don't get involved with trolls, only interact with polite users
|
||||
- Be transparent with community, hold both parties accountable
|
||||
- Act like a duck--always calm above water
|
||||
- Stay safe
|
||||
- Don't be a target. Would someone be incentivized to harm you or your friends?
|
||||
- Use good personal security practices. Passwords, 2FA.
|
||||
- Separate hardware network and VM for dangerous work.
|
||||
|
||||
### Community Interaction
|
||||
- Success is primarily about player experience and perception
|
||||
- Survey community for perceptions and suggestions
|
||||
- Controlled in-game form, Google form, forum analytics?
|
||||
- Gather additional data on player trust, skill, playtime, etc.
|
||||
|
||||
### Project Management:
|
||||
- How to prioritize anti-cheat strategies?
|
||||
- Impact (short/long term)
|
||||
- Cost (to develop and distribute)
|
||||
- Strategies of competitors
|
||||
- Community feedback
|
||||
- Ideal anti-cheat team composition. Size, skills?
|
||||
- Collaborating with infosec/security team?
|
||||
- Getting organizational resources, using analytics to determine areas of focus
|
||||
- How to integrate and delegate tasks to third parties like EAC?
|
||||
- Testing framework. Playtest with pros? Roll out in one map/mode? Random rollout with RCT?
|
||||
|
||||
### Career:
|
||||
- How to ramp up quickly and sustainably
|
||||
- How to decide between offers?
|
||||
- Potential to learn and network
|
||||
- Potential to make an impact (freedom, development resources, open-sourcing, company vision)
|
||||
- Turn down a good offer for a chance of a better offer? Uncertainty of appraisal, expected utility
|
||||
- Conisder contracting:
|
||||
- https://www.youtube.com/watch?v=R1aznQvqMQw
|
||||
- Find a good attorney
|
||||
|
||||
### Thoughts on Hack vs. Hack
|
||||
- Could be a mode with competitive integrity, save for problems with balance.
|
||||
- Hard to get into because it requires investment in VPN and VM/separate machine.
|
||||
- Rewards decision making over mechanical aim in fights.
|
||||
- Rewards strategy and teamplay over positional game sense and information control.
|
||||
- Rewards usage, tuning, and creation of tools.
|
||||
- Hopefully reduce casual cheating a little bit. Ineffective at deterring people who hack to win.
|
||||
|
||||
### Misc:
|
||||
- Examine MOBA market's response to Riot's anti-cheat
|
||||
- Trust factor, possibly integrate with Valve's.
|
||||
- Does trust factor stratification increase cheat contagion?
|
||||
- Custom game modes with wallhacks and easy aim, maybe speed. Modes with asymmetric player power.
|
||||
- Legally taking down cheat providers. Studies on effectiveness? Economics.
|
||||
- Laying traps for cheat developers, bait, or directed evolution.
|
||||
- Outsourcing not only detection, but grunt development work to the community.
|
||||
|
||||
### News
|
||||
- (April 2020) https://www.pubg.com/en-us/2020/04/21/dev-letter-anti-cheat-performance-plans-for-2020/
|
||||
|
||||
### Favorite talks
|
||||
- https://www.gdcvault.com/play/1024994/Robocalypse-Now-Using-Deep-Learning
|
||||
- https://www.gdcvault.com/play/1025804/Reporting-Metasystem-Design-and-Penalization
|
||||
- https://www.gdcvault.com/play/1026757/What-Does-It-Take-to
|
||||
- https://www.youtube.com/watch?v=knvySXCNfd8
|
||||
- https://www.youtube.com/watch?v=C5qfKaVe89c
|
||||
- https://www.youtube.com/watch?time_continue=1&v=aZIxPfLLh98&feature=emb_title
|
||||
|
||||
```
|
||||
@@ -0,0 +1,912 @@
|
||||
Project Path: arc_gmh5225_alt-V-Anticheat-Guide_xg9aw3zp
|
||||
|
||||
Source Tree:
|
||||
|
||||
```txt
|
||||
arc_gmh5225_alt-V-Anticheat-Guide_xg9aw3zp
|
||||
└── README.md
|
||||
|
||||
```
|
||||
|
||||
`README.md`:
|
||||
|
||||
```md
|
||||
<h1 align="center">alt-V-Anticheat-Guide</h1>
|
||||
|
||||
---
|
||||
|
||||
## :warning: **DISCLAIMER** :warning:
|
||||
|
||||
This guide is more or less designed to help you find approaches to detect & ban cheaters. Please do not use the same variable names, metas, or code in any case.
|
||||
An anticheat is characterized by individuality, because otherwise the cheat developers can understand your anticheat and outsmart it easily!
|
||||
|
||||
## Contents
|
||||
|
||||
1. [Introduction](#1-introduction)
|
||||
2. [Type of cheaters](#2-type-of-cheaters)
|
||||
2.1 [The rager](#21-the-rager)
|
||||
2.2 [Casual cheaters](#22-casual-cheaters)
|
||||
2.3 [Legit cheaters](#23-legit-cheaters)
|
||||
2.4 [Careful cheaters](#24-careful-cheaters)
|
||||
3. [Type of cheats](#3-type-of-cheats)
|
||||
3.1 [Injectors & Executors](#31-injectors--executors)
|
||||
3.2 [Casual cheats](#32-casual-cheats)
|
||||
4. [Anticheat Implementations](#4-anticheat-implementations)
|
||||
4.1 [Code security](#41-code-security)
|
||||
4.2 [Data security](#42-data-security)
|
||||
4.3 [Self banning events](#43-self-banning-events)
|
||||
4.4 [No bushes/ props detection](#44-no-bushesprops-detection)
|
||||
4.5 [Code injectors](#45-code-injectors)
|
||||
4.6 [ESP](#46-esp)
|
||||
4.7 [Weapon (attachments) giving](#47-weapon-attachments-giving)
|
||||
4.8 [Weapon modifications](#48-weapon-modifications)
|
||||
4.9 [Classic aimbot](#49-classic-aimbot)
|
||||
4.10 [Silent aimbot & magic bullets](#410-silent-aimbot--magic-bullets)
|
||||
4.11 [Healing](#411-healing)
|
||||
4.12 [Ammunition](#412-ammunition)
|
||||
4.13 [Pressed keys](#413-pressed-keys)
|
||||
4.14 [Explosives](#414-explosives)
|
||||
4.15 [Teleporting](#415-teleporting)
|
||||
4.16 [Noclip](#416-noclip)
|
||||
5. [Multiaccount detection](#5-multiaccount-detection)
|
||||
6. [Things you should consider](#6-things-you-should-consider)
|
||||
6.1 [Spectator mode](#61-specator-mode)
|
||||
6.2 [forced debug mode](#62-force-debug-mode)
|
||||
6.3 [Bullet tracers](#63-bullet-tracers)
|
||||
6.4 [hiding while spectator mode](#64-hiding-while-spectator-mode)
|
||||
6.5 [Vehicle cheats](#65-vehicle-cheats)
|
||||
|
||||
## 1. Introduction
|
||||
|
||||
Cheats are a problem for many GTA5 MP servers. It is often the case that cheaters can use software for several months and years without being detected. So-called PC checks, or video recordings are also not really helpful, because almost every cheat leaves no trace and e.g. Silent Aimbots with low FOV is impossible to detect in video recordings.
|
||||
|
||||
It is also important that you always protect your code and especially the anticheat, so that players can't easily trick it!
|
||||
|
||||
It is also absolutely important that you only ban people from your server with your anticheat who are really obviously cheating and causing damage. If you are unsure about a cheater, then really check all parameters before the ban and make sure that you have as few false-bans as possible. Nothing is worse than being banned without having cheated. After all, there's hardly anything you can do about a ban, and of course it can damage the server's reputation in a very negative way.
|
||||
|
||||
## 2. Type of cheaters
|
||||
|
||||
Each cheater has their own mindset and as an anticheat developer you really have to think about each of these players and really cover all of them seamlessly so that you really get them all. However, on a server with a strict whitelist with multiaccount mechanisms, for example, you can often skip a lot of checks on Rage cheaters because you simply won't have them. Likewise, on a freeroam server, legit cheaters are unimportant, as they may even have the same options in their cheat as the server itself.
|
||||
|
||||
Also, try to put yourself in a cheater's position and think about what they would use to achieve certain advantages.
|
||||
|
||||
### 2.1 The rager
|
||||
|
||||
Rage cheaters are a really special species, as they try to forcefully inflict as much damage as quickly as possible. On an RP server, for example, they disrupt really big and important RP situations and usually want the maximum attention. Not infrequently, these are well-known groups, which then upload these situations to YouTube and are happy about a few views.
|
||||
A rage cheater usually uses an executor to run his own code. This then, for example, has found out the synced metas and can use ESP to pick out exactly the people who want to harass anyway. He then teleports directly there or uses noclip. Also popular are things like exploding cars or players, spawning objects that crash all players in the vicinity or the classic RPG. Also in rare cases they check your server for open source code from different modules (eg. chat, speedometer etc.) and try to spam events to crash or lag the server.
|
||||
To sum up, these don't appear often, but they can do some really heavy damage.
|
||||
|
||||
### 2.2 Casual cheaters
|
||||
|
||||
The classic casual cheater doesn't always have his cheats on and likes to use them only for a very short moment to enrich himself with them in a special situation. He is characterized by the fact that he only uses very few functions of his cheat and the damage is limited to a very small group of players. The casual cheater also often uses old open source cheats, which are often detected. On FiveM for example you can sort out such people very well, because you can search for loaded textures there. (FiveM cheats like to have a custom texture in their NativeUI banner, which of course is loaded into the game).
|
||||
A casual cheater can also be someone who, for example, develops frustration in PvP situations due to a lack of skills, grabs the next best cheat and sets the Recoil of all weapons to 0 at first.
|
||||
|
||||
### 2.3 Legit cheaters
|
||||
|
||||
This group of cheaters is by far more widespread. These cheaters often know exactly what they are doing and also know what is detected and what is not. I would go so far as to say that some write their cheats themselves with the help of executors or injectors, in order to circumvent known patterns.
|
||||
The most popular among legit cheaters is the Aimbot. Be it Silent Aimbot, Magic Bullets, or a simple Aimbot with a lot of smoothening. These players are hardly noticeable, because they are only slightly helped by the cheats in PvP compared to their skills through e.g. low FOV or high smoothening. Sometimes these people just use ESP to recognize opponents better, or to win RP situations decisively through such an advantage. Often, legit cheaters also have previous experience and are very likely to use hardware ID changers. You should keep an eye on that and if someone often changes his HardwareID, then that is already suspicious.
|
||||
|
||||
### 2.4 Careful cheaters
|
||||
|
||||
The average cautious cheater is comparable to a legit cheater, except that he uses his cheat functions even less often and even less. He doesn't want to be detected at all costs and is actually not a problem for most servers, because these people don't gain much in PvP or RP situations. Whether you want to cat these people is ultimately a cost/benefit question that everyone must answer for themselves. Often these people can only be caught by very intensive spectating, or own video recordings. Among the careful cheaters you can even count more and more streamers, because they want to be particularly good for their viewers, etc..
|
||||
|
||||
## 3. Type of cheats
|
||||
|
||||
There are many different types of cheats. Cheats may be self-developed and a player may use VMs, DMA PCIE devices, or other hardware to write directly to and read from the computer's memory. However, this type of cheat is absolutely rare and is more likely to be seen in games like Escape from Tarkov or Rust. For GTA, simpler methods are sufficient:
|
||||
|
||||
### 3.1 Injectors & Executors
|
||||
|
||||
There are several private executors a player can use. An executor simply hooks up to an alt:V JS resource and the player can modify and use it completely at will. You can use it to access the entire alt:V interface (alt-client) and all natives. Also you can use the local metas from the said resource.
|
||||
|
||||
Some executors also have functions that are specifically designed for alt:V. These can then among other things the following:
|
||||
|
||||
#### Spoofer
|
||||
|
||||
The cheater can make up all sorts of values and then only has to make sure that he has a different IP and possibly a new Discord account, and then he can get started.
|
||||
<img src='https://i.imgur.com/o4SvC7U.png' width=300><br>
|
||||
|
||||
#### Executor
|
||||
|
||||
You can run custom written code. The developer in this example provides a bad template, which can be detected very well. Often used to trigger certain events on the server.
|
||||
<img src='https://i.imgur.com/buhgxoE.png' width=300><br>
|
||||
|
||||
#### Dumper
|
||||
|
||||
The function can be used to dump all clientside code and resources. All vehicles and meta files are unencrypted and you can analyze them immediately without additional effort, or use them yourself.
|
||||
|
||||
The clientside code is readable without any encryption in the same structure as it is downloaded from the client. So all variables have plausible names and the file structure is also completely present.
|
||||
|
||||
If a server has taken steps against this, for example with the bytecode module, or JS obfuscation, then the whole thing is more difficult for the attacker to read. It should be noted, however, that from dumped bytecode module code you can still read all strings properly and you can also see which natives are called.
|
||||
<img src='https://i.imgur.com/xkV0cbE.png' width=300><br>
|
||||
|
||||
#### Event Logging
|
||||
|
||||
You can view all events that are exchanged between client and server and of course you can read all parameters in plain text.
|
||||
|
||||
For example, if you allow certain events only in one area, then this can be very exploitable under certain circumstances. For example, the cheater interacts with an object that is further away than expected.
|
||||
<img src='https://i.imgur.com/HPJoMi9.png' width=300><br>
|
||||
|
||||
#### Event Blocker
|
||||
|
||||
You can block predefined events and thus, for example, avoid a ban by a clientside cheat detection by simply blocking the event.
|
||||
<img src='https://i.imgur.com/A6z8Bi7.png' width=300><br>
|
||||
|
||||
#### Misc Options
|
||||
|
||||
You can at least connect to any server in debug mode with the executor shown here and thus possibly use developer options. You should definitely be careful what you allow in debug mode and what not!
|
||||
The Anti Weapon detection can be very well counteracted by a good Anticheat.
|
||||
<img src='https://i.imgur.com/tfoXMnh.png' width=300>
|
||||
|
||||
#### Availability
|
||||
|
||||
There are not many providers for alt:V specialized executors and also few users of it, nevertheless this part of cheaters should be considered with caution as they can cause the most damage.
|
||||
|
||||
### 3.2 Casual cheats
|
||||
|
||||
Casual cheats include everything that is available on the Clear Web for a few euros per month or is open source. Depending on the quality of the cheat and the settings the user chooses, it can be a bit difficult to detect.
|
||||
|
||||
#### ESP
|
||||
|
||||
ESPs are used to find players behind walls and at long distances. Since alt:V uses GTA sync, many stats are synced and you can use the ESP to display life, armor, possibly usernames and other details.
|
||||
|
||||
Most ESPs use the RAGE engine functions to draw lines directly in the game and others use external drawers to be stream proof for example. You can then record your gameplay, or stream it, and you can't see the ESP as a spectator.
|
||||
|
||||
#### Aim Helpers
|
||||
|
||||
Aim helpers are the main reason why people cheat. There are as many ways to cheat as there are ways to detect them. The most commonly used is a silent aimbot. This ensures that the shots from the player's weapon are always fired in a previously calculated direction. If a player sets the FOV low, this can be very difficult to detect. The disadvantage of this variant is that it is easily visible with tracers and often just aims at a certain body part.
|
||||
|
||||
Then there is the classic aimbot, which uses values calculated in the cheat to move the camera so that the player aims the weapon at the opponent. The cheater can not only adjust the FOV, but also other parameters like smoothening. Smoothening ensures that the cheat only very slightly interferes with the player's camera movement.
|
||||
|
||||
Finally, there is a currently newer variant and that is the Magic Bullet Aimbot. This changes the course of the shots and ensures that the fired bullets don't start at the cheaters position, but only a few centimeters in front of the opponent. This way, the cheat can calculate the exact position of the bullet's arrival and it is often possible to shoot through walls.
|
||||
|
||||
#### Weapon Modification
|
||||
|
||||
This function changes live weapon metas of the weapons. For example, you can adjust the recoil, damage and range of the weapons and of course set them as desired.
|
||||
|
||||
#### Godmode
|
||||
|
||||
Most cheats have a dozen options on how you want to set your godmode. There are options that simply make the player invincible, others add the lost HP back to the player, and yet other cheats activate a light generation. Whatever cheaters use. With a good anticheat, no cheater is safe from a ban.
|
||||
|
||||
#### Availability
|
||||
|
||||
Casual cheats are extremely easy to use and often cost very little money, or are even completely free. It can be assumed that on a PvP focused server a really large part of the players use or have used such software.
|
||||
Even on Freeroam servers there are dozens of people who test out their cheats and generate their attention with explosions, etc.
|
||||
|
||||
## 4. Anticheat Implementations
|
||||
|
||||
In this part, things finally get interesting, because I'm going to present a few suggestions on how you can fight cheaters.
|
||||
|
||||
### 4.1 Code security
|
||||
|
||||
The security of your code should be your highest asset. If a cheater gets hold of some of your source code, he can really do a lot of damage. Also, it can happen that other server developers help themselves to your work and you end up being robbed of your work and time.
|
||||
|
||||
alt:V offers with the bytecode module a very good protection against code theft. The only problem is that you can still read all strings with a code dumper and also which natives you use in which places. With a little effort, a cheater can then, for example, easily use your synced metas for usernames, IDs and auth levels and thus set his ESP really nice.
|
||||
|
||||
I currently only use the obfuscation method, since the alt:V bytecode module has caused massive crashes for all my players.
|
||||
|
||||
So you might want to go one step further and use a bundler and obfuscation. I use for example the module [altv-esbuild](https://github.com/xxshady/altv-esbuild) from xxshady and the [JS obfuscator](https://obfuscator.io/) to protect my code. With this, strings are still readable, but they are split in places and you can make it much harder for the cheater.
|
||||
|
||||
The only advantage of the bytecode module over obfuscation is performance, according to most developers. It is assumed that due to the more complex code of the obfuscator the player will have less FPS and the performance will suffer. In the live test I could not confirm this thesis myself. No matter if bytecode module or obfuscation, the players had the same performance.
|
||||
|
||||
The esbuild module is also so handy that it really includes all the resources including the resources in the shared folder so you don't have to send it to the client. This way you can also effectively obfuscate all assets in text form, etc.
|
||||
|
||||
Here my build.js file I use to build my resource for production:
|
||||
|
||||
```js
|
||||
import esbuild from "esbuild";
|
||||
import { altvEsbuild } from "altv-esbuild";
|
||||
import glob from "glob";
|
||||
import obfuscator from "javascript-obfuscator";
|
||||
import fs from "fs";
|
||||
|
||||
esbuild
|
||||
.build({
|
||||
entryPoints: ["resources/<your Resource>/client/startup.js"],
|
||||
outfile: "dist/bundle.js",
|
||||
bundle: true,
|
||||
plugins: [
|
||||
altvEsbuild({
|
||||
mode: "client", // use "server" for server code, and "client" for client code
|
||||
}),
|
||||
],
|
||||
})
|
||||
.then(() => {
|
||||
glob("dist/bundle.js", {}, (err, files) => {
|
||||
const result = obfuscator.obfuscate(fs.readFileSync("dist/bundle.js", "utf8"), {
|
||||
compact: true,
|
||||
target: "node",
|
||||
controlFlowFlattening: true,
|
||||
controlFlowFlatteningThreshold: 1,
|
||||
numbersToExpressions: true,
|
||||
simplify: true,
|
||||
stringArrayShuffle: true,
|
||||
splitStrings: true,
|
||||
stringArrayThreshold: 1,
|
||||
deadCodeInjection: true, // may increase performance issues!
|
||||
});
|
||||
fs.writeFileSync("resources/code/client/startup.js", result.getObfuscatedCode(), { encoding: "utf8" });
|
||||
});
|
||||
});
|
||||
```
|
||||
|
||||
#### How JS bytecode looks like:
|
||||
|
||||
<img src='https://i.imgur.com/iTM8MBX.png'>
|
||||
|
||||
#### How obfuscated code looks like:
|
||||
|
||||
<img src='https://i.imgur.com/0rhYlfU.png'>
|
||||
|
||||
### 4.2 Data security
|
||||
|
||||
#### Secure your server
|
||||
|
||||
I don't think I need to mention that you should secure your servers well under all circumstances. This starts with setting up a firewall that prevents attacks on the database structure, or that you can only access the SSH login of your server with a VPN, for example. If you are not well informed in this area, then try to get a rough overview by googling or using the [ChatGPT](https://chat.openai.com/chat) bot. Also every system administrator will help you with such questions.
|
||||
Also remember to make regular offshore backups of your database so that you don't suffer total data loss due to a failure. For example, there are very good free tools like [Duplicati](https://www.duplicati.com/).
|
||||
|
||||
#### Secure synced metas
|
||||
|
||||
We now know that the cheater can read the strings. But now you surely need strings to sync for example names, IDs, auth levels and so on with the players. To protect yourself from this you should use cryptic names for the synced metas or have them regenerated with every server restart. This way the cheater would have to search out the strings again with every server restart. The implementation of such a system should not bother you, because really few cheaters go so far and display the names in their ESP.
|
||||
|
||||
#### Secure events
|
||||
|
||||
Since events are sent to the server and also come from the server, they should be made unrecognizable to the cheater. You can change the event names when building the production version of the code, generate them automatically at server startup and send them encrypted to the client, and so on.
|
||||
|
||||
The complexity of the implementation depends on the desired security level.
|
||||
|
||||
#### Sanitizing & Storing passwords
|
||||
|
||||
Never store user passwords in the database in plain text. Ideally, you should also never send user-entered passwords to the server in clear text. It is best to use a function that creates a hash from the user's password and use it for storage and authorization.
|
||||
Sanitize all values that the user can enter and save before saving them to the database. Most database modules have such a function integrated.
|
||||
If you like to write your own SQL commands, [mysql2](https://www.npmjs.com/package/mysql2) is the best choice.
|
||||
|
||||
### 4.3 Self banning events
|
||||
|
||||
If you run client-side checks to see if the player is using cheats or not, then you should make sure in any case that you transfer the event to the server securely. We've learned that certain cheats can be used to block events, and that would undermine your entire anticheat.
|
||||
Don't use heartbeat checks, because the cheater can simply intercept and trigger implemented checks himself.
|
||||
You should also avoid using websockets without any special security, because the player can easily trick them too.
|
||||
|
||||
For me, the best solution was to send the ban reason as an event to the server and insert the current time. The server then checks if the incoming event is known or not and such an event can ban the cheater very easily and safely and the cheater can't prevent it.
|
||||
|
||||
Example:
|
||||
|
||||
```js
|
||||
alt.emitServer(`No Bushes detected! ${Date.now()}`);
|
||||
```
|
||||
|
||||
### 4.4 No bushes/props detection
|
||||
|
||||
As we know, there are players who really try to get an advantage in any situation by any means. The player. The no bush or no prop modification described here ensures that the player does not see certain bushes, trees and objects. These often have no collision and the player can even shoot through them.
|
||||
|
||||
This modification is not used by many cheaters, because the installation is a bit more complex and you first have to search for hours on the Internet for suitable files.
|
||||
|
||||
However, the detection of it is also that easy:
|
||||
|
||||
```js
|
||||
function checkGameFiles() {
|
||||
let textureRes;
|
||||
textureRes = native.getTextureResolution("ext_veg_reeds", "nxg_prop_sl_reeds");
|
||||
if ((Math.round(textureRes.x) < 512 || textureRes.y < 256) && Math.round(textureRes.x) != 4) {
|
||||
//Run Detection Event
|
||||
return;
|
||||
}
|
||||
|
||||
textureRes = native.getTextureResolution("prop_coral_2", "prop_coral_sweed_03");
|
||||
if ((Math.round(textureRes.x) < 128 || textureRes.y < 256) && Math.round(textureRes.x) != 4) {
|
||||
//Run Detection Event
|
||||
return;
|
||||
}
|
||||
|
||||
textureRes = native.getTextureResolution("prop_coral_2", "prop_coral_kelp_01_lod");
|
||||
if ((Math.round(textureRes.x) < 32 || textureRes.y < 128) && Math.round(textureRes.x) != 4) {
|
||||
//Run Detection Event
|
||||
return;
|
||||
}
|
||||
|
||||
textureRes = native.getTextureResolution("prop_bbq_4", "prop_bbq_4_ng");
|
||||
if ((Math.round(textureRes.x) < 256 || textureRes.y < 256) && Math.round(textureRes.x) != 4) {
|
||||
//Run Detection Event
|
||||
return;
|
||||
}
|
||||
|
||||
textureRes = native.getTextureResolution("prop_trafficlight", "prop_traffic_01a");
|
||||
if ((Math.round(textureRes.x) < 128 || textureRes.y < 256) && Math.round(textureRes.x) != 4) {
|
||||
//Run Detection Event
|
||||
return;
|
||||
}
|
||||
|
||||
textureRes = native.getTextureResolution("prop_trafficlight", "rsn_os_security_oldwide");
|
||||
if ((Math.round(textureRes.x) < 128 || textureRes.y < 128) && Math.round(textureRes.x) != 4) {
|
||||
//Run Detection Event
|
||||
return;
|
||||
}
|
||||
|
||||
textureRes = native.getTextureResolution("prop_fnclink_04", "prop_fnclink_02_dark");
|
||||
if ((Math.round(textureRes.x) < 128 || textureRes.y < 512) && Math.round(textureRes.x) != 4) {
|
||||
//Run Detection Event
|
||||
return;
|
||||
}
|
||||
|
||||
if (native.isModelInCdimage(alt.hash("prop_bin_07d")) === false) {
|
||||
//Run Detection Event
|
||||
return;
|
||||
}
|
||||
|
||||
if (0.4153 - native.getModelDimensions(alt.hash("prop_bin_07d"))[2].x > 0.1) {
|
||||
//Run Detection Event
|
||||
return;
|
||||
}
|
||||
|
||||
if (native.isModelInCdimage(alt.hash("prop_dumpster_01a")) === false) {
|
||||
//Run Detection Event
|
||||
return;
|
||||
}
|
||||
|
||||
if (native.isModelInCdimage(alt.hash("prop_elecbox_01a")) === false) {
|
||||
//Run Detection Event
|
||||
return;
|
||||
}
|
||||
|
||||
textureRes = native.getTextureResolution("prop_elecbox_01a", "prop_elecbox_01a");
|
||||
if ((Math.round(textureRes.x) < 128 || textureRes.y < 256) && Math.round(textureRes.x) != 4) {
|
||||
//Run Detection Event
|
||||
return;
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
I downloaded a pack to remove bushes and picked out a few of the hundreds of objects and textures, which I check. The cheapest of these modifications set the texture resolution to 100x100, which is really easy to see, and others use even lower values, or delete them completely from the client. To check if the objects are present I took a few, which are important for the cheater and check them with several natives.
|
||||
|
||||
Note that if the texture resolution is the value 4, that means that the texture is either not loaded or not present. You should not ban a player just because the value is 4.
|
||||
|
||||
Also, keep in mind that you only need to do this once on the player, since they can't easily change these files during the session.
|
||||
|
||||
### 4.5 Code injectors
|
||||
|
||||
Depending on the code the cheater injected, you can easily get it. For example, you can make sure that you count the number of [event listeners](https://docs.altv.mp/js/api/alt-client.html#_altmp_altv_types_alt_client_getEventListeners) and if the player has more keydown or keyup events than expected, then you can ban him immediately without any doubt.
|
||||
|
||||
You should also implement a function on the server side that checks whether the player sends too many events in too short a time and then kicks or bans him depending on the intensity. Many Rage cheaters exploit open source resources and can flood the chat with as many messages per second as they have frames per second. So if the cheater has 120 fps or more, then your server is actually almost instantly offline, or all players who are affected by it go down.
|
||||
|
||||
Also, for all localized events, make sure you check on the server side if the player is really close enough to the event to run it.
|
||||
|
||||
Also be sure to note that the executor attaches to one of the clientside javascript resources. So if you have multiple resources, it may be a bit more difficult to detect, since the event listeners only apply per resource.
|
||||
|
||||
### 4.6 ESP
|
||||
|
||||
Unfortunately, there is currently little that can be done automatically against an ESP. One possibility would be to test with a few natives and position checks whether the player looks directly at others through walls. (Many cheaters with ESP are so smart and look directly at the players through walls).
|
||||
|
||||
Such a system is certainly a bit more complex to develop and can possibly cause many false positives.
|
||||
|
||||
The best way to fight ESPs is to watch conspicuous players and analyze their behavior accurately.
|
||||
|
||||
### 4.7 Weapon (attachments) giving
|
||||
|
||||
Check at certain intervals or for certain actions whether the player is allowed to carry the currently selected weapon, whether he has only mounted allowed attachments and whether the number of bullets in the magazine is correct.
|
||||
|
||||
These checks are really easy to implement and usually keep away rage cheaters with miniguns and rocket launchers.
|
||||
|
||||
### 4.8 Weapon modifications
|
||||
|
||||
This method of cheating is also one of the most commonly used. There are really a lot of players who change the recoil, damage or range of their weapon to get an advantage.
|
||||
|
||||
Thanks to the [alt:V Weapon Data API](https://docs.altv.mp/js/api/alt-client.WeaponData.html), it is really easy to detect and ban these colleagues.
|
||||
|
||||
The easiest way to detect even the slightest differences is to create a dump yourself and then share it with the client and have it counterchecked.
|
||||
|
||||
There are cheaters who do not change the values much (e.g. Recoil to 0), but try to get closer with slight changes. With a dump you can detect even the smallest deviations and ban the cheater.
|
||||
|
||||
#### client:
|
||||
|
||||
```js
|
||||
const data = {};
|
||||
Object.values(weaponComponents).forEach((weapon) => {
|
||||
const weaponHash = alt.hash(weapon.HashKey);
|
||||
const weaponData = alt.WeaponData.getForHash(weaponHash);
|
||||
const weaponDataObj = {
|
||||
clipSize: weaponData.clipSize,
|
||||
accuracySpread: weaponData.accuracySpread,
|
||||
animReloadRate: weaponData.animReloadRate,
|
||||
damage: weaponData.damage,
|
||||
headshotDamageModifier: weaponData.headshotDamageModifier,
|
||||
lockOnRange: weaponData.lockOnRange,
|
||||
playerDamageModifier: weaponData.playerDamageModifier,
|
||||
range: weaponData.range,
|
||||
recoilAccuracyMax: weaponData.recoilAccuracyMax,
|
||||
recoilAccuracyToAllowHeadshotPlayer: weaponData.recoilAccuracyToAllowHeadshotPlayer,
|
||||
recoilRecoveryRate: weaponData.recoilRecoveryRate,
|
||||
recoilShakeAmplitude: weaponData.recoilShakeAmplitude,
|
||||
timeBetweenShots: weaponData.timeBetweenShots,
|
||||
};
|
||||
data[weaponHash] = weaponDataObj;
|
||||
});
|
||||
alt.emitServer("refreshWeaponData", data);
|
||||
```
|
||||
|
||||
#### server:
|
||||
|
||||
```js
|
||||
alt.onClient("refreshWeaponData", refreshWeaponData);
|
||||
function refreshWeaponData(player, data) {
|
||||
if (!player.valid) return;
|
||||
//if(player.data.authlevel < 1)return; MAKE SURE TO CHECK FOR PERMISSIONS!
|
||||
alt.log("saved weapon data");
|
||||
fs.writeFileSync("./resources/assets/DataDumps/weaponData.json", JSON.stringify(data));
|
||||
}
|
||||
```
|
||||
|
||||
#### client checking:
|
||||
|
||||
```js
|
||||
function acCheckWeapon(hash = undefined) {
|
||||
const weaponHashToCheck = hash != undefined ? hash : player.currentWeapon;
|
||||
if (weaponHashToCheck == 0xa2719263) return; //do not check fist
|
||||
const currWeaponStoredData = weaponData[weaponHashToCheck];
|
||||
const currWeaponData = alt.WeaponData.getForHash(weaponHashToCheck);
|
||||
|
||||
if (!currWeaponStoredData || !currWeaponData) {
|
||||
alt.log("e");
|
||||
return;
|
||||
}
|
||||
|
||||
let found = [];
|
||||
if (currWeaponData.clipSize != currWeaponStoredData.clipSize && weaponHashToCheck !== 1171102963 && weaponHashToCheck !== 911657153) found.push("clipSize" + `(${weaponHashToCheck})` + `(${currWeaponData.clipSize})`);
|
||||
if (currWeaponData.accuracySpread != currWeaponStoredData.accuracySpread) found.push("accuracySpread" + `(${weaponHashToCheck})` + `(${currWeaponData.accuracySpread})`);
|
||||
if (currWeaponData.animReloadRate != currWeaponStoredData.animReloadRate) found.push("animReloadRate" + `(${weaponHashToCheck})` + `(${currWeaponData.animReloadRate})`);
|
||||
if (currWeaponData.damage != currWeaponStoredData.damage) found.push("damage" + `(${weaponHashToCheck})` + `(${currWeaponData.damage})`);
|
||||
if (currWeaponData.headshotDamageModifier != currWeaponStoredData.headshotDamageModifier) found.push("headshotDamageModifier" + `(${weaponHashToCheck})` + `(${currWeaponData.headshotDamageModifier})`);
|
||||
if (currWeaponData.playerDamageModifier != currWeaponStoredData.playerDamageModifier) found.push("playerDamageModifier" + `(${weaponHashToCheck})` + `(${currWeaponData.playerDamageModifier})`);
|
||||
if (currWeaponData.range != currWeaponStoredData.range) found.push("range" + `(${weaponHashToCheck})` + `(${currWeaponData.range})`);
|
||||
if (currWeaponData.recoilAccuracyMax != currWeaponStoredData.recoilAccuracyMax) found.push("recoilAccuracyMax" + `(${weaponHashToCheck})` + `(${currWeaponData.recoilAccuracyMax})`);
|
||||
if (currWeaponData.recoilAccuracyToAllowHeadshotPlayer != currWeaponStoredData.recoilAccuracyToAllowHeadshotPlayer) found.push("recoilAccuracyToAllowHeadshotPlayer" + `(${weaponHashToCheck})` + `(${currWeaponData.recoilAccuracyToAllowHeadshotPlayer})`);
|
||||
if (currWeaponData.recoilRecoveryRate != currWeaponStoredData.recoilRecoveryRate) found.push("recoilRecoveryRate" + `(${weaponHashToCheck})` + `(${currWeaponData.recoilRecoveryRate})`);
|
||||
if (currWeaponData.recoilShakeAmplitude != currWeaponStoredData.recoilShakeAmplitude) found.push("recoilShakeAmplitude" + `(${weaponHashToCheck})` + `(${currWeaponData.recoilShakeAmplitude})`);
|
||||
if (currWeaponData.timeBetweenShots != currWeaponStoredData.timeBetweenShots) found.push("timeBetweenShots" + `(${weaponHashToCheck})` + `(${currWeaponData.timeBetweenShots})`);
|
||||
|
||||
if (found.length != 0) {
|
||||
alt.emitServer(JSON.stringify(found) + new Date());
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
You can grab the weapon component data from: https://gist.github.com/root-cause/3f29d38179b12245a003fb4fff615335
|
||||
|
||||
### 4.9 Classic aimbot
|
||||
|
||||
The classic Aimbot is used to target enemy players using camera arotaion, or targeted mouse inputs. I present here a method that works really well against it.
|
||||
|
||||
#### client:
|
||||
|
||||
```js
|
||||
let preventSusReport = false;
|
||||
let preventSusReportTimeout;
|
||||
|
||||
alt.on("playerWeaponShoot", (weaponHash, totalAmmo, ammoInClip) => {
|
||||
if (preventSusReport) {
|
||||
if (!preventSusReportTimeout) {
|
||||
preventSusReportTimeout = setTimeout(() => {
|
||||
preventSusReport = false;
|
||||
preventSusReportTimeout = undefined;
|
||||
}, 1000);
|
||||
}
|
||||
} else {
|
||||
//gather all needed variables for calculation
|
||||
const cameraRotation = native.getGameplayCamRot(2);
|
||||
const currentMousePos = alt.getCursorPos(false);
|
||||
const screenResolution = alt.getScreenResolution();
|
||||
|
||||
//check if the players mouse is not near any borders of the screen > could lead to a lot false positives
|
||||
const xDist = screenResolution.x - currentMousePos.x;
|
||||
const xDistCheck = xDist > screenResolution.x.toFixed(0) * 0.95 || xDist < screenResolution.x.toFixed(0) * 0.05;
|
||||
|
||||
if (!xDistCheck) {
|
||||
if (lastKnownMousePos.x == currentMousePos.x) {
|
||||
// if mouse position since last shot didnt changed
|
||||
/* the screenResolution.x*0.0005 is absolutely important,
|
||||
because the mouse position is only in integer values and when moving the mouse it could lead to different coordinates of the gameplay camera,
|
||||
but the mouse position is still the same. This is espacially important for really low screen resolutions!
|
||||
*/
|
||||
if (Math.abs(cameraRotation.z - lastKnownCameraRot) > screenResolution.x * 0.0005) {
|
||||
// Detection handle
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
lastKnownMousePos = alt.getCursorPos(false);
|
||||
lastKnownCameraRot = cameraRotation.z.toFixed(3);
|
||||
}
|
||||
});
|
||||
|
||||
alt.everyTick(() => {
|
||||
//prevent aimbot detection, when turning the camera by pressing C or right click
|
||||
if (native.isControlPressed(0, 26) || native.isControlJustPressed(0, 25)) {
|
||||
preventSusReport = true;
|
||||
if (preventSusReportTimeout) {
|
||||
alt.clearTimeout(preventSusReportTimeout);
|
||||
preventSusReportTimeout = undefined;
|
||||
}
|
||||
}
|
||||
});
|
||||
```
|
||||
|
||||
With the method shown above, you can detect players with aimbots really easily, even if they set the smoothening very high. The cheater just has to make the mistake of not moving his mouse while the aimbot is moving the camera :)
|
||||
|
||||
Just pay attention with the c and right click pressing while holding weapons, cheaters who got lost and have read this guide can keep pressing c or right mouse to prevent flagging.
|
||||
|
||||
Against Aimbots you can also check on the server side if the player is cheating or not. For example, you can calculate whether the player is targeting a bone particularly often in a row. Often people set their cheats to headshot only and if someone has hit the head more than, say, 40 times in a row, that's a bit sus.
|
||||
|
||||
A really good method is also to check the offsets and if the player hits close to a low value multiple times. The following example throws a false positive, but it is a better way to confirm acute suspicions.
|
||||
|
||||
(But if players hit the offsets 0, 0, 0 several times, you can ban them immediately for Magic Bullet cheat).
|
||||
|
||||
#### server:
|
||||
|
||||
```js
|
||||
alt.on("weaponDamage", (player, target, weaponHash, damage, offset, bodyPart) => {
|
||||
if (!player.valid || !target.valid) return;
|
||||
if (bodyPart != undefined) anticheatCheckAimbot(player, bodyPart);
|
||||
|
||||
if ((Math.abs(offset.x) < 0.015 || Math.abs(offset.y) < 0.015 || Math.abs(offset.z) < 0.015) && player.lastPos.distanceTo(player.pos) > 0.001 && target.lastPos.distanceTo(target.pos) > 0.001) {
|
||||
player.offsetFlags++;
|
||||
if (player.offsetFlags % 5 === 0) {
|
||||
// handle logging/ detection
|
||||
}
|
||||
} else {
|
||||
player.offsetFlags = 0;
|
||||
}
|
||||
// do not forget to set the lastPos once upon connection complete to not break this function
|
||||
// Or however I suggest to refactor this :D It's just a proof of concept
|
||||
player.lastPos = player.pos;
|
||||
target.lastPos = target.pos;
|
||||
});
|
||||
```
|
||||
|
||||
#### server:
|
||||
|
||||
```js
|
||||
function anticheatCheckAimbot(player, bone) {
|
||||
if (!player.valid) return;
|
||||
let currentData = player.getMeta("acAimbotCheck") ?? [bone, 0];
|
||||
if (currentData[0] === bone) {
|
||||
currentData[1]++;
|
||||
} else {
|
||||
currentData[0] = bone;
|
||||
currentData[1] = 0;
|
||||
}
|
||||
if (currentData[1] == 20) {
|
||||
// handle logging
|
||||
currentData[1] = 0;
|
||||
}
|
||||
player.setMeta("acAimbotCheck", currentData);
|
||||
}
|
||||
```
|
||||
|
||||
### 4.10 Silent aimbot & magic bullets
|
||||
|
||||
Silent aimbots and magic bullets are the hot shit among cheats and can hardly be detected like ESP.
|
||||
|
||||
Latest magic bullet cheats (or the leaks of the function for it) can be detected well, as players influence the bullet's trajectory and they spawn right in front of the enemy player. Thus, the offset in weaponDamage is well and truly 0, 0, 0 on the server side.
|
||||
|
||||
However, I have also developed a method for this, which can also filter out such cheaters:
|
||||
(Silent, Magic Bullet & trigger bots)
|
||||
|
||||
#### client:
|
||||
|
||||
```js
|
||||
alt.on("playerWeaponShoot", (weaponHash, totalAmmo, ammoInClip) => {
|
||||
// if player is shooting a bullet, while he is not allowed to do so, then yea...
|
||||
if (player.hasMeta("TRIGGERBOT_CHALLENGE")) {
|
||||
// logging or instant ban handle here
|
||||
}
|
||||
|
||||
/*
|
||||
I implemented a little pre-check before running this, because triggerbot detection
|
||||
can be very annoying for non-cheaters
|
||||
and it also only checks if there are enough bullets in the magazine to make sure that the player
|
||||
actually shoots in that time frame he is beeing checked.
|
||||
*/
|
||||
if (alt.getLocalMeta("PlayerActedWeird") && ammoInClip > 10) {
|
||||
if (getRandomInt(0, 1000) <= 3) {
|
||||
runSilentCheck();
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
function runSilentCheck() {
|
||||
/*
|
||||
To explain this: The most magic bullet or silent cheats are using the function setPedShootsAtCoord
|
||||
This is used to shoot a bullet, but however this ignores the disablePlayerFiring flag.
|
||||
So if a player shoots a bullet, while he is not allowed to do so, it's 100% silent or magic bullet cheat.
|
||||
However this can be really annoying for normal players, but this detection gives you the best chance to catch them all.
|
||||
*/
|
||||
const ticky = alt.everyTick(() => {
|
||||
native.disablePlayerFiring(0, true);
|
||||
});
|
||||
|
||||
player.setMeta("TRIGGERBOT_CHALLENGE", true);
|
||||
|
||||
setTimeout(() => {
|
||||
alt.emitServer("playerRanTriggeraimbot");
|
||||
player.deleteMeta("TRIGGERBOT_CHALLENGE");
|
||||
alt.clearEveryTick(ticky);
|
||||
}, 1000); // you can lower this value to 200ms, but one second works the best for revolvers, pistols etc.
|
||||
}
|
||||
|
||||
// just a little helper
|
||||
function getRandomInt(min, max) {
|
||||
min = Math.ceil(min);
|
||||
max = Math.floor(max);
|
||||
return Math.floor(Math.random() * (max - min + 1)) + min;
|
||||
}
|
||||
```
|
||||
|
||||
### 4.11 Healing
|
||||
|
||||
Healing cheats are used less by players on alt:V, because they are warned in the cheat tools and know what to expect when using it.
|
||||
|
||||
An implementation of such checks is very simple and you can simply check in an interval x, or after each shot, whether the player has more HP than he should have.
|
||||
|
||||
Here an implementation to check if someone has godmode active, or is healing himself automatically:
|
||||
Run the function if the player is suspicous, or in a random interval. It is up to you.
|
||||
|
||||
```js
|
||||
let isChecking = false;
|
||||
let healhackviolation = 0;
|
||||
|
||||
if (player.health > 110 && !isChecking /* Maybe exclude some edge cases like using medkits etc. in here*/) {
|
||||
isChecking = true;
|
||||
const oldHealth = player.health;
|
||||
native.setEntityHealth(player, player.health - 1, 0); // take 1hp and check if the player regains it. If so, ban him :)
|
||||
alt.setTimeout(() => {
|
||||
alt.setTimeout(() => {
|
||||
isChecking = false;
|
||||
}, 500);
|
||||
if (/* Maybe include some case to reset the counter */) {
|
||||
healhackviolation = 0; //reset when left gamemode while test
|
||||
return;
|
||||
}
|
||||
if (player.health >= oldHealth) {
|
||||
healhackviolation++;
|
||||
}
|
||||
else {
|
||||
healhackviolation = 0;
|
||||
if (player.health < 200 && player.health > 100) { // not dead and not fullhp
|
||||
native.setEntityHealth(player, player.health + 1, 0); //give back the 1 hp we stole the player
|
||||
}
|
||||
}
|
||||
if (healhackviolation == 3) {
|
||||
// Send Au Revoir
|
||||
return;
|
||||
}
|
||||
}, 100);
|
||||
}
|
||||
```
|
||||
|
||||
### 4.12 Ammunition
|
||||
|
||||
Just check after each shot if the player has more rounds in the magazine than he should have.
|
||||
|
||||
Be sure to take into account all eventualities in which the weapon magazine is refilled by intercation.
|
||||
|
||||
- Reloading
|
||||
- Weapon switch
|
||||
- Climbing onto objects
|
||||
|
||||
### 4.13 Pressed keys
|
||||
|
||||
My absolute favorite. You only have to log somewhere which special keys the player presses and you can justify suspicions very well.
|
||||
|
||||
Here is an example to detect this:
|
||||
|
||||
```js
|
||||
let pressedSusKeys;
|
||||
alt.on("keyup", (key) => {
|
||||
/* if (player.hasAnyMenuOpen()) return; -> Depends on the server menu.
|
||||
If you have something with NativeUI or arrow keys navigation
|
||||
exclude detection while the menu is open.
|
||||
*/
|
||||
let keyCode = "";
|
||||
switch (key) {
|
||||
case 0x2e:
|
||||
keyCode = "DEL";
|
||||
break;
|
||||
|
||||
case 0x2d:
|
||||
keyCode = "INS";
|
||||
break;
|
||||
|
||||
case 0x23:
|
||||
keyCode = "END";
|
||||
break;
|
||||
case 0x91:
|
||||
keyCode = "ROLL";
|
||||
break;
|
||||
|
||||
/*
|
||||
I suggest to disable arrow left, because some custom keyboards
|
||||
like mine are pressing the left key button randomly and this is just spamming the logs
|
||||
case 0x25:
|
||||
keyCode = 'ARROW LEFT';
|
||||
break;
|
||||
*/
|
||||
case 0x26:
|
||||
keyCode = "ARROW UP";
|
||||
break;
|
||||
|
||||
case 0x27:
|
||||
keyCode = "ARROW RIGHT";
|
||||
break;
|
||||
case 0x28:
|
||||
keyCode = "ARROW DOWN";
|
||||
break;
|
||||
case 0x24:
|
||||
keyCode = "HOME";
|
||||
break;
|
||||
default:
|
||||
return;
|
||||
}
|
||||
|
||||
// Use this object to store multiple interactions and send them bundled to prevent logging overload.
|
||||
if (!pressedSusKeys) pressedSusKeys = {};
|
||||
if (!pressedSusKeys[keyCode]) pressedSusKeys[keyCode] = 1;
|
||||
pressedSusKeys[keyCode]++;
|
||||
});
|
||||
|
||||
alt.setInterval(() => {
|
||||
if (pressedSusKeys) {
|
||||
// handle sending content to server.
|
||||
pressedSusKeys = undefined;
|
||||
}
|
||||
}, 60000);
|
||||
```
|
||||
|
||||
### 4.14 Explosives
|
||||
|
||||
Rage cheaters like to use various functions to cause a lot of damage with explosions.
|
||||
|
||||
Depending on the game mode, you can return explosions in the weaponDamage with false and thus block the whole thing, or you track how many explosions a player causes in a period of time.
|
||||
|
||||
There are also cheats that teleport to the driver's seat of all vehicles in the area and then explode them.
|
||||
|
||||
The most common explosion hash is the following:
|
||||
|
||||
```js
|
||||
weaponHash == 539292904;
|
||||
```
|
||||
|
||||
### 4.15 Teleporting
|
||||
|
||||
Teleport cheats are often used by Rage hackers or players in PvP modes, who port to another location shortly before death.
|
||||
|
||||
When detecting, it is important to take into account that the player may have lags, fall under the map or simply have a really bad computer.
|
||||
|
||||
Here is a small implementation approach:
|
||||
|
||||
#### client
|
||||
|
||||
```js
|
||||
const player = alt.Player.local;
|
||||
let latestPosition = player.pos;
|
||||
|
||||
alt.everyTick(() => {
|
||||
if (player.pos.distanceTo(latestPosition) > 100 /*&& player.health > 100*/) {
|
||||
// somehow pause this detection when a player is about to teleport, because its requested by the gamemode or server.
|
||||
// Also people with really bad fps may ban themselves. The best option is to track the performance and in PvP modes consider kicking players with really bad fps
|
||||
if (player.getMeta("PREVENTTPDETECTION") || alt.getFps() < 20) {
|
||||
latestPosition = player.pos;
|
||||
return;
|
||||
}
|
||||
//handle teleport detection
|
||||
alt.emitServer("CheatingIsBad", `Teleport/Speedhack ${latestPosition} -> ${player.pos} in one frame ${player.pos.distanceTo(latestPosition)}m traveled!`, 0);
|
||||
latestPosition = player.pos;
|
||||
} else {
|
||||
latestPosition = player.pos;
|
||||
}
|
||||
});
|
||||
```
|
||||
### 4.16 Noclip
|
||||
Noclip is also a function that is often only used by Rage cheaters and you can detect them relatively well. Here is an example:
|
||||
|
||||
```js
|
||||
const player = alt.Player.local;
|
||||
let noclipviolation = 0
|
||||
|
||||
// exlude vehicles with caution! Some cheats know that noclipping in vehicles is safe!
|
||||
if (!native.isPedRagdoll(player) && !player.vehicle && !native.isPedClimbing(player)) {
|
||||
// we try to get the actual ground position of the player. Sometimes the function fails due to roof etc.
|
||||
// may lead to issues in interiors or parking garages, make sure to test all possible locations and before only carefully execute automated bans
|
||||
let [_, height] = native.getGroundZFor3dCoord(player.pos.x, player.pos.y, player.pos.z, undefined, undefined);
|
||||
if (height == 0) [_, height] = native.getGroundZFor3dCoord(player.pos.x, player.pos.y, player.pos.z + 2, undefined, undefined);
|
||||
if (height == 0) [_, height] = native.getGroundZFor3dCoord(player.pos.x, player.pos.y, player.pos.z + 50, undefined, undefined);
|
||||
// If the game found no ground height the result is simply 0
|
||||
if (height != 0) {
|
||||
const heightdiff = player.pos.z - height;
|
||||
if (heightdiff < -3 || heightdiff > 10) {
|
||||
// check if the player is swimming or at least over water and ignore it
|
||||
const [waterprobe, ___] = native.testVerticalProbeAgainstAllWater(player.pos.x, player.pos.y, player.pos.z, 0, 30);
|
||||
if(!waterprobe){ //if not over water and height difference above ground is too bad
|
||||
noclipviolation++;
|
||||
}
|
||||
} else {
|
||||
noclipviolation = 0;
|
||||
}
|
||||
if (noclipviolation == 5) {
|
||||
// Send Noclip detection to server
|
||||
// Sending the detection after the first violation may lead to false positives, so we use 5 violations in a row
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
## 5. Multiaccount detection
|
||||
|
||||
Depending on the effort, multiaccounts can be detected very quickly. If you run a RP server with forum, then you can filter out almost all players with a plugin for the Woltlab Suite, because they have to reset their browser agent and also other attributes are checked.
|
||||
|
||||
But if you don't have a forum, it's a bit more complicated. In the first place, you can actually throw all of alt:V's or GTA's built-in checks in the garbage can. A cheater can spoof all these values with one click, or just fix the necessary adjustments.
|
||||
|
||||
#### hwidHash & hwidExHash
|
||||
|
||||
hwidHash and hwidExHash should also be viewed with absolute caution, as these values tend to change with a new installation of Windows, or a BIOS update.
|
||||
|
||||
ASRock motherboards with a certain type and an old BIOS version also have the bug that all players have the same hardware ID.
|
||||
|
||||
If you want to consider these values for identification, then you should form a hash from both and consider this combined. Individually, it can really lead to many difficulties.
|
||||
|
||||
#### socialID
|
||||
|
||||
It is recommended to block all players with the value set to 0, because they either use bad cheats, or try to connect in offline mode.
|
||||
(Possibly allow temporarily after a GTA update, otherwise hardly anyone can join the server). You should also keep in mind, that every players SocialID can be 0 if Rockstars servers are offline or not working correctly.
|
||||
|
||||
If the socialclub id is 488923086, then the player is using a version of a launcher that is very widespread in Eastern Europe, with which GTA can be played without a purchased license. I recommend to inform players with this ID to buy the game and also to kick/ban them from the server.
|
||||
|
||||
#### discordID
|
||||
|
||||
The discordID has one major purpose which makes it handy to use. It allows servers to dynamically create whitelists, which are connected to discord roles. The server can check if the user with discordId `123` has the role `abc`. Using only discordID allows cheaters to gain access using a spoofer to change their discordID to a whitelisted one so you should also consider using different methods at the same time. [We suggest using OAuth2](#so-if-all-is-bad-what-can-i-actually-use)
|
||||
|
||||
#### ip
|
||||
|
||||
By IP, I would only ban players if the account that matches that IP is also banned.
|
||||
Because at least in Germany many providers use Dual Stack Lite and it happens more often that players have the same public IP address. Also, IPs are reassigned after x hours and with a little luck you get that of another player.
|
||||
|
||||
Furthermore, it can be that in a household several people play on the server and you would first have to whitelist all accounts in the household, so that they are no longer flagged.
|
||||
|
||||
### So if all is bad, what can I actually use?
|
||||
|
||||
You should have the player log in with a Discord login and work with the player's token. No spoofer can influence these values and the player would have to create a new Discord account with every ban, which increases the hurdle significantly.
|
||||
|
||||
You should also best check the IP, HardwareID etc on other accounts when the player logs in and if the other accounts are banned with matching data. If you ban the player at every overlap, then you first need a larger team, which takes care of the support tickets :D
|
||||
|
||||
Use the [OAuth2 implementation from alt:V](https://docs.altv.mp/articles/discord_oauth.html) and please add a [fallback for Linux users](https://github.com/Stuyk/altv-discord-auth)
|
||||
|
||||
## 6. Things you should consider
|
||||
|
||||
Always keep in mind that the race between cheaters and anticheat never ends and you as a server developer should regularly check your anticheat for updates and update it if necessary.
|
||||
Here are a few more ideas that come to my mind
|
||||
|
||||
### 6.1 Specator mode
|
||||
|
||||
Develop a Spectator Mode that allows you to look from the cheater's point of view and closely observe his movements. You can use the native attachToEntity etc. for this.
|
||||
|
||||
### 6.2 Force debug mode
|
||||
|
||||
The executor shown at the beginning of the guide allows cheaters with debug mode to connect to servers that do not allow it, and the player could get access to developer options, or hidden menus. Make sure that such accesses are secured on the server side, or are not even on the live server.
|
||||
Also, the player could produce sync errors and duplicate items or money. Pay attention to how fast the player reconnects after a disconnect.
|
||||
|
||||
### 6.3 Bullet tracers
|
||||
|
||||
The new alt:V JS hook weaponShoot allows you to draw tracers of the bullets fired without silent or magic aimbot and you can better detect possible cheaters while spectating.
|
||||
|
||||
### 6.4 Hiding while spectator mode
|
||||
|
||||
Never just set your player invisible while spectating, but move it to a negative dimension, or set the streamed parameter to false!
|
||||
Cheaters can see players who are invisible with their ESP and aimbots ignore any players who are invisible or in godmode.
|
||||
|
||||
### 6.5 Vehicle cheats
|
||||
|
||||
Vehicle cheats are unfortunately a little too short here in the guide, but you can certainly use vehicle handling similar to the weapon metas in the first place to see whether the player has modified them and also check whether, for example, the acceleration or maximum speed is too high.
|
||||
|
||||
# Happy hunting! :heart:
|
||||
|
||||
If you have any question feel free to write me on Discord Kaniggel#6969
|
||||
And if you like to contribute to this guide, feel free to help me adding more content!
|
||||
|
||||
```
|
||||
@@ -0,0 +1,852 @@
|
||||
Project Path: arc_gmh5225_awesome-executable-packing_og9nb7z1
|
||||
|
||||
Source Tree:
|
||||
|
||||
```txt
|
||||
arc_gmh5225_awesome-executable-packing_og9nb7z1
|
||||
├── CODE-OF-CONDUCT.md
|
||||
├── CONTRIBUTING.md
|
||||
├── LICENSE
|
||||
└── README.md
|
||||
|
||||
```
|
||||
|
||||
`CODE-OF-CONDUCT.md`:
|
||||
|
||||
```md
|
||||
# Contributor Covenant Code of Conduct
|
||||
|
||||
## Our Pledge
|
||||
|
||||
In the interest of fostering an open and welcoming environment, we as
|
||||
contributors and maintainers pledge to making participation in our project and
|
||||
our community a harassment-free experience for everyone, regardless of age, body
|
||||
size, disability, ethnicity, gender identity and expression, level of experience,
|
||||
nationality, personal appearance, race, religion, or sexual identity and
|
||||
orientation.
|
||||
|
||||
## Our Standards
|
||||
|
||||
Examples of behavior that contributes to creating a positive environment
|
||||
include:
|
||||
|
||||
* Using welcoming and inclusive language
|
||||
* Being respectful of differing viewpoints and experiences
|
||||
* Gracefully accepting constructive criticism
|
||||
* Focusing on what is best for the community
|
||||
* Showing empathy towards other community members
|
||||
|
||||
Examples of unacceptable behavior by participants include:
|
||||
|
||||
* The use of sexualized language or imagery and unwelcome sexual attention or
|
||||
advances
|
||||
* Trolling, insulting/derogatory comments, and personal or political attacks
|
||||
* Public or private harassment
|
||||
* Publishing others' private information, such as a physical or electronic
|
||||
address, without explicit permission
|
||||
* Other conduct which could reasonably be considered inappropriate in a
|
||||
professional setting
|
||||
|
||||
## Our Responsibilities
|
||||
|
||||
Project maintainers are responsible for clarifying the standards of acceptable
|
||||
behavior and are expected to take appropriate and fair corrective action in
|
||||
response to any instances of unacceptable behavior.
|
||||
|
||||
Project maintainers have the right and responsibility to remove, edit, or
|
||||
reject comments, commits, code, wiki edits, issues, and other contributions
|
||||
that are not aligned to this Code of Conduct, or to ban temporarily or
|
||||
permanently any contributor for other behaviors that they deem inappropriate,
|
||||
threatening, offensive, or harmful.
|
||||
|
||||
## Scope
|
||||
|
||||
This Code of Conduct applies both within project spaces and in public spaces
|
||||
when an individual is representing the project or its community. Examples of
|
||||
representing a project or community include using an official project e-mail
|
||||
address, posting via an official social media account, or acting as an appointed
|
||||
representative at an online or offline event. Representation of a project may be
|
||||
further defined and clarified by project maintainers.
|
||||
|
||||
## Enforcement
|
||||
|
||||
Instances of abusive, harassing, or otherwise unacceptable behavior may be
|
||||
reported by contacting the project team at <alexandre.dhondt@gmail.com>. All
|
||||
complaints will be reviewed and investigated and will result in a response that
|
||||
is deemed necessary and appropriate to the circumstances. The project team is
|
||||
obligated to maintain confidentiality with regard to the reporter of an incident.
|
||||
Further details of specific enforcement policies may be posted separately.
|
||||
|
||||
Project maintainers who do not follow or enforce the Code of Conduct in good
|
||||
faith may face temporary or permanent repercussions as determined by other
|
||||
members of the project's leadership.
|
||||
|
||||
## Attribution
|
||||
|
||||
This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4,
|
||||
available at [http://contributor-covenant.org/version/1/4][version]
|
||||
|
||||
[homepage]: http://contributor-covenant.org
|
||||
[version]: http://contributor-covenant.org/version/1/4/
|
||||
|
||||
|
||||
```
|
||||
|
||||
`CONTRIBUTING.md`:
|
||||
|
||||
```md
|
||||
# Contribution Guidelines
|
||||
|
||||
Please note that this project is released with a [Contributor Code of Conduct](code-of-conduct.md). By participating in this project you agree to abide by its terms.
|
||||
|
||||
---
|
||||
|
||||
Ensure your pull request adheres to the following guidelines:
|
||||
|
||||
- One commit per suggestion is preferred
|
||||
- Commit message should follow this format: *Add [section]: [slugified name or description]* ; examples:
|
||||
|
||||
- *Add bibliography: generic-unpacking-techniques*
|
||||
- *Add packer: yoda-protector*
|
||||
- *Add tool: pypackerdetect*
|
||||
|
||||
- Multiple commits can be included in a single pull request
|
||||
- Each section has its entries alphabetically sorted ; please keep the same order
|
||||
- Use the following format: *[Item Name](homepage link) <newline> [description]*.
|
||||
- No duplication of tools, put them where they make the most sense
|
||||
- By submitting a pull request, you agree to release your submission under the LICENSE
|
||||
|
||||
Thank you for your suggestions!
|
||||
|
||||
|
||||
## Updating your PR
|
||||
|
||||
Making a PR adhere to the standards above can sometimes be difficult. If the maintainers notice anything that we'd like changed, we'll ask you to edit your PR before we merge it. There's no need to open a new PR, just edit the existing one. If you're not sure how to do that, [here is a guide](https://github.com/RichardLitt/knowledge/blob/master/github/amending-a-commit-guide.md) on the different ways you can update your PR so that we can merge it.
|
||||
|
||||
|
||||
```
|
||||
|
||||
`LICENSE`:
|
||||
|
||||
```
|
||||
Creative Commons Legal Code
|
||||
|
||||
CC0 1.0 Universal
|
||||
|
||||
CREATIVE COMMONS CORPORATION IS NOT A LAW FIRM AND DOES NOT PROVIDE
|
||||
LEGAL SERVICES. DISTRIBUTION OF THIS DOCUMENT DOES NOT CREATE AN
|
||||
ATTORNEY-CLIENT RELATIONSHIP. CREATIVE COMMONS PROVIDES THIS
|
||||
INFORMATION ON AN "AS-IS" BASIS. CREATIVE COMMONS MAKES NO WARRANTIES
|
||||
REGARDING THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS
|
||||
PROVIDED HEREUNDER, AND DISCLAIMS LIABILITY FOR DAMAGES RESULTING FROM
|
||||
THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS PROVIDED
|
||||
HEREUNDER.
|
||||
|
||||
Statement of Purpose
|
||||
|
||||
The laws of most jurisdictions throughout the world automatically confer
|
||||
exclusive Copyright and Related Rights (defined below) upon the creator
|
||||
and subsequent owner(s) (each and all, an "owner") of an original work of
|
||||
authorship and/or a database (each, a "Work").
|
||||
|
||||
Certain owners wish to permanently relinquish those rights to a Work for
|
||||
the purpose of contributing to a commons of creative, cultural and
|
||||
scientific works ("Commons") that the public can reliably and without fear
|
||||
of later claims of infringement build upon, modify, incorporate in other
|
||||
works, reuse and redistribute as freely as possible in any form whatsoever
|
||||
and for any purposes, including without limitation commercial purposes.
|
||||
These owners may contribute to the Commons to promote the ideal of a free
|
||||
culture and the further production of creative, cultural and scientific
|
||||
works, or to gain reputation or greater distribution for their Work in
|
||||
part through the use and efforts of others.
|
||||
|
||||
For these and/or other purposes and motivations, and without any
|
||||
expectation of additional consideration or compensation, the person
|
||||
associating CC0 with a Work (the "Affirmer"), to the extent that he or she
|
||||
is an owner of Copyright and Related Rights in the Work, voluntarily
|
||||
elects to apply CC0 to the Work and publicly distribute the Work under its
|
||||
terms, with knowledge of his or her Copyright and Related Rights in the
|
||||
Work and the meaning and intended legal effect of CC0 on those rights.
|
||||
|
||||
1. Copyright and Related Rights. A Work made available under CC0 may be
|
||||
protected by copyright and related or neighboring rights ("Copyright and
|
||||
Related Rights"). Copyright and Related Rights include, but are not
|
||||
limited to, the following:
|
||||
|
||||
i. the right to reproduce, adapt, distribute, perform, display,
|
||||
communicate, and translate a Work;
|
||||
ii. moral rights retained by the original author(s) and/or performer(s);
|
||||
iii. publicity and privacy rights pertaining to a person's image or
|
||||
likeness depicted in a Work;
|
||||
iv. rights protecting against unfair competition in regards to a Work,
|
||||
subject to the limitations in paragraph 4(a), below;
|
||||
v. rights protecting the extraction, dissemination, use and reuse of data
|
||||
in a Work;
|
||||
vi. database rights (such as those arising under Directive 96/9/EC of the
|
||||
European Parliament and of the Council of 11 March 1996 on the legal
|
||||
protection of databases, and under any national implementation
|
||||
thereof, including any amended or successor version of such
|
||||
directive); and
|
||||
vii. other similar, equivalent or corresponding rights throughout the
|
||||
world based on applicable law or treaty, and any national
|
||||
implementations thereof.
|
||||
|
||||
2. Waiver. To the greatest extent permitted by, but not in contravention
|
||||
of, applicable law, Affirmer hereby overtly, fully, permanently,
|
||||
irrevocably and unconditionally waives, abandons, and surrenders all of
|
||||
Affirmer's Copyright and Related Rights and associated claims and causes
|
||||
of action, whether now known or unknown (including existing as well as
|
||||
future claims and causes of action), in the Work (i) in all territories
|
||||
worldwide, (ii) for the maximum duration provided by applicable law or
|
||||
treaty (including future time extensions), (iii) in any current or future
|
||||
medium and for any number of copies, and (iv) for any purpose whatsoever,
|
||||
including without limitation commercial, advertising or promotional
|
||||
purposes (the "Waiver"). Affirmer makes the Waiver for the benefit of each
|
||||
member of the public at large and to the detriment of Affirmer's heirs and
|
||||
successors, fully intending that such Waiver shall not be subject to
|
||||
revocation, rescission, cancellation, termination, or any other legal or
|
||||
equitable action to disrupt the quiet enjoyment of the Work by the public
|
||||
as contemplated by Affirmer's express Statement of Purpose.
|
||||
|
||||
3. Public License Fallback. Should any part of the Waiver for any reason
|
||||
be judged legally invalid or ineffective under applicable law, then the
|
||||
Waiver shall be preserved to the maximum extent permitted taking into
|
||||
account Affirmer's express Statement of Purpose. In addition, to the
|
||||
extent the Waiver is so judged Affirmer hereby grants to each affected
|
||||
person a royalty-free, non transferable, non sublicensable, non exclusive,
|
||||
irrevocable and unconditional license to exercise Affirmer's Copyright and
|
||||
Related Rights in the Work (i) in all territories worldwide, (ii) for the
|
||||
maximum duration provided by applicable law or treaty (including future
|
||||
time extensions), (iii) in any current or future medium and for any number
|
||||
of copies, and (iv) for any purpose whatsoever, including without
|
||||
limitation commercial, advertising or promotional purposes (the
|
||||
"License"). The License shall be deemed effective as of the date CC0 was
|
||||
applied by Affirmer to the Work. Should any part of the License for any
|
||||
reason be judged legally invalid or ineffective under applicable law, such
|
||||
partial invalidity or ineffectiveness shall not invalidate the remainder
|
||||
of the License, and in such case Affirmer hereby affirms that he or she
|
||||
will not (i) exercise any of his or her remaining Copyright and Related
|
||||
Rights in the Work or (ii) assert any associated claims and causes of
|
||||
action with respect to the Work, in either case contrary to Affirmer's
|
||||
express Statement of Purpose.
|
||||
|
||||
4. Limitations and Disclaimers.
|
||||
|
||||
a. No trademark or patent rights held by Affirmer are waived, abandoned,
|
||||
surrendered, licensed or otherwise affected by this document.
|
||||
b. Affirmer offers the Work as-is and makes no representations or
|
||||
warranties of any kind concerning the Work, express, implied,
|
||||
statutory or otherwise, including without limitation warranties of
|
||||
title, merchantability, fitness for a particular purpose, non
|
||||
infringement, or the absence of latent or other defects, accuracy, or
|
||||
the present or absence of errors, whether or not discoverable, all to
|
||||
the greatest extent permissible under applicable law.
|
||||
c. Affirmer disclaims responsibility for clearing rights of other persons
|
||||
that may apply to the Work or any use thereof, including without
|
||||
limitation any person's Copyright and Related Rights in the Work.
|
||||
Further, Affirmer disclaims responsibility for obtaining any necessary
|
||||
consents, permissions or other rights required for any use of the
|
||||
Work.
|
||||
d. Affirmer understands and acknowledges that Creative Commons is not a
|
||||
party to this document and has no duty or obligation with respect to
|
||||
this CC0 or use of the Work.
|
||||
|
||||
```
|
||||
|
||||
`README.md`:
|
||||
|
||||
```md
|
||||
# Awesome Executable Packing [](https://awesome.re) <a href="https://twitter.com/intent/tweet?text=Awesome%20Executable%20Packing%20-%20A%20curated%20list%20of%20resources%20related%20to%20the%20packing%20of%20various%20executable%20formats%20and%20its%20detection.%0D%0Ahttps%3a%2f%2fgithub%2ecom%2fdhondta%2fawesome-executable-packing%0D%0A&hashtags=awesomelists,malware,malwareresearch,executablepacking,cybersecurity,infosec"><img src="https://img.shields.io/badge/Tweet--lightgrey?logo=twitter&style=social" alt="Tweet" height="20"/></a>
|
||||
|
||||
> A curated list of resources related to executable packing (including Portable Executable, Executable and Linkable Format and others) containing references to books, papers, blog posts, and other written resources but also packers and tools for detecting packers and unpacking executables.
|
||||
|
||||
*Packing* is the action of modifying an executable in a way that does not modify its purpose. It is generally one or a combination of the following operations:
|
||||
- bundling: makes a single executable with multiple files
|
||||
- compression: compresses the executable to reduce its original size
|
||||
- encoding: obfuscates the executable by encoding it
|
||||
- encryption: obfuscates the executable by encrypting it
|
||||
- mutation: alters the executable's code so that it uses a modifided instruction set and architecture (e.g. using oligomorphism)
|
||||
- protection: makes the reversing of the executable harder (i.e. using anti-debugging, anti-tampering or other tricks)
|
||||
- virtualization: embeds a virtual machine that allows to virtualize executable's instructions
|
||||
|
||||
|
||||
## Contents
|
||||
|
||||
- [:books: Literature](#books-literature)
|
||||
- [Documentation](#documentation)
|
||||
- [Scientific Research](#scientific-research)
|
||||
- [:bookmark_tabs: Datasets](#bookmark_tabs-datasets)
|
||||
- [:package: Packers](#package-packers)
|
||||
- [After 2010](#after-2010)
|
||||
- [Between 2000 and 2010](#between-2000-and-2010)
|
||||
- [Before 2000](#before-2000)
|
||||
- [:wrench: Tools](#wrench-tools)
|
||||
|
||||
|
||||
|
||||
## :books: Literature
|
||||
|
||||
|
||||
### Documentation
|
||||
|
||||
- :earth_americas: [a.out (FreeBSD manual pages)](https://www.freebsd.org/cgi/man.cgi?a.out(5))
|
||||
- :earth_americas: [A.out binary format](https://wiki.osdev.org/A.out)
|
||||
- :earth_americas: [About anti-debug tricks](https://anti-debug.checkpoint.com)
|
||||
- :bar_chart: [Android packers: Separating from the pack](https://www.fortiguard.com/events/759/2014-06-12-android-packers-separating-from-the-pack)
|
||||
- :pushpin: [Anti debugging protection techniques with examples](https://www.apriorit.com/dev-blog/367-anti-reverse-engineering-protection-techniques-to-use-before-releasing-software)
|
||||
- :bar_chart: [API deobfuscator: Resolving obfuscated API functions in modern packers](https://www.blackhat.com/docs/us-15/materials/us-15-Choi-API-Deobfuscator-Resolving-Obfuscated-API-Functions-In-Modern-Packers.pdf)
|
||||
- :bar_chart: [The art of unpacking](https://www.blackhat.com/presentations/bh-usa-07/Yason/Whitepaper/bh-usa-07-yason-WP.pdf)
|
||||
- :pushpin: [Cloak and dagger: Unpacking hidden malware attacks](https://symantec-enterprise-blogs.security.com/blogs/expert-perspectives/unpacking-hidden-malware-attacks)
|
||||
- :earth_americas: [COM binary format](https://wiki.osdev.org/COM)
|
||||
- :earth_americas: [Common object file format (COFF)](https://wiki.osdev.org/COFF)
|
||||
- :earth_americas: [Comparison of executable file formats](https://en.wikipedia.org/wiki/Comparison_of_executable_file_formats)
|
||||
- :earth_americas: [Defacto2](https://defacto2.net/defacto2)
|
||||
- :bar_chart: [Dynamic binary analysis and obfuscated codes](https://triton.quarkslab.com/files/sthack2016-rthomas-jsalwan.pdf)
|
||||
- :earth_americas: [elf (FreeBSD manual pages)](https://www.freebsd.org/cgi/man.cgi?elf(5))
|
||||
- :earth_americas: [Executable and linkable format (ELF)](https://wiki.osdev.org/ELF)
|
||||
- :clipboard: [Executable and linking format (ELF) specification](https://refspecs.linuxfoundation.org/elf/elf.pdf)
|
||||
- :earth_americas: [Executable file formats](https://docs.fileformat.com/executable)
|
||||
- :earth_americas: [FatELF: Universal binaries for Linux (HALTED)](https://icculus.org/fatelf)
|
||||
- :clipboard: [Hyperion: Implementation of a PE-Crypter](https://www.exploit-db.com/docs/english/18849-hyperion-implementation-of-a-pe-crypter.pdf)
|
||||
- :scroll: [Implementing your own generic unpacker](https://gsec.hitb.org/materials/sg2015/whitepapers/Julien%20Lenoir%20-%20Implementing%20Your%20Own%20Generic%20Unpacker.pdf)
|
||||
- :pushpin: [Mach-O - A look at apple executable files](https://redmaple.tech/blogs/macho-files)
|
||||
- :earth_americas: [Mach-O file format reference](https://github.com/aidansteele/osx-abi-macho-file-format-reference)
|
||||
- :bar_chart: [Mach-O internals](https://yossarian.net/res/pub/macho-internals/macho-internals.pdf)
|
||||
- :clipboard: [Microsoft portable executable and common object file format specification](http://www.skyfree.org/linux/references/coff.pdf)
|
||||
- :earth_americas: [MITRE ATT&CK | T1027.002 | obfuscated files or information: Software packing](https://attack.mitre.org/techniques/T1027/002)
|
||||
- :earth_americas: [MZ disk operating system (DOS)](https://wiki.osdev.org/MZ)
|
||||
- :bar_chart: [One packer to rule them all: Empirical identification, comparison and circumvention of current antivirus detection techniques](https://www.blackhat.com/docs/us-14/materials/us-14-Mesbahi-One-Packer-To-Rule-Them-All-WP.pdf)
|
||||
- :scroll: [One packer to rule them all: Empirical identification, comparison and circumvention of current antivirus detection techniques](https://www.blackhat.com/docs/us-14/materials/us-14-Mesbahi-One-Packer-To-Rule-Them-All.pdf)
|
||||
- :pushpin: [Packer detection tool evaluation](https://github.com/FFRI/PackerDetectionToolEvaluation)
|
||||
- :page_facing_up: [Packers](https://storage.googleapis.com/google-code-archive-downloads/v2/code.google.com/corkami/packers.pdf) :star2: :star2: :star2:
|
||||
- :pushpin: [Parsing mach-O files](https://lowlevelbits.org/parsing-mach-o-files)
|
||||
- :earth_americas: [PE format (Microsoft docs)](https://docs.microsoft.com/en-us/windows/win32/debug/pe-format)
|
||||
- :scroll: [PinDemonium: A DBI-based generic unpacker for Windows executables](https://www.blackhat.com/docs/us-16/materials/us-16-Mariani-Pindemonium-A-Dbi-Based-Generic-Unpacker-For-Windows-Executables-wp.pdf)
|
||||
- :earth_americas: [Portable executable (PE)](https://wiki.osdev.org/PE)
|
||||
- :bar_chart: [Reverse engineering malware: Binary obfuscation and protection](http://www.cse.tkk.fi/fi/opinnot/T-110.6220/2014_Reverse_Engineering_Malware_AND_Mobile_Platform_Security_AND_Software_Security/luennot-files/Binary%20Obfuscation%20and%20Protection.pdf)
|
||||
- :bar_chart: [Runtime packers: The hidden problem?](https://www.blackhat.com/presentations/bh-usa-06/BH-US-06-Morgenstern.pdf)
|
||||
- :bar_chart: [TitanMist: Your first step to reversing nirvana](https://www.reversinglabs.com/blackhat/TitanMist_BlackHat-USA-10-Slides.pdf)
|
||||
- :pushpin: [Tuts 4 you - UnPackMe (.NET)](https://forum.tuts4you.com/forum/155-unpackme-net)
|
||||
- :pushpin: [Tuts 4 you | unpackme](https://forum.tuts4you.com/forum/147-unpackme)
|
||||
- :closed_book: [The "Ultimate" anti-debugging reference](http://pferrie.epizy.com/papers/antidebug.pdf)
|
||||
- :bar_chart: [Virtual machine obfuscation](https://compil2019.minesparis.psl.eu/wp-content/uploads/2019/02/BeatriceCreusillet-Obfuscation-quarkslab.pdf)
|
||||
- :bar_chart: [We can still crack you! General unpacking method for Android Packer (NO ROOT)](https://www.blackhat.com/asia-15/briefings.html#we-can-still-crack-you-general-unpacking-method-for-android-packer-no-root)
|
||||
- :bar_chart: [When malware is packing heat](https://www.eurecom.fr/publication/5372)
|
||||
- :clipboard: [Win32 portable executable packing uncovered](https://securitylabs.websense.com/content/Assets/HistoryofPackingTechnology.pdf)
|
||||
- :pushpin: [Writing a packer](https://dr4k0nia.github.io/dotnet/coding/2021/06/24/Writing-a-Packer.html)
|
||||
- :pushpin: [Writing a simple PE packer in detail](https://github.com/levanvn/Packer_Simple-1)
|
||||
|
||||
<p align="center"><a href="#"><img src="https://img.shields.io/badge/Back%20to%20top--lightgrey?style=social" alt="Back to top" height="20"/></a></p>
|
||||
|
||||
### Scientific Research
|
||||
|
||||
- :newspaper: [Absent extreme learning machine algorithm with application to packed executable identification](https://link.springer.com/article/10.1007%2Fs00521-014-1558-4) (January 2016)
|
||||
- :newspaper: [An accurate packer identification method using support vector machine](https://www.jstage.jst.go.jp/article/transfun/E97.A/1/E97.A_253/_article) (January 2014)
|
||||
- :notebook: [Adaptive unpacking of Android Apps](https://ieeexplore.ieee.org/document/7985676) (May 2017)
|
||||
- :newspaper: [Advanced preprocessing of binary executable files and its usage in retargetable decompilation](https://www.fit.vut.cz/research/publication/10531) (December 2014)
|
||||
- :newspaper: [All-in-one framework for detection, unpacking, and verification for malware analysis](https://www.hindawi.com/journals/scn/2019/5278137/) (January 2019) :star:
|
||||
- :newspaper: [Analysis of machine learning approaches to packing detection](https://arxiv.org/abs/2105.00473) (May 2021) :star: :star:
|
||||
- :notebook: [Anti-unpacker tricks](http://2008.caro.org/downloads/unpackers.pdf) (May 2008)
|
||||
- :notebook: [Application of string kernel based support vector machine for malware packer identification](https://ieeexplore.ieee.org/document/6707043) (August 2013)
|
||||
- :notebook: [AppSpear: Bytecode decrypting and DEX reassembling for packed Android malware](https://link.springer.com/chapter/10.1007/978-3-319-26362-5_17) (November 2015)
|
||||
- :newspaper: [Automatic analysis of malware behavior using machine learning](https://dl.acm.org/doi/10.5555/2011216.2011217) (December 2011)
|
||||
- :notebook: [Automatic static unpacking of malware binaries](https://ieeexplore.ieee.org/document/5328814) (October 2009)
|
||||
- :newspaper: [BareUnpack: Generic unpacking on the bare-metal operating system](https://www.jstage.jst.go.jp/article/transinf/E101.D/12/E101.D_2017EDP7424/_article) (December 2018) :star:
|
||||
- :newspaper: [Binary-code obfuscations in prevalent packer tools](https://doi.org/10.1145/2522968.2522972) (October 2013) :star:
|
||||
- :newspaper: [BinStat tool for recognition of packed executables](http://www.ijofcs.org/abstract-v06n1-pp03.html) (September 2010)
|
||||
- :notebook: [BitBlaze: A new approach to computer security via binary analysis](https://link.springer.com/chapter/10.1007/978-3-540-89862-7_1) (December 2008)
|
||||
- :notebook: [Boosting scalability in anomaly-based packed executable filtering](https://link.springer.com/chapter/10.1007%2F978-3-642-34704-7_3) (November 2011)
|
||||
- :mortar_board: [Building a smart and automated tool for packed malware detections using machine learning](https://dial.uclouvain.be/memoire/ucl/en/object/thesis%3A25193) (June 2020) :star: :star:
|
||||
- :newspaper: Bypassing anti-analysis of commercial protector methods using DBI tools (January 2021) :star: :star:
|
||||
- :notebook: [ByteWise: A case study in neural network obfuscation identification](https://ieeexplore.ieee.org/document/8301720/) (January 2018) :star:
|
||||
- :notebook: [Challenging anti-virus through evolutionary malware obfuscation](https://link.springer.com/chapter/10.1007%2F978-3-319-31153-1_11) (April 2016)
|
||||
- :newspaper: [Classification of packed executables for accurate computer virus detection](http://www.sciencedirect.com/science/article/pii/S0167865508002110) (October 2008)
|
||||
- :notebook: [Classifying packed programs as malicious software detected](https://www.semanticscholar.org/paper/Classifying-Packed-Programs-as-Malicious-Software-Osaghae/676f38819a0ed3028acce36f4f11b0c77e4cc0ae) (December 2016) :star:
|
||||
- :newspaper: [A close look at a daily dataset of malware samples](https://doi.org/10.1145/3291061) (January 2019) :star:
|
||||
- :notebook: [Collective classification for packed executable identification](https://doi.org/10.1145/2030376.2030379) (June 2012)
|
||||
- :notebook: [A comparative analysis of classifiers in the recognition of packed executables](https://ieeexplore.ieee.org/abstract/document/8995252) (November 2019) :star:
|
||||
- :notebook: [A comparative assessment of malware classification using binary texture analysis and dynamic analysis](https://dl.acm.org/doi/10.1145/2046684.2046689) (September 2011)
|
||||
- :notebook: [Comparing malware samples for unpacking: A feasibility study](https://ieeexplore.ieee.org/document/7782073) (August 2016)
|
||||
- :mortar_board: [Computational-intelligence techniques for malware generation](https://raw.githubusercontent.com/jimmy-sonny/ConferencesAndTalks/master/Ms.C%20Thesis/Thesis_Marcelli.pdf) (October 2015)
|
||||
- :newspaper: [A consistently-executing graph-based approach for malware packer identification](https://ieeexplore.ieee.org/document/8695825) (April 2019) :star:
|
||||
- :notebook: [A control flow graph-based signature for packer identification](https://ieeexplore.ieee.org/document/8170793) (October 2017) :star:
|
||||
- :notebook: [Countering entropy measure attacks on packed software detection](https://ieeexplore.ieee.org/document/6181079) (January 2012)
|
||||
- :bar_chart: [Dealing with virtualization packers](http://2008.caro.org/downloads/boris_lau_virtualization_obfs.pdf) (May 2008)
|
||||
- :notebook: [Denial-of-service attacks on host-based generic unpackers](https://link.springer.com/chapter/10.1007/978-3-642-11145-7_19) (December 2009)
|
||||
- :mortar_board: [Deobfuscation of packed and virtualization-obfuscation protected binaries](https://repository.arizona.edu/handle/10150/202716) (June 2011)
|
||||
- :notebook: [Design and development of a new scanning core engine for malware detection](https://ieeexplore.ieee.org/document/6388212) (October 2012)
|
||||
- :notebook: [Design and performance evaluation of binary code packing for protecting embedded software against reverse engineering](https://ieeexplore.ieee.org/document/5479571) (May 2010)
|
||||
- :notebook: [Detecting packed executable file: Supervised or anomaly detection method?](https://ieeexplore.ieee.org/abstract/document/7784628) (August 2016) :star:
|
||||
- :newspaper: [Detecting packed executables based on raw binary data](https://www.semanticscholar.org/paper/DETECTING-PACKED-EXECUTABLES-BASED-ON-RAW-BINARY-Nataraja-Jacobb/53371424fb79de29a096e563b07fcae432f4d201) (June 2010)
|
||||
- :notebook: [Detecting packed executables using steganalysis](https://ieeexplore.ieee.org/document/7018361) (December 2014)
|
||||
- :mortar_board: [Detecting packed PE files: Executable file analysis for the Windows operating system](https://uia.brage.unit.no/uia-xmlui/handle/11250/2823655) (June 2021) :star: :star:
|
||||
- :notebook: [Detection of metamorphic malware packers using multilayered LSTM networks](https://www.springerprofessional.de/en/detection-of-metamorphic-malware-packers-using-multilayered-lstm/18635334) (November 2020) :star: :star:
|
||||
- :notebook: [Detection of packed executables using support vector machines](https://ieeexplore.ieee.org/document/6016774) (July 2011)
|
||||
- :notebook: [Detection of packed malware](https://doi.org/10.1145/2490428.2490431) (August 2012)
|
||||
- :notebook: [DexHunter: Toward extracting hidden code from packed Android applications](https://link.springer.com/chapter/10.1007/978-3-319-24177-7_15) (September 2015)
|
||||
- :notebook: [Disabling anti-debugging techniques for unpacking system in user-level debugger](https://ieeexplore.ieee.org/document/8939719) (October 2019) :star:
|
||||
- :notebook: [Dynamic binary instrumentation for deobfuscation and unpacking](https://hal.inria.fr/inria-00431666) (November 2009)
|
||||
- :notebook: [Dynamic classification of packing algorithms for inspecting executables using entropy analysis](https://ieeexplore.ieee.org/document/6703681) (October 2013)
|
||||
- :newspaper: [Effective, efficient, and robust packing detection and classification](http://www.sciencedirect.com/science/article/pii/S0167404818311040) (May 2019) :star: :star:
|
||||
- :notebook: [Efficient and automatic instrumentation for packed binaries](https://link.springer.com/chapter/10.1007/978-3-642-02617-1_32) (June 2009)
|
||||
- :newspaper: [Efficient automatic original entry point detection](https://jise.iis.sinica.edu.tw/JISESearch/pages/View/PaperView.jsf?keyId=169_2256) (January 2019) :star:
|
||||
- :newspaper: [An efficient block-discriminant identification of packed malware](https://link.springer.com/article/10.1007%2Fs12046-015-0399-x) (August 2015)
|
||||
- :notebook: [Efficient malware packer identification using support vector machines with spectrum kernel](https://ieeexplore.ieee.org/document/6621654) (July 2013)
|
||||
- :newspaper: [Efficient SVM based packer identification with binary diffing measures](https://ieeexplore.ieee.org/document/8754440/) (July 2019) :star:
|
||||
- :newspaper: [ELF-Miner: Using structural knowledge and data mining methods to detect new (Linux) malicious executables](https://dl.acm.org/doi/10.5555/2150963.2150968) (March 2012)
|
||||
- :newspaper: [EMBER: An open dataset for training static PE malware machine learning models](https://arxiv.org/abs/1804.04637) (April 2018) :star:
|
||||
- :notebook: [An empirical evaluation of an unpacking method implemented with dynamic binary instrumentation](https://www.jstage.jst.go.jp/article/transinf/E94.D/9/E94.D_9_1778/_article) (September 2011)
|
||||
- :notebook: [Encoded executable file detection technique via executable file header analysis](https://www.earticle.net/Article/A105986) (April 2009)
|
||||
- :notebook: [Entropy analysis to classify unknown packing algorithms for malware detection](https://link.springer.com/article/10.1007/s10207-016-0330-4) (May 2016) :star:
|
||||
- :notebook: [ESCAPE: Entropy score analysis of packed executable](https://dl.acm.org/doi/10.1145/2388576.2388607) (October 2012)
|
||||
- :notebook: [Ether: Malware analysis via hardware virtualization extensions](https://doi.org/10.1145/1455770.1455779) (October 2008)
|
||||
- :notebook: [Eureka: A framework for enabling static malware analysis](https://link.springer.com/chapter/10.1007%2F978-3-540-88313-5_31) (October 2008)
|
||||
- :notebook: [Experimental comparison of machine learning models in malware packing detection](https://ieeexplore.ieee.org/document/9237007) (September 2020) :star: :star:
|
||||
- :notebook: [An experimental study on identifying obfuscation techniques in packer](https://docplayer.net/63501103-An-experimental-study-on-identifying-obfuscation-techniques-in-packer.html) (June 2016)
|
||||
- :mortar_board: [Experimental toolkit for studying executable packing - Analysis of the state-of-the-art packing detection techniques](https://dial.uclouvain.be/memoire/ucl/en/object/thesis%3A35692) (June 2022) :star2: :star2: :star2:
|
||||
- :notebook: [A fast flowgraph based classification system for packed and polymorphic malware on the endhost](https://ieeexplore.ieee.org/document/5474800/) (April 2010)
|
||||
- :notebook: [Feature set reduction for the detection of packed executables](https://ieeexplore.ieee.org/document/6912767) (June 2014)
|
||||
- :newspaper: [File packing from the malware perspective: Techniques, analysis approaches, and directions for enhancements](https://doi.org/10.1145/3530810) (April 2022)
|
||||
- :notebook: [A fine-grained classification approach for the packed malicious code](https://link.springer.com/chapter/10.1007/978-3-642-34129-8_49) (October 2012)
|
||||
- :notebook: [A generic approach to automatic deobfuscation of executable code](https://ieeexplore.ieee.org/document/7163054) (May 2015) :star:
|
||||
- :newspaper: [Generic packing detection using several complexity analysis for accurate malware detection](https://www.researchgate.net/publication/332594129_Generic_Packing_Detection_using_Several_Complexity_Analysis_for_Accurate_Malware_Detection?channel=doi&linkId=5cbf828b299bf120977ac78a&showFulltext=true) (January 2014)
|
||||
- :notebook: [Generic unpacker of executable files](https://www.semanticscholar.org/paper/Generic-Unpacker-of-Executable-Files-Milkovi/413321c5a473d59c18e861c1478cd44f88142275) (April 2015)
|
||||
- :notebook: [Generic unpacking method based on detecting original entry point](https://link.springer.com/chapter/10.1007/978-3-642-42054-2_74) (November 2013)
|
||||
- :newspaper: [Generic unpacking of self-modifying, aggressive, packed binary programs](https://arxiv.org/abs/0905.4581) (May 2009)
|
||||
- :notebook: [Generic unpacking techniques](https://ieeexplore.ieee.org/document/4909168) (February 2009)
|
||||
- :notebook: [Generic unpacking using entropy analysis](https://ieeexplore.ieee.org/document/5665789) (October 2010)
|
||||
- :notebook: [Gunpack: Un outil générique d'unpacking de malwares](https://www.sstic.org/2016/presentation/gunpack/) (June 2016)
|
||||
- :notebook: [A heuristic approach for detection of obfuscated malware](https://ieeexplore.ieee.org/document/5137328) (June 2009)
|
||||
- :newspaper: [A heuristics-based static analysis approach for detecting packed PE binaries](http://dx.doi.org/10.14257/ijsia.2013.7.5.24) (October 2013)
|
||||
- :notebook: [An implementation of a generic unpacking method on Bochs Emulator](https://www.semanticscholar.org/paper/An-Implementation-of-a-Generic-Unpacking-Method-on-HyungChanKim-Daisuke/d5c947520815105231673f1b87af57ed6abd379c) (September 2009)
|
||||
- :notebook: [Information theoretic method for classification of packed and encoded files](https://dl.acm.org/doi/10.1145/2799979.2800015) (September 2015)
|
||||
- :notebook: [Instructions-based detection of sophisticated obfuscation and packing](https://ieeexplore.ieee.org/document/6956729) (October 2014)
|
||||
- :newspaper: [A learning model to detect maliciousness of portable executable using integrated feature set](https://www.sciencedirect.com/science/article/pii/S1319157817300149) (January 2017)
|
||||
- :mortar_board: [Maitland: Analysis of packed and encrypted malware via paravirtualization extensions](https://dspace.library.uvic.ca/handle/1828/3866) (June 2012)
|
||||
- :notebook: [Mal-EVE: Static detection model for evasive malware](https://ieeexplore.ieee.org/document/7497952) (August 2015)
|
||||
- :newspaper: [Mal-flux: Rendering hidden code of packed binary executable](http://www.sciencedirect.com/science/article/pii/S1742287618303736) (March 2019) :star:
|
||||
- :newspaper: [Mal-XT: Higher accuracy hidden-code extraction of packed binary executable](https://iopscience.iop.org/article/10.1088/1757-899X/453/1/012001) (November 2018) :star:
|
||||
- :newspaper: [Mal-xtract: Hidden code extraction using memory analysis](https://doi.org/10.1088%2F1742-6596%2F801%2F1%2F012058) (January 2017)
|
||||
- :newspaper: [Malware analysis using multiple API sequence mining control flow graph](https://arxiv.org/abs/1707.02691) (July 2017)
|
||||
- :newspaper: [Malware analysis using visualized images and entropy graphs](https://link.springer.com/article/10.1007%2Fs10207-014-0242-0) (February 2015)
|
||||
- :notebook: [Malware obfuscation techniques: A brief survey](https://ieeexplore.ieee.org/document/5633410) (November 2010)
|
||||
- :notebook: [Malware obfuscation through evolutionary packers](https://doi.org/10.1145/2739482.2764940) (July 2015)
|
||||
- :newspaper: [Malwise - An effective and efficient classification system for packed and polymorphic malware](https://ieeexplore.ieee.org/document/6171162) (June 2013)
|
||||
- :notebook: [McBoost: Boosting scalability in malware collection and analysis using statistical classification of executables](https://ieeexplore.ieee.org/document/4721567) (December 2008)
|
||||
- :notebook: [Memory behavior-based automatic malware unpacking in stealth debugging environment](https://ieeexplore.ieee.org/document/5665794) (October 2010)
|
||||
- :notebook: [Modern linux malware exposed](https://www.eurecom.fr/fr/publication/5584) (June 2018)
|
||||
- :notebook: [MutantX-S: Scalable malware clustering based on static features](https://www.usenix.org/conference/atc13/technical-sessions/presentation/hu) (June 2013)
|
||||
- :notebook: [The new signature generation method based on an unpacking algorithm and procedure for a packer detection](https://www.earticle.net/Article/A147420) (February 2011)
|
||||
- :notebook: [Obfuscation-resilient executable payload extraction from packed malware](https://www.usenix.org/conference/usenixsecurity21/presentation/cheng-binlin) (August 2021) :star: :star:
|
||||
- :newspaper: [Obfuscation: The hidden malware](https://ieeexplore.ieee.org/document/5975134) (August 2011)
|
||||
- :notebook: [Obfuscation: Where are we in anti-DSE protections? (a first attempt)](https://doi.org/10.1145/3371307.3371309) (December 2019) :star:
|
||||
- :notebook: [OmniUnpack: Fast, generic, and safe unpacking of malware](https://ieeexplore.ieee.org/document/4413009) (December 2007)
|
||||
- :newspaper: [On the adoption of anomaly detection for packed executable filtering](https://www.sciencedirect.com/science/article/pii/S0167404814000522?via%3Dihub) (June 2014)
|
||||
- :notebook: [OPEM: A static-dynamic approach for machine-learning-based malware detection](https://link.springer.com/chapter/10.1007/978-3-642-33018-6_28) (September 2012)
|
||||
- :newspaper: [An original entry point detection method with candidate-sorting for more effective generic unpacking](https://www.jstage.jst.go.jp/article/transinf/E98.D/4/E98.D_2014EDP7268/_article) (January 2015)
|
||||
- :newspaper: [Packed malware detection using entropy related analysis: A survey](https://api.semanticscholar.org/CorpusID:212493886) (November 2015)
|
||||
- :newspaper: [Packed malware variants detection using deep belief networks](https://doi.org/10.1051/matecconf/202030902002) (March 2020)
|
||||
- :notebook: [Packed PE file detection for malware forensics](https://ieeexplore.ieee.org/document/5404211) (December 2009)
|
||||
- :newspaper: [Packer analysis report debugging and unpacking the NsPack 3.4 and 3.7 packer](https://www.sans.org/reading-room/whitepapers/malicious/packer-analysis-report-debugging-unpacking-nspack-34-37-packer-33428) (June 2010)
|
||||
- :notebook: [Packer classifier based on PE header information](https://dl.acm.org/doi/10.1145/2746194.2746213) (April 2015)
|
||||
- :newspaper: [Packer detection for multi-layer executables using entropy analysis](https://www.mdpi.com/1099-4300/19/3/125) (March 2017) :star:
|
||||
- :notebook: [Packer identification based on metadata signature](https://dl.acm.org/doi/10.1145/3151137.3160687) (December 2017) :star:
|
||||
- :notebook: [Packer identification method based on byte sequences](https://onlinelibrary.wiley.com/doi/abs/10.1002/cpe.5082) (November 2018) :star:
|
||||
- :newspaper: [Packer identification using byte plot and Markov plot](https://link.springer.com/article/10.1007/s11416-015-0249-8) (September 2015) :star:
|
||||
- :notebook: [Packer identification using hidden Markov model](https://link.springer.com/chapter/10.1007/978-3-319-69456-6_8) (November 2017) :star:
|
||||
- :mortar_board: [Packer-complexity analysis in PANDA](https://webthesis.biblio.polito.it/7519/) (January 2018) :star:
|
||||
- :mortar_board: [Pandora's Bochs: Automatic unpacking of malware](https://www.researchgate.net/publication/268355151_Pandora%27s_Bochs_Automatic_Unpacking_of_Malware) (January 2008)
|
||||
- :notebook: [Pattern recognition techniques for the classification of malware packers](https://link.springer.com/chapter/10.1007/978-3-642-14081-5_23) (July 2010)
|
||||
- :newspaper: [PE file features in detection of packed executables](http://www.ijcte.org/show-42-485-1.html) (January 2012)
|
||||
- :notebook: [PE file header analysis-based packed PE file detection technique (PHAD)](https://ieeexplore.ieee.org/document/4654055) (October 2008)
|
||||
- :notebook: PE-Miner: Mining structural information to detect malicious executables in realtime (2009)
|
||||
- :notebook: [PE-Probe: Leveraging packer detection and structural information to detect malicious portable executables](https://www.semanticscholar.org/paper/PE-Probe%3A-Leveraging-Packer-Detection-and-to-Detect-Shafiq-Tabish/9811ec751f2b5bb41ee46c0ee2a3b6eccc39bb9a) (June 2009)
|
||||
- :notebook: [PEAL - Packed executable analysis](https://link.springer.com/chapter/10.1007/978-3-642-29280-4_28) (January 2012)
|
||||
- :notebook: [PolyUnpack: Automating the hidden-code extraction of unpack-executing malware](https://ieeexplore.ieee.org/document/4041175) (December 2006)
|
||||
- :notebook: [Preprocessing of binary executable files towards retargetable decompilation](https://www.fit.vut.cz/research/publication/10200) (July 2013)
|
||||
- :notebook: [Prevalence and impact of low-entropy packing schemes in the malware ecosystem](https://www.ndss-symposium.org/wp-content/uploads/2020/02/24297.pdf) (February 2020) :star: :star:
|
||||
- :bar_chart: [Qualitative and quantitative evaluation of software packers](http://webdiis.unizar.es/~ricardo/files/slides/industrial/slides_NcN-15.pdf) (December 2015)
|
||||
- :notebook: [RAMBO: Run-Time packer analysis with multiple branch observation](https://link.springer.com/chapter/10.1007/978-3-319-40667-1_10) (July 2016)
|
||||
- :mortar_board: [REFORM: A framework for malware packer analysis using information theory and statistical methods](https://researchrepository.rmit.edu.au/view/delivery/61RMIT_INST/12246783310001341/13248377300001341) (April 2010)
|
||||
- :notebook: [Renovo: A hidden code extractor for packed executables](https://dl.acm.org/doi/10.1145/1314389.1314399) (November 2007)
|
||||
- :notebook: [RePEconstruct: Reconstructing binaries with self-modifying code and import address table destruction](https://ieeexplore.ieee.org/document/7888727) (October 2016) :star:
|
||||
- :notebook: RePEF — A system for restoring packed executable file for malware analysis (July 2011)
|
||||
- :notebook: [Research and implementation of compression shell unpacking technology for PE file](https://ieeexplore.ieee.org/document/5231651) (May 2009)
|
||||
- :newspaper: [Revealing packed malware](https://ieeexplore.ieee.org/document/4639028) (September 2008)
|
||||
- :notebook: [Reverse engineering self-modifying code: Unpacker extraction](https://ieeexplore.ieee.org/document/5645447) (October 2010)
|
||||
- :mortar_board: [Robust static analysis of portable executable malware](https://repo.zenk-security.com/Virus-Infections-Detections-Preventions/Robust%20Static%20Analysis%20ofPortable%20ExecutableMalware.pdf) (December 2014)
|
||||
- :bar_chart: [Runtime packers testing experiences](https://docs.google.com/a/caro.org/viewer?a=v&pid=sites&srcid=Y2Fyby5vcmd8Y2Fyby13b3Jrc2hvcC0yMDA4fGd4OjZkNzk3MmI2YjZlMWMxZGI) (May 2008)
|
||||
- :notebook: [SATURN - Software deobfuscation framework based on LLVM](https://doi.org/10.1145/3338503.3357721) (November 2019) :star: :star:
|
||||
- :newspaper: [SCORE: Source code optimization & reconstruction](https://ieeexplore.ieee.org/document/9139493) (July 2020) :star: :star:
|
||||
- :notebook: [SE-PAC: A self-evolving packer classifier against rapid packers evolution](https://doi.org/10.1145/3422337.3447848) (April 2021) :star: :star:
|
||||
- :newspaper: [Secure and advanced unpacking using computer emulation](https://link.springer.com/article/10.1007%2Fs11416-007-0046-0) (August 2007)
|
||||
- :notebook: [Semi-supervised learning for packed executable detection](https://ieeexplore.ieee.org/document/6060027) (September 2011)
|
||||
- :notebook: [Semi-supervised learning for unknown malware detection](https://link.springer.com/chapter/10.1007/978-3-642-19934-9_53) (April 2011)
|
||||
- :newspaper: [Sensitive system calls based packed malware variants detection using principal component initialized multilayers neural networks](https://cybersecurity.springeropen.com/articles/10.1186/s42400-018-0010-y) (September 2018) :star:
|
||||
- :notebook: [SoK: Deep packer inspection: A longitudinal study of the complexity of run-time packers](https://ieeexplore.ieee.org/document/7163053) (May 2015) :star: :star: :star:
|
||||
- :notebook: [SPADE: Signature based packer detection](https://dl.acm.org/doi/10.1145/2490428.2490442) (August 2012)
|
||||
- :notebook: [Static analysis of executables to detect malicious patterns](https://dl.acm.org/doi/10.5555/1251353.1251365) (August 2003)
|
||||
- :notebook: [A static, packer-agnostic filter to detect similar malware samples](https://link.springer.com/chapter/10.1007/978-3-642-37300-8_6) (July 2012)
|
||||
- :notebook: [Structural feature based anomaly detection for packed executable identification](https://link.springer.com/chapter/10.1007%2F978-3-642-21323-6_29) (June 2011)
|
||||
- :notebook: [The study of evasion of packed PE from static detection](https://ieeexplore.ieee.org/document/6280206) (June 2012)
|
||||
- :notebook: [A study of the packer problem and its solutions](https://link.springer.com/chapter/10.1007/978-3-540-87403-4_6) (September 2008)
|
||||
- :newspaper: A survey on malware analysis techniques: Static, dynamic, hybrid and memory analysis (September 2018) :star:
|
||||
- :notebook: [Survey on malware evasion techniques: State of the art and challenges](https://ieeexplore.ieee.org/abstract/document/6174775) (February 2012)
|
||||
- :notebook: [Syntia: Synthesizing the semantics of obfuscated code](https://www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/blazytko) (August 2017) :star:
|
||||
- :notebook: [Things you may not know about Android (Un) packers: A systematic study based on whole-system emulation.](https://www.ndss-symposium.org/wp-content/uploads/2018/02/ndss2018_04A-4_Duan_paper.pdf) (February 2018) :star:
|
||||
- :notebook: [Thwarting real-time dynamic unpacking](https://dl.acm.org/doi/10.1145/1972551.1972556) (January 2011)
|
||||
- :notebook: [Toward generic unpacking techniques for malware analysis with quantification of code revelation](https://www.researchgate.net/publication/255608911_Toward_Generic_Unpacking_Techniques_for_Malware_Analysis_with_Quantification_of_Code_Revelation) (August 2009)
|
||||
- :notebook: [Towards paving the way for large-scale Windows malware analysis: Generic binary unpacking with orders-of-magnitude performance boost](https://dl.acm.org/doi/10.1145/3243734.3243771) (October 2018) :star: :star:
|
||||
- :newspaper: [Two techniques for detecting packed portable executable files](https://ieeexplore.ieee.org/document/6636333) (June 2013)
|
||||
- :notebook: [Unconditional self-modifying code elimination with dynamic compiler optimizations](https://ieeexplore.ieee.org/document/5665795) (October 2010)
|
||||
- :notebook: [Understanding linux malware](https://ieeexplore.ieee.org/document/8418602) (May 2018) :star:
|
||||
- :mortar_board: [Unpacking framework for packed malicious executables](https://repositorio-aberto.up.pt/bitstream/10216/68815/2/25935.pdf) (July 2013)
|
||||
- :newspaper: [Unpacking techniques and tools in malware analysis](https://www.scientific.net/AMM.198-199.343) (September 2012)
|
||||
- :notebook: [Unpacking virtualization obfuscators](https://dl.acm.org/doi/10.5555/1855876.1855877) (August 2009)
|
||||
- :newspaper: [UnThemida: Commercial obfuscation technique analysis with a fully obfuscated program](https://onlinelibrary.wiley.com/doi/abs/10.1002/spe.2622) (July 2018) :star: :star:
|
||||
- :newspaper: [Using entropy analysis to find encrypted and packed malware](https://ieeexplore.ieee.org/document/4140989) (March 2007)
|
||||
- :notebook: [VMAttack: Deobfuscating virtualization-based packed binaries](https://dl.acm.org/doi/10.1145/3098954.3098995) (August 2017) :star:
|
||||
- :bar_chart: [WaveAtlas: Surfing through the landscape of current malware packers](https://www.virusbulletin.com/virusbulletin/2016/12/vb2015-paper-waveatlas-surfing-through-landscape-current-malware-packers/) (September 2015)
|
||||
- :notebook: [When malware is packin' heat; limits of machine learning classifiers based on static analysis features](https://www.ndss-symposium.org/wp-content/uploads/2020/02/24310.pdf) (January 2020) :star:
|
||||
- :newspaper: [WYSINWYX: What you see is not what you execute](https://doi.org/10.1145/1749608.1749612) (August 2010)
|
||||
- :newspaper: [x64Unpack: Hybrid emulation unpacker for 64-bit Windows Environments and detailed analysis results on VMProtect 3.4](https://ieeexplore.ieee.org/document/9139515) (July 2020) :star: :star: :star:
|
||||
|
||||
<p align="center"><a href="#"><img src="https://img.shields.io/badge/Back%20to%20top--lightgrey?style=social" alt="Back to top" height="20"/></a></p>
|
||||
|
||||
|
||||
|
||||
## :bookmark_tabs: Datasets
|
||||
|
||||
- [CyberCrime](https://cybercrime-tracker.net/vx.php) - C² tracking and malware database.
|
||||
- [Dataset of Packed ELF](https://github.com/dhondta/dataset-packed-elf) - Dataset of packed ELF samples.
|
||||
- [Dataset of Packed PE](https://github.com/dhondta/dataset-packed-pe) - Sanitized version of the original dataset, PackingData, removing packed samples from the Notpacked folder but also samples in packer folders that failed to be packed (having a same hash as the original unpacked executable).
|
||||
- [Ember](https://github.com/elastic/ember) - Collection of features from PE files that serve as a benchmark dataset for researchers.
|
||||
- [FFRI Dataset Scripts](https://github.com/FFRI/ffridataset-scripts) - Make datasets like FFRI Dataset.
|
||||
- [MaleX](https://github.com/Mayachitra-Inc/MaleX) - Curated dataset of malware and benign Windows executable samples for malware researchers containing 1,044,394 Windows executable binaries and corresponding image representations with 864,669 labelled as malware and 179,725 as benign.
|
||||
- [Malfease](https://web.archive.org/web/20141221153307/http://malfease.oarci.net) - Dataset of about 5,000 packed malware samples.
|
||||
- [Malheur](https://www.sec.cs.tu-bs.de/data/malheur) - Contains the recorded behavior of malicious software (malware) and has been used for developing methods for classifying and clustering malware behavior (see the JCS article from 2011).
|
||||
- [Malicia](http://malicia-project.com/dataset.html) - Dataset of 11,688 malicous PE files collected from 500 drive-by download servers over a period of 11 months in 2013 (DISCONTINUED).
|
||||
- [MalShare](https://malshare.com) - Free Malware repository providing researchers access to samples, malicious feeds, and Yara results.
|
||||
- [MalwareBazaar](https://bazaar.abuse.ch/browse) - Project operated by abuse.ch aimed to collect and share malware samples, helping IT-security researchers and threat analysts protecting their constituency and customers from cyber threats.
|
||||
- [MalwareGallery](https://github.com/BaRRaKudaRain/MalwareGallery) - Yet another malware collection in the Internet.
|
||||
- [OARC Malware Dataset](https://www.dns-oarc.net) - Semi-public dataset of 3,467 samples captured in the wild from Sep 2005 to Jan 2006 by mail traps, user submissions, honeypots and other sources aggregated by the OARC, available to qualified academic and industry researchers upon request.
|
||||
- [Open Malware](https://web.archive.org/web/20190116100735/http://www.offensivecomputing.net/) - Online collection of malware samples.
|
||||
- [PackingData](https://github.com/chesvectain/PackingData) - Original dataset with sample PE files packed with a large variety of packers, including ASPack, BeRoEXEPacker, exe32pack, eXpressor, FSG, JDPack, MEW, Molebox, MPRESS, Neolite, NSPack, Pckman, PECompact, PEtite, RLPack, UPX, WinUpack, Yoda's Crypter and Yoda's Protector.
|
||||
- [Packware](https://github.com/ucsb-seclab/packware) - Datasets and codes that are needed to reproduce the experiments in the paper "When Malware is Packing Heat".
|
||||
- [RCE Lab](https://github.com/apuromafo/RCE_Lab) - Crackme's, keygenme's, serialme's ; the "tuts4you" folder contains many packed binaries.
|
||||
- [Runtime Packers Testset](https://www.researchgate.net/publication/268030543_Runtime_Packers_The_Hidden_Problem) - Dataset of 10 common Malware files, packed with about 40 different runtime packers in over 500 versions and options, with a total of about 5,000 samples.
|
||||
- [SAC](https://www.sac.sk/files.php?d=7&l=) - Slovak Antivirus Center, non-commercial project of AVIR and ESET companies ; contains packers, detectors and unpackers.
|
||||
- [SOREL](https://github.com/sophos-ai/SOREL-20M) - Sophos-ReversingLabs 20 Million dataset.
|
||||
- [theZoo](https://github.com/ytisf/theZoo) - Project created to make the possibility of malware analysis open and available to the public.
|
||||
- [ViruSign](https://www.virusign.com) - Another online malware database.
|
||||
- [VirusShare](https://virusshare.com) - Virus online database with more than 44 millions of samples.
|
||||
- [VX Heaven](https://web.archive.org/web/20170817143838/http://vxheaven.org/) - Site dedicated to providing information about computer viruses.
|
||||
- [VX Underground](https://vx-underground.org/samples.html) - PL-CERT based open source MWDB python application holding a malware database containing every APT sample from 2010 and over 7.5M maliciousbinaries.
|
||||
- [VXvault](http://vxvault.net/ViriList.php) - Online malware database.
|
||||
- [WildList](http://www.wildlist.org/CurrentList.txt) - Cooperative listing of malwares reported as being in the wild by security professionals.
|
||||
|
||||
<p align="center"><a href="#"><img src="https://img.shields.io/badge/Back%20to%20top--lightgrey?style=social" alt="Back to top" height="20"/></a></p>
|
||||
|
||||
|
||||
|
||||
## :package: Packers
|
||||
|
||||
### After 2010
|
||||
|
||||
- [Alienyze](https://alienyze.com) - Advanced software protection and security for Windows 32-bit executables.
|
||||
- [Alternate EXE Packer](https://www.alternate-tools.com/pages/c_exepacker.php) - Compression tool for executable files (type EXE) or DLL's relying on UPX 3.96.
|
||||
- [Amber](https://github.com/EgeBalci/amber/releases) - Position-independent(reflective) PE loader that enables in-memory execution of native PE files(EXE, DLL, SYS).
|
||||
- [Andromeda](https://blog.morphisec.com/andromeda-tactics-analyzed) - Custom packer used in malware campaigns using RunPE techniques for evading AV mitigation methods.
|
||||
- [APKProtect](https://sourceforge.net/projects/apkprotect) - APK encryption and shell protection supporting Java and C++.
|
||||
- [Armadillo](https://web.archive.org/web/20030324043555/https://www.exetools.com/files/protectors/win/armd252b2.zip) - Incorporates both a license manager and wrapper system for protecting PE files.
|
||||
- [ASPack](http://www.aspack.com/aspack.html) - Advanced solution created to provide Win32 EXE file packing and to protect them against non-professional reverse engineering.
|
||||
- [ASProtect 32](http://www.aspack.com/asprotect32.html) - Multifunctional EXE packing tool designed for software developers to protect 32-bit applications with in-built application copy protection system.
|
||||
- [ASProtect 64](http://www.aspack.com/asprotect64.html) - Tool for protecting 64-bit applications and .NET applications for Windows against unauthorized use, industrial and home copying, professional hacking and analysis of software products distributed over the Internet and on any physical media.
|
||||
- [AutoIT](https://www.autoitscript.com/site) - Legitimate executable encryption service.
|
||||
- [AxProtector](https://www.wibu.com/us/products/protection-suite/axprotector.html) - Encrypts the complete software you aim to protect, and shields it with a security shell, AxEngine, best-of-breed anti-debugging and anti-disassembly methods are then injected into your software.
|
||||
- [BangCle](https://github.com/woxihuannisja/Bangcle) - Protection tool using the second generation Android Hardening Protection, loading the encrypted DEX file from memory dynamically.
|
||||
- [Bero](https://blog.rosseaux.net/page/875fbe6549aa072b5ee0ac9cefff4827/BeRoEXEPacker) - Bero EXE Packer (BEP) for 32-bit windows executables.
|
||||
- [BIN-crypter](https://www.autoitscript.com/forum/topic/129383-bin-crypter/) - EXE protection software against crackers and decompilers.
|
||||
- [BoxedApp Packer](https://www.boxedapp.com/boxedapppacker)
|
||||
- [Code Virtualizer](https://www.oreans.com/CodeVirtualizer.php) - Code Virtualizer is a powerful code obfuscation system for Windows, Linux and macOS applications that helps developers to protect their sensitive code areas against Reverse Engineering with very strong obfuscation code, based on code virtualization.
|
||||
- [ConfuserEx](https://github.com/mkaring/ConfuserEx) - An open-source, free protector for .NET applications.
|
||||
- [Crinkler](https://github.com/runestubbe/Crinkler) - Compressing linker for Windows, specifically targeted towards executables with a size of just a few kilobytes.
|
||||
- [DarkCrypt](https://totalcmd.net/plugring/darkcrypttc.html) - Simply and powerful plugin for Total Commander used for file encryption using 100 algorithms and 5 modes.
|
||||
- [DexGuard](https://www.guardsquare.com/en/products/dexguard) - Android app obfuscation & security protocols for mobile app protection.
|
||||
- [DexProtector](https://dexprotector.com/) - Multi-layered RASP solution that secures your Android and iOS apps against static and dynamic analysis, illegal use and tampering.
|
||||
- [DotBundle](https://web.archive.org/web/20160508074421/http://www.dotbundle.com:80/download.html) - GUI tool to compress, encrypt ad password-protect a .NET application or embed .NET libraries.
|
||||
- [DotNetZ](https://www.softpedia.com/get/Programming/Packers-Crypters-Protectors/NETZ.shtml) - Straightforward and lightweight, command-line piece of software written in C that allows you to compress and pack Microsoft .NET Framework executable files.
|
||||
- [ElecKey](https://www.sciensoft.com) - Suite of software and tools that offer a complete solution for software protection, copy protection, and license management.
|
||||
- [ELFCrypt](https://github.com/droberson/ELFcrypt) - Simple ELF crypter using RC4 encryption.
|
||||
- [ELFuck](https://github.com/timhsutw/elfuck) - ELF packer for i386 original version from sk2 by sd.
|
||||
- [Enigma Protector](https://www.enigmaprotector.com) - Professional system for executable files licensing and protection.
|
||||
- [Enigma Virtual Box](https://www.enigmaprotector.com/en/aboutvb.html) - Application virtualization system for Windows.
|
||||
- [Eronona-Packer](https://github.com/Eronana/packer) - This is a packer for exe under win32.
|
||||
- [EXE Bundle](https://www.webtoolmaster.com/exebundle.htm) - Bundles application files into a single PE32 file.
|
||||
- [EXE Stealth](http://www.webtoolmaster.com/packer.htm) - Anti-cracking protection and licensing tool for PE files featuring compression and encryption polymorphic technology.
|
||||
- [Ezuri](https://github.com/guitmz/ezuri/blob/master/ezuri.go) - A Simple Linux ELF Runtime Crypter.
|
||||
- [GzExe](https://git.savannah.gnu.org/cgit/gzip.git) - Utility that allows to compress executables as a shell script.
|
||||
- [hXOR-Packer](https://github.com/rurararura/hXOR-Packer) - PE packer with Huffman compression and XOR encryption.
|
||||
- [LIAPP](https://liapp.lockincomp.com) - Easiest and most powerful mobile app security solution.
|
||||
- [LM-X License Manager](https://www.x-formation.com/lm-x-license-manager) - LM-X License Manager lets you protect your products against piracy by enforcing various levels of security, save time, and reduce business risks.
|
||||
- [m0dern_p4cker](https://github.com/n4sm/m0dern_p4cker) - Just a modern packer for elf binaries ( works on linux executables only ).
|
||||
- [MidgetPack](https://github.com/arisada/midgetpack) - Midgetpack is a binary packer for ELF binaries, such as burneye, upx or other tools.
|
||||
- [MPRESS](https://www.autohotkey.com/mpress/mpress_web.htm) - Compresses (using LZMA) and protects PE, .NET or Mach-O programs against reverse engineering.
|
||||
- [NetCrypt](https://github.com/friedkiwi/netcrypt) - A proof-of-concept packer for .NET executables, designed to provide a starting point to explain the basic principles of runtime packing.
|
||||
- [.netshrink](https://www.pelock.com/products/netshrink) - Executable compressor for your Windows or Linux .NET application executable file using LZMA.
|
||||
- [NPack](http://www.nsdsn.com/english/nspack.zip) - Can compress 32bits and 64bits exe, dll, ocx, scr Windows program.
|
||||
- [Obsidium](http://www.obsidium.de/show.php?home) - Feature-rich professional software protection and licensing system designed as a cost effective and easy to implement, yet reliable and non-invasive way to protect your 32- and 64-bit Windows software applications and games from reverse engineering.
|
||||
- [Origami](https://github.com/dr4k0nia/Origami) - Packer compressing .net assemblies, (ab)using the PE format for data storage.
|
||||
- [Pakkero](https://github.com/89luca89/pakkero) - Pakkero is a binary packer written in Go made for fun and educational purpose.
|
||||
- [Papaw](https://github.com/dimkr/papaw) - Permissively-licensed packer for ELF executables using LZMA Zstandard or Deflate compression.
|
||||
- [PE-Packer](https://github.com/czs108/PE-Packer) - Simple packer for Windows 32-bits PE files.
|
||||
- [PE-Toy](https://github.com/r0ngwe1/petoy) - A PE file packer.
|
||||
- [PELock](https://www.pelock.com) - Software protection system for Windows executable files ; protects your applications from tampering and reverse engineering, and provides extensive support for software license key management, including support for time trial periods.
|
||||
- [PePacker](https://github.com/SamLarenN/PePacker) - Simple PE Packer Which Encrypts .text Section I release a simple PE file packer which encrypts the .text section and adds a decryption stub to the end of the last section.
|
||||
- [PEShield](https://webscene.ir/tools/show/PE-SHIELD-0.25) - PE-SHiELD is a program, which encrypts 32-bit Windows EXE files, leaving them still executable.
|
||||
- [PESpin](http://downloads.fyxm.net/PESpin-95477.html)
|
||||
- [PEtite](https://www.un4seen.com/petite/) - Free Win32 (Windows 95/98/2000/NT/XP/Vista/7/etc) executable (EXE/DLL/etc) compressor.
|
||||
- [RapidEXE](https://sourceforge.net/projects/rapidexe) - Simple and efficient way to convert a PHP/Python script to a standalone executable.
|
||||
- [sePACKER](https://sourceforge.net/projects/sepacker/) - Simple Executable Packer is compressing executables' code section inorder to decrease size of binary files.
|
||||
- [Silent-Packer](https://github.com/SilentVoid13/Silent_Packer) - Silent Packer is an ELF / PE packer written in pure C.
|
||||
- [Simple-PE32-Packer](https://github.com/z3r0d4y5/Simple-PE32-Packer) - Simple PE32 Packer with aPLib compression library.
|
||||
- [Smart Packer](https://www.smartpacker.nl) - Packs 32 & 64bit applications with DLLs, data files, 3rd party run-time into one single executable that runs instantly, with no installs or hassles.
|
||||
- [theArk](https://github.com/aaaddress1/theArk) - Windows x86 PE Packer In C++.
|
||||
- [Themida](https://www.oreans.com/themida.php) - From Renovo paper: Themida converts the original x86 instructions into virtual instructions in its own randomized instruction set, and then interpret these virtual instructions at run-time.
|
||||
- [UPX](https://upx.github.io/) - Ultimate Packer for eXecutables.
|
||||
- [VMPROTECT](https://github.com/eaglx/VMPROTECT) - Obfuscation method using virtual machine.
|
||||
- [VMProtect](https://vmpsoft.com/products/vmprotect) - VMProtect protects code by executing it on a virtual machine with non-standard architecture that makes it extremely difficult to analyze and crack the software.
|
||||
- [Ward](https://github.com/ex0dus-0x/ward) - Simple implementation of an ELF packer that creates stealthy droppers for loading malicious ELFs in-memory.
|
||||
- [xorPacker](https://github.com/nqntmqmqmb/xorPacker) - Simple packer working with all PE files which cipher your exe with a XOR implementation.
|
||||
- [ZProtect](http://www.jiami.net) - Renames metadata entities and supports advanced obfuscation methods that harden protection scheme and foil reverse engineering altogether.
|
||||
|
||||
<p align="center"><a href="#"><img src="https://img.shields.io/badge/Back%20to%20top--lightgrey?style=social" alt="Back to top" height="20"/></a></p>
|
||||
|
||||
### Between 2000 and 2010
|
||||
|
||||
- [20to4](http://20to4.net) - Executable compressor that is able to stuff about 20k of finest code and data into less than 4k.
|
||||
- [ACProtect](https://www.yaldex.com/Bestsoft/Utilities/acprotect.htm) - Application that allows to protect Windows executable files against piracy, using RSA to create and verify the registration keys and unlock code.
|
||||
- [AHPack](https://www.delphibasics.info/home/delphibasicscounterstrikewireleases/ahpacker01byfeuerraderahteam) - PE and PE+ file packer.
|
||||
- [Application Protector](https://sourceforge.net/projects/balaji/) - Tool for protecting Windows applications.
|
||||
- [AT4RE Protector](https://en.52yma.com/thread-5444-1-1.html) - Very simple PE files protector programmed in ASM.
|
||||
- [AverCryptor](https://web.archive.org/web/20071012084924/http://secnull.org) - Small and very handy utility designed to encrypt notes in which you can store any private information - it helps to hide your infection from antiviruses.
|
||||
- [BurnEye](https://packetstormsecurity.com/files/29691/burneye-1.0-linux-static.tar.gz.html) - Burneye ELF encryption program, x86-linux binary.
|
||||
- [ByteBoozer](https://csdb.dk/release/?id=33093) - Commodore 64 executable packer.
|
||||
- [EXE Guarder](http://www.exeicon.com/exeguarder) - Licensing tool for PE files allowing to compress and specify a password notice.
|
||||
- [EXE Wrapper](https://web.archive.org/web/20160331144211/http://533soft.com/exewrapper) - Protects any EXE file with a password from non-authorized execution.
|
||||
- [Exe32Pack](https://exe32pack.apponic.com/) - Compresses Win32 EXEs, DLLs, etc and dynamically expands them upon execution.
|
||||
- [EXECryptor](https://execryptor.freedownloadscenter.com/windows) - Protects EXE programs from reverse engineering, analysis, modifications and cracking.
|
||||
- [ExeFog](https://www.delphibasics.info/home/delphibasicscounterstrikewireleases/exefog11-executablepackerbybagie) - Simple Win32 PE files packer.
|
||||
- [eXPressor](https://www.cgsoftlabs.ro/express.html) - Used as a compressor this tool can compress EXE files to half their normal size.
|
||||
- [FSG](https://web.archive.org/web/20030324043555/https://www.exetools.com/files/compressors/win/fsg.zip) - *Fast Small Good*, perfect compressor for small exes, eg.
|
||||
- [GHF Protector](https://www.delphibasics.info/home/delphibasicscounterstrikewireleases/ghfprotector10) - Executable packer / protector based on open source engines Morphine and AHPack.
|
||||
- [HackStop](https://defacto2.net/f/a520164?packer=hs) - EXE and COM programs encrypter and protector.
|
||||
- [Kkrunchy](http://www.farbrausch.de/~fg/kkrunchy) - Kkrunchy is a small exe packer primarily meant for 64k intros.
|
||||
- [mPack](https://blog.fearcat.in/a?ID=00050-86a031da-e36f-4409-9a08-d3d993dbf8f5) - mPack - mario PACKersimple Win32 PE Executable compressor.
|
||||
- [NSPack](https://nspack.apponic.com/) - 32/64-bits exe, dll, ocx, scr Windows program compressor.
|
||||
- [NTPacker](https://hacking-software-free-download.blogspot.com/2013/02/nt-packer-v21.html) - PE file packer relying on aPlib for compression and/or XOR for encryption.
|
||||
- [PECompact](http://www.bitsum.com/pec2.asp) - Windows executable compressor featuring third-party plug-ins offering protection against reverse engineering.
|
||||
- [RDMC](https://www.sac.sk/download/pack/rdm006be.zip) - DMC algorithm based packer.
|
||||
- [RLPack](https://web.archive.org/web/20070527132336/http://rlpack.jezgra.net) - Compresses your executables and dynamic link libraries in a way that keeps them small and has no effect on compressed file functionality.
|
||||
- [RSCC](https://defacto2.net/f/a520164?packer=rscc) - ROSE Super COM Crypt ; polymorph cryptor for files greater than 300-400B and smaller than 60kB.
|
||||
- [RUCC](https://defacto2.net/f/a520164?packer=rucc) - ROSE Ultra COM Compressor ; COM and EXE compression utility based on 624.
|
||||
- [Sentinel HASP Envelope](https://cpl.thalesgroup.com/en-gb/software-monetization/all-products/sentinel-hasp) - Wrapping application that protects the target application with a secure shield, providing a means to counteract reverse engineering and other anti-debugging measures.
|
||||
- [Shiva](https://packetstormsecurity.com/files/31087/shiva-0.95.tar.gz.html) - Shiva is a tool to encrypt ELF executables under Linux.
|
||||
- [tElock](https://www.softpedia.com/get/Programming/Packers-Crypters-Protectors/Telock.shtml) - Telock is a practical tool that intends to help developers who want to protect their work and reduce the size of the executable files.
|
||||
- [TTProtect](http://www.ttprotect.com) - Professional protection tool designed for software developers to protect their PE applications against illegal modification or decompilation.
|
||||
- [UPack](https://www.sac.sk/download/pack/upack399.rar) - Compresses Windows PE file.
|
||||
- [UPX-Scrambler](https://defacto2.net/f/a520164?packer=upxs) - Scrambler for files packed with UPX (up to 1.06) so that they cannot be unpacked with the '-d' option.
|
||||
- [WinUpack](https://www.sac.sk/download/pack/wupck039.zip) - Graphical interface for Upack, a command-line program used to create self-extracting archives from Windows PE files.
|
||||
- [XComp](http://www.soft-lab.de/JoKo/index_old.htm) - PE32 image file packer and rebuilder.
|
||||
- [Yoda Crypter](https://sourceforge.net/projects/yodap/files/Yoda%20Crypter/1.3/yC1.3.zip/download) - Supports polymorphic encryption, softice detection, anti-debug API's, anti-dumping, etc, encrypts the Import Table and erases PE Header.
|
||||
- [Yoda Protector](http://yodap.sourceforge.net) - Free, open source, Windows 32-bit software protector.
|
||||
|
||||
<p align="center"><a href="#"><img src="https://img.shields.io/badge/Back%20to%20top--lightgrey?style=social" alt="Back to top" height="20"/></a></p>
|
||||
|
||||
### Before 2000
|
||||
|
||||
- [32Lite](https://web.archive.org/web/20060111104142/http://www.exetools.com/files/compressors/dos/32lte02d.zip) - Compression tool for executable files created with Watcom C/C++ compiler.
|
||||
- [624](https://web.archive.org/web/20060111104142/http://www.exetools.com/files/compressors/dos/624-11.zip) - COM packer that can compress COM programs shorter than 25000 bytes.
|
||||
- [ABK Scrambler](https://defacto2.net/f/a520164?packer=abk-scrambler) - COM file scrambler and protector recoded from ABKprot.
|
||||
- [AEP](https://defacto2.net/f/a520164?packer=aep) - Addition Encode-Protective for COM and EXE file.
|
||||
- [AINEXE](https://defacto2.net/f/a520164?packer=ainexe) - DOS executable packer (part of the AIN Archiver suite).
|
||||
- [aPack](https://web.archive.org/web/20060111104142/http://www.exetools.com/files/compressors/dos/apack099.zip) - 16-bit real-mode DOS executable ( .EXE and .COM ) compressor.
|
||||
- [AVPack](https://web.archive.org/web/20060111104142/http://www.exetools.com/files/compressors/dos/avpck122.zip) - Encrypts EXE or COM files so that they'll be able to start on your PC only.
|
||||
- [AXE](https://web.archive.org/web/20060111104142/http://www.exetools.com/files/compressors/dos/axe22.zip) - Program compression utility.
|
||||
- [BIN-Lock](https://defacto2.net/f/a520164?packer=bin-lock) - COM file scrambler for preventing reverse engineering.
|
||||
- [BitLok](https://defacto2.net/f/a520164?packer=bitlok) - COM and EXE file protector.
|
||||
- [C0NtRiVER](https://defacto2.net/f/a520164?packer=c0ntriver) - COM file encryptor.
|
||||
- [CauseWay Compressor](https://github.com/tkchia/causeway/tree/1ead4be14c9e536262e225f090b40b0c6cded286/watcom) - DOS EXE compressor.
|
||||
- [CC Pro](https://defacto2.net/f/a520164?packer=ccpro) - COM and EXE executable file compression utility.
|
||||
- [CEXE](https://web.archive.org/web/20060111104142/http://www.exetools.com/files/compressors/win/cexe10a.zip) - Compresses an input EXE into a smaller executable (only runs on WinNT, Win2000 and above - won't run on Win95 or Win98).
|
||||
- [COMProtector](https://defacto2.net/f/a520164?packer=comprotector) - Adds a security envelope around DOS .COM files by randomly encrypting it and adding several anti-debugging tricks.
|
||||
- [CrackStop](https://defacto2.net/f/a520164?packer=crackstop) - Tool that creates a security envelope around a DOS EXE file to protect it against crackers.
|
||||
- [Crunch](https://defacto2.net/f/a520164?packer=crunch) - File encryptor for COM and EXE files.
|
||||
- [EPack](https://web.archive.org/web/20060111104142/http://www.exetools.com/files/compressors/dos/epack16.zip) - EXE and COM file compressor ; works with DOS/Windows95 files.
|
||||
- [ExeGuard](https://defacto2.net/f/a520164?packer=exeguard) - DOS EXE files free protector using anti-debugging ticks to prevent hacking, analysis and unpacking.
|
||||
- [EXELOCK 666](https://defacto2.net/f/a520164?packer=exelock666) - Utility for protecting .EXE files so no lamers can hack out the copyright.
|
||||
- [FSE](https://defacto2.net/f/a520164?packer=fse) - Final Fantasy Security Envelope freeware for protecting COM and EXE progams.
|
||||
- [Gardian Angel](https://defacto2.net/f/a520164?packer=gardian-angel) - COM and EXE encrypter and protector using a variety of anti-debugging tricks.
|
||||
- [JMCryptExe](https://defacto2.net/f/a520164?packer=jmce) - DOS EXE encrypter.
|
||||
- [LGLZ](https://web.archive.org/web/20060111104142/http://www.exetools.com/files/compressors/dos/lglz104b.zip) - DOS EXE and COM file compressor using modified LZ77.
|
||||
- [LzExe](https://defacto2.net/f/a520164?packer=lzexe) - MS-DOS executable file compressor.
|
||||
- [Mask](https://defacto2.net/f/a520164?packer=mask) - Tool that prevents COM program from being cracked by using encryption and anti-debugging tricks.
|
||||
- [Megalite](https://web.archive.org/web/20060111104142/http://www.exetools.com/files/compressors/dos/megal120.zip) - MS-DOS executable file compressor.
|
||||
- [Mess](https://defacto2.net/f/a520164?packer=mess) - This tool does the same as HackStop, with the exception that it is freeware for non-commercial use.
|
||||
- [Morphine](https://github.com/bowlofstew/rootkit.com/blob/master/hf/Morphine27) - Application for PE files encryption.
|
||||
- [Neolite](https://web.archive.org/web/20060111104142/http://www.exetools.com/files/compressors/win/neolte20.zip) - Compresses Windows 32-bit EXE files and DLLs.
|
||||
- [PACK](https://web.archive.org/web/20060111104142/http://www.exetools.com/files/compressors/dos/pack201.zip) - Executable files compressor.
|
||||
- [PCShrink](https://web.archive.org/web/20060111104142/http://www.exetools.com/files/compressors/win/pcsnk071.zip) - Windows 9x/NT executable file compressor relying on the aPLib compression library.
|
||||
- [PE Diminisher](https://web.archive.org/web/20060111104142/http://www.exetools.com/files/compressors/win/ped.zip) - Simple PE packer relying on the aPLib compression library.
|
||||
- [PE-Protector](https://web.archive.org/web/20030324043555/https://www.exetools.com/files/protectors/win/pe-protector10.zip) - Encrypter/protector for Windows 9x/ME to protect executable files PEagainst reverse engineering or cracking with a very strong protection.
|
||||
- [PEBundle](http://www.collakesoftware.com/files/pebsetup.exe) - Physically attaches DLL(s) to an executable, resolving dependencies in memory.
|
||||
- [PEPack](https://web.archive.org/web/20060111104142/http://www.exetools.com/files/compressors/win/pepack10.zip) - PE compression tool based on the code of a newer version of PE-SHiELD.
|
||||
- [PKlite](https://defacto2.net/f/a520164?packer=pklite) - Easy-to-use file compression program for compressing DOS and Windows executable files.
|
||||
- [Pro-Pack](https://web.archive.org/web/20060111104142/http://www.exetools.com/files/compressors/dos/pp219.zip) - DOS executable file compressor.
|
||||
- [RERP](https://www.sac.sk/download/pack/rerp.rar) - ROSE's EXE Relocation Packer.
|
||||
- [RJCrush](https://www.sac.sk/download/pack/rjc-beta.zip) - EXE and COM files compressor with the ability to compress overlays.
|
||||
- [Scorpion](https://defacto2.net/f/a520164?packer=scorpion) - EXE and COM file encrypter and protector.
|
||||
- [SecuPack](https://web.archive.org/web/20210119235522/https://www.exetools.com/files/compressors/win/secupack15.zip) - Win32 executable compressor.
|
||||
- [Shrinker](https://www.sac.sk/download/pack/shrinker.exe) - Compresses (up to 70%) 16 and 32 bit Windows and real mode DOS programs.
|
||||
- [SPack](https://www.sac.sk/download/pack/spack20.zip)
|
||||
- [$PIRIT](https://defacto2.net/f/a520164?packer=%24pirit) - COM/EXE executable files polymorphic encryptor.
|
||||
- [SysPack](https://web.archive.org/web/20060111104142/http://www.exetools.com/files/compressors/dos/syspack.zip) - Device drivers compressor.
|
||||
- [T-Pack](https://web.archive.org/web/20060111104142/http://www.exetools.com/files/compressors/dos/tpack05.zip) - Executable COM-FILE compressor (LZ77) optimized for small files like BBS-Addys or similar files.
|
||||
- [TinyProg](https://www.sac.sk/download/pack/tinyp39.zip) - EXE and COM programs compressor.
|
||||
- [TRAP](https://defacto2.net/f/a520164?packer=trap) - EXE and COM files encrypter and protector.
|
||||
- [Vacuum](https://web.archive.org/web/20060111104142/http://www.exetools.com/files/compressors/dos/vacuum.zip) - Runtime Compressor for DOS32 executables.
|
||||
- [VGCrypt](ftp://ftp.cdrom.com/.3/sac/security/vgcrypt.zip) - PE crypter for Win95/98/NT.
|
||||
- [WinLite](https://www.sac.sk/download/pack/winlite1.zip) - Compresses Windows executables (such as Pklite, Diet or Wwpack) for executables programs under DOS.
|
||||
- [WWPack](https://defacto2.net/f/a520164?packer=wwpack) - Squeezes EXE files, compresses relocation tables, optimizes headers, protects EXE files from hacking.
|
||||
- [XE](https://defacto2.net/f/a520164?packer=xe) - PE32 image file packer and rebuilder.
|
||||
- [XorCopy](https://defacto2.net/f/a520164?packer=xorcopy) - COM file XOR-based encrypter.
|
||||
- [XORER](https://defacto2.net/f/a520164?packer=xorer) - COM file XOR-based encrypter.
|
||||
- [XPA](https://web.archive.org/web/20060111104142/http://www.exetools.com/files/compressors/dos/xpa.zip) - DOS executable packer.
|
||||
- [XPack](https://defacto2.net/f/a520164?packer=xpack) - EXE/COM/SYS executable file compressor.
|
||||
|
||||
<p align="center"><a href="#"><img src="https://img.shields.io/badge/Back%20to%20top--lightgrey?style=social" alt="Back to top" height="20"/></a></p>
|
||||
|
||||
|
||||
|
||||
## :wrench: Tools
|
||||
|
||||
- [Android Unpacker](https://github.com/strazzere/android-unpacker) - Android Unpacker presented at Defcon 22: Android Hacker Protection Level 0.
|
||||
- [Angr](https://github.com/angr/angr) - Platform-agnostic binary analysis framework.
|
||||
- [APKiD](https://github.com/rednaga/APKiD) - Android application Identifier for packers, protectors, obfuscators and oddities - PEiD for Android.
|
||||
- [aPLib](https://ibsensoftware.com/products_aPLib.html) - Compression library based on the algorithm used in aPACK.
|
||||
- [AppSpear](https://github.com/UchihaL/AppSpear) - Universal and automated unpacking system suitable for both Dalvik and ART.
|
||||
- [Assiste (Packer)](https://assiste.com/Packer.html) - Assiste.com's example list of packers.
|
||||
- [AVClass](https://github.com/malicialab/avclass) - Python tools to tag / label malware samples.
|
||||
- [Bintropy](https://github.com/dhondta/bintropy) - Prototype analysis tool that estimates the likelihood that a binary file contains compressed or encrypted bytes.
|
||||
- [BinUnpack](https://doi.org/10.1145/3243734.3243771) - Unpacking approach free from tedious memory access monitoring, therefore introducing very small runtime overhead.
|
||||
- [Binutils](https://www.gnu.org/software/binutils) - The GNU Binutils are a collection of binary tools for Linux (it namely includes Readelf).
|
||||
- [BitBlaze](http://bitblaze.cs.berkeley.edu/release/index.html) - Analysis platform that features a novel fusion of static and dynamic analysis techniques, mixed concrete and symbolic execution, and whole-system emulation and binary instrumentation, all to facilitate state-of-the art research on real security problems.
|
||||
- [Capstone](https://www.capstone-engine.org) - Lightweight multi-platform, multi-architecture disassembly framework.
|
||||
- [CFF Explorer](https://ntcore.com/?page_id=388) - PE32/64 and .NET editor, part of the Explorer Suite.
|
||||
- [ChkEXE](https://defacto2.net/f/a91dea6?dosmachine=svga&dosspeed=max) - Identifies almost any EXE/COM packer, crypter or protector.
|
||||
- [Clamscan Unpacker](https://clamunpacker.sourceforge.io/) - Unpacker derived from ClamAV.
|
||||
- [COM2EXE](https://defacto2.net/f/a520164?tool=com2exe) - Free tool for converting COM files to EXE format.
|
||||
- [de4dot](https://github.com/0xd4d/de4dot) - .NET deobfuscator and unpacker.
|
||||
- [de4js](https://github.com/lelinhtinh/de4js) - JavaScript Deobfuscator and Unpacker.
|
||||
- [Defacto2 Analyzers Archive](https://defacto2.net/f/aa2e6ec) - Collection of 60 binary files analysers for MS-DOS and Windows32 from the 1990s and the 2000s.
|
||||
- [Defacto2 Packers Archive](https://defacto2.net/f/a520164) - Collection of 460 binary and data file packers for MS-DOS and Windows32 from the 1990s and 2000s.
|
||||
- [Defacto2 Unpackers Archive](https://defacto2.net/f/a218ab4) - Collection of 152 binary files unpackers for MS-DOS and Windows 32 from the 1990s and 2000s.
|
||||
- [DIE](https://github.com/horsicq/DIE-engine/releases) - Detect It Easy ; Program for determining types of files.
|
||||
- [DynamoRIO](https://dynamorio.org) - Runtime code manipulation system that supports code transformations on any part of a program, while it executes.
|
||||
- [Emulator](https://techdocs.broadcom.com/us/en/symantec-security-software/endpoint-security-and-management/endpoint-protection/all/Using-policies-to-manage-security/preventing-and-handling-virus-and-spyware-attacks-v40739565-d49e172/how-does-the-emulator-in-symantec-endpoint-protect-v121004909-d47e230.html) - Symantec Endpoint Protector (from v14) capability to create a virtual machine on the fly to identify, detonate, and eliminate malware hiding inside custom malware packers.
|
||||
- [EtherUnpack](https://ether.gtisc.gatech.edu/web_unpack) - Precision universal automated unpacker (successor of PolyUnpack).
|
||||
- [Eureka](https://web.archive.org/web/20150502154942/http://eureka.cyber-ta.org) - Binary static analysis preparation framework implementing a novel binary unpacking strategy based on statistical bigram analysis and coarse-grained execution tracing.
|
||||
- [EXEInfo-PE](https://github.com/ExeinfoASL/ASL) - Fast detector for executable PE files.
|
||||
- [ExeScan](https://defacto2.net/f/ae2c42e) - Executable file analyzer which detects the most famous EXE/COM Protectors, Packers, Converters and compilers.
|
||||
- [EXETools](https://forum.exetools.com) - Forum for reverse engineering and executale packing related topics.
|
||||
- [FUU](https://github.com/crackinglandia/fuu) - Fast Universal Unpacker.
|
||||
- [GetTyp](https://www.helger.com/gt/gt.htm) - File format detection program for DOS based on special strings and byte code.
|
||||
- [GUnpacker](http://qunpack.ahteam.org/?p=327) - Shell tool that performs OEP positioning and dumps decrypted code.
|
||||
- [IDR](https://github.com/crypto2011/IDR) - Interactive Delphi Reconstructor.
|
||||
- [Justin](https://doi.org/10.1007/978-3-540-87403-4_6) - Just-In-Time AV scanning ; generic unpacking solution.
|
||||
- [Language 2000](https://farrokhi.net/language) - Ultimate compiler detection utility.
|
||||
- [LIEF](https://github.com/lief-project/LIEF) - Library to Instrument Executable Formats ; Python package for parsing PE, ELF, Mach-O and DEX formats, modifying and rebuilding executables.
|
||||
- [Lissom](ttp://www.fit.vutbr.cz/research/groups/lissom) - Retargetable decompiler consisting of a preprocessing part and a decompilation core.
|
||||
- [LordPE](https://www.aldeid.com/wiki/LordPE) - PE header viewer, editor and rebuilder.
|
||||
- [Malheur](https://github.com/rieck/malheur) - Tool for the automatic analysis of malware behavior (recorded from malicious software in a sandbox environment).
|
||||
- [MalUnpack](https://github.com/hasherezade/mal_unpack) - Dynamic unpacker based on PE-sieve.
|
||||
- [Manalyze](https://github.com/JusticeRage/Manalyze) - Robust parser for PE files with a flexible plugin architecture which allows users to statically analyze files in-depth.
|
||||
- [MRC](https://mandiant-red-curtain.apponic.com) - (Mandiant Red Curtain) Free software for Incident Responders that assists with the analysis of malware ; it examines executable files (e.g., .exe, .dll, and so on) to determine how suspicious they are based on a set of criteria.
|
||||
- [.NET Deobfuscator](https://github.com/NotPrab/.NET-Deobfuscator) - List of .NET Deobfuscators and Unpackers.
|
||||
- [OEPdet](https://ieeexplore.ieee.org/abstract/document/7782073) - Automated original-entry-point detector.
|
||||
- [OllyDbg Scripts](https://github.com/xshows/ollydbg-script) - Collection of OllyDbg scripts for unpacking many different packers.
|
||||
- [OmniUnpack](https://doi.org/10.1109/ACSAC.2007.15) - New technique for fast, generic, and safe unpacking of malware by monitoring the execution in real-time and detecting the removed layers of packing.
|
||||
- [PackerAttacker](https://github.com/BromiumLabs/PackerAttacker) - Tool that uses memory and code hooks to detect packers.
|
||||
- [PackerBreaker](https://www.portablefreeware.com/forums/viewtopic.php?t=21555) - Tool for helping unpack, decompress and decrypt most of the programs packed, compressed or encrypted using advanced emulation technology.
|
||||
- [PackerGrind](https://github.com/rewhy/adaptiveunpacker) - Adaptive unpacking tool for tracking packing bahaviors and unpacking Android packed apps.
|
||||
- [PackerID](https://github.com/sooshie/packerid) - Fork of packerid.py using PEid signatures and featuring additional output types, formats, digital signature extraction, and disassembly support.
|
||||
- [PackID](https://github.com/mesaleh/PackiD) - Packer identification multiplatform tool/library using the same database syntax as PEiD.
|
||||
- [Packing-Box](https://github.com/dhondta/docker-packing-box) - Docker image gathering many packing-related tools and for making datasets of packed executables for use with machine learning.
|
||||
- [PANDA](https://github.com/panda-re/panda) - Platform for Architecture-Neutral Dynamic Analysis.
|
||||
- [Pandora's Bochs](https://0x0badc0.de/gitweb?p=bochs/.git) - Extension to the Bochs PC eumlator to enable it to monitor execution of the unpacking stubs for extracting the original code.
|
||||
- [PCjs](https://www.pcjs.org) - PCjs uses JavaScript to recreate the IBM PC experience, using original ROMs, CPUs running at their original speeds, and early IBM video cards and monitors.
|
||||
- [PE Compression Test](http://pect.atspace.com/) - List of packers tested on a few sample executables for comparing compressed sizes.
|
||||
- [PE Detective](https://ntcore.com/?page_id=367) - This GUI tool can scan single PE files or entire directories (also recursevely) and generate complete reports.
|
||||
- [PE-bear](https://github.com/hasherezade/pe-bear-releases) - Freeware reversing tool for PE files aimed to deliver fast and flexible “first view” for malware analysts, stable and capable to handle malformed PE files.
|
||||
- [PEdump](https://pedump.me/) - Dump windows PE files using Ruby.
|
||||
- [Pefeats](https://github.com/roussieau/masterthesis/tree/master/src/detector/tools/pefeats) - Utility for extracting 119 features from a PE file for use with machine learning algorithms.
|
||||
- [Pefile](https://github.com/erocarrera/pefile) - Multi-platform Python module to parse and work with Portable Executable files.
|
||||
- [PEFrame](https://github.com/guelfoweb/peframe) - Tool for performing static analysis on PE malware and generic suspicious files.
|
||||
- [PEiD](http://www.secretashell.com/codomain/peid/) - Packed Executable iDentifier.
|
||||
- [PEiD (CLI)](https://github.com/dhondta/peid) - Python implementation of PEiD featuring an additional tool for making new signatures.
|
||||
- [PEiD (yara)](https://github.com/K-atc/PEiD) - Yet another implementation of PEiD with yara.
|
||||
- [PeLib](https://github.com/avast/pelib) - PE file manipulation library.
|
||||
- [PEPack](https://github.com/merces/pev) - PE file packer detection tool, part of the Unix package "pev".
|
||||
- [PEscan](https://tzworks.com/prototype_page.php?proto_id=15) - CLI tool to scan PE files to identify how they were constructed.
|
||||
- [PETools](https://github.com/petoolse/petools) - Old-school reverse engineering tool (with a long history since 2002) for manipulating PE files.
|
||||
- [PEview](http://wjradburn.com/software) - Provides a quick and easy way to view the structure and content of 32-bit Portable Executable (PE) and Component Object File Format (COFF) files.
|
||||
- [PExplorer](http://www.heaventools.com/overview.htm) - Most feature-packed program for inspecting the inner workings of your own software, and more importantly, third party Windows applications and libraries for which you do not have source code.
|
||||
- [Pin](https://www.intel.com/content/www/us/en/developer/articles/tool/pin-a-dynamic-binary-instrumentation-tool.html) - Dynamic binary instrumentation framework for the IA-32, x86-64 and MIC instruction-set architectures that enables the creation of dynamic program analysis tools.
|
||||
- [PINdemonium](https://github.com/Phat3/PINdemonium) - Unpacker for PE files exploiting the capabilities of PIN.
|
||||
- [PolyUnpack](https://github.com/PlatonovIvan/PolyUnpack) - Implemention attempt of the general approach for extracting the original hidden code of PE files without any heuristic assumptions.
|
||||
- [PortEx](https://github.com/katjahahn/PortEx) - Java library for static malware analysis of PE files with a focus on PE malformation robustness and anomaly detection.
|
||||
- [PROTECTiON iD](https://web.archive.org/web/20210331144912/https://protectionid.net) - PE file signature-based scanner.
|
||||
- [ProTools](http://protools.narod.ru) - Programmer's Tools, a web site dedicated for all kinds of tools and utilities for the true WinBloze programmer, including packers, crypters, etc.
|
||||
- [PyPackerDetect](https://github.com/cylance/PyPackerDetect) - Small python script/library to detect whether an executable is packed.
|
||||
- [PyPackerDetect (refactored)](https://github.com/dhondta/PyPackerDetect) - A complete refactoring of the original project to a Python package with a console script to detect whether an executable is packed.
|
||||
- [PyPeid](https://github.com/FFRI/pypeid) - Yet another implementation of PEiD with yara-python.
|
||||
- [Quick Unpack](http://qunpack.ahteam.org/?p=458) - Generic unpacker that facilitates the unpacking process.
|
||||
- [RDG Packer Detector](http://www.rdgsoft.net) - Packer detection tool.
|
||||
- [Reko](https://github.com/uxmal/reko) - Free decompiler for machine code binaries.
|
||||
- [REMINDer](https://doi.org/10.1109/CSA.2009.5404211) - Packing detection tool based on the entropy value of the entry point section and the WRITE attribute.
|
||||
- [REMnux](https://remnux.org) - Linux toolkit for reverse-engineering and analyzing malicious software.
|
||||
- [Renovo](https://doi.org/10.1145/1314389.1314399) - Detection tool built on top of TEMU (dynamic analysis component of BitBlaze) based on the execution of newly-generated code and monitoring memory writes after the program starts.
|
||||
- [ResourceHacker](http://angusj.com/resourcehacker) - Resource editor for 32bit and 64bit Windows applications.
|
||||
- [RetDec](https://github.com/avast/retdec) - Retargetable machine-code decompiler based on LLVM.
|
||||
- [RTD](https://www.sac.sk/download/pack/rtd_rp24.zip) - Rose Patch - TinyProt/Rosetiny Unpacker.
|
||||
- [RUPP](https://www.sac.sk/download/pack/rupp037.rar) - ROSE SWE UnPaCKER PaCKaGE (for DOS executables only).
|
||||
- [SAFE](mailto:mihai@cs.wisc.edu) - Static Analyzer For Executables (available on demand).
|
||||
- [ShowStopper](https://github.com/CheckPointSW/showstopper) - Tool to help malware researchers explore and test anti-debug techniques or verify debugger plugins or other solutions that clash with standard anti-debug methods.
|
||||
- [StudPE](http://www.cgsoftlabs.ro/studpe.html) - PE viewer and editor (32/64 bit).
|
||||
- [SymPack](https://www.amazon.com/Norton-AntiVirus-2007-Old-Version/dp/B000IAOIXW) - Safe, portable, largely effective but not generic library for packing detection and unpacking ; part of the Norton Antivirus solution.
|
||||
- [Titanium Platform](https://www.reversinglabs.com/products/malware-analysis-platform) - Machine learning hybrid cloud platform that harvests thousands of file types at scale, speeds threat detection through machine learning binary analysis, and continuously monitors an index of over 10B files for future threats.
|
||||
- [TrID](https://mark0.net/soft-trid-e.html) - Utility for identifying file types from their binary signatures.
|
||||
- [Triton](https://github.com/jonathansalwan/Triton) - Dynamic binary analysis library.
|
||||
- [Tuts 4 You](https://tuts4you.com) - Non-commercial, independent community dedicated to the sharing of knowledge and information on reverse code engineering.
|
||||
- [Unipacker](https://github.com/unipacker/unipacker) - Automatic and platform-independent unpacker for Windows binaries based on emulation.
|
||||
- [UnpacMe](https://www.unpac.me) - Automated malware unpacking service.
|
||||
- [Unpckarc](https://web.archive.org/web/20191218043307/http://www.woodmann.com/crackz/Tools/) - Packed executables detection tool relying on several heuristics.
|
||||
- [UU](https://www.sac.sk/download/pack/uu215e.exe) - Universal Unpacker.
|
||||
- [Uundo](https://www.sac.sk/download/pack/uundo.zip) - Universal Undo - Universal Unpacker.
|
||||
- [Uunp (IDA Pro plugin)](https://www.hex-rays.com/blog/unpacking-mpressed-pe-dlls-with-the-bochs-plugin/) - IDA Pro debugger plug-in module automating the analysis and unpacking of packed binaries.
|
||||
- [UUP](https://www.sac.sk/download/pack/uup14.zip) - Universal exe-file UnPacker.
|
||||
- [VirusTotal](https://www.virustotal.com/gui/) - File analysis Web service for detecting malware.
|
||||
- [VMUnpacker](https://www.leechermods.com/2010/01/vmunpacker-16-latest-version.html) - Unpacker based on the technology of virtual machine.
|
||||
- [Winbindex](https://github.com/m417z/winbindex) - An index of Windows binaries, including download links for executables such as EXE, DLL and SYS files.
|
||||
|
||||
<p align="center"><a href="#"><img src="https://img.shields.io/badge/Back%20to%20top--lightgrey?style=social" alt="Back to top" height="20"/></a></p>
|
||||
|
||||
|
||||
|
||||
## Contributing
|
||||
|
||||
Contributions are welcome! Please read the [contribution guidelines](CONTRIBUTING.md) first.
|
||||
|
||||
|
||||
|
||||
```
|
||||
@@ -0,0 +1,224 @@
|
||||
Project Path: arc_gmh5225_ghostbusters_11a6k0uk
|
||||
|
||||
Source Tree:
|
||||
|
||||
```txt
|
||||
arc_gmh5225_ghostbusters_11a6k0uk
|
||||
├── README.md
|
||||
├── main.cpp
|
||||
├── notebook.ipynb
|
||||
└── requirements.txt
|
||||
|
||||
```
|
||||
|
||||
`README.md`:
|
||||
|
||||
```md
|
||||
|
||||
### Senior Design: Anit-Cheat Detection system
|
||||
---
|
||||
|
||||
#### "Measure Learning":
|
||||
- Client Side Application
|
||||
- Server Side Streaming
|
||||
- UDP style streaming capabilites
|
||||
- Camara Processing Capabilities
|
||||
- Multithreading
|
||||
- MIT / Free Licencing
|
||||
|
||||
### Behaviors:
|
||||
- Bluetooch Monitoring
|
||||
- Video Streaming
|
||||
- Mouse Analysis
|
||||
- Feature Analysis
|
||||
- Privacy Concerns (FIPPA)
|
||||
|
||||
#### Frameworks Ideas:
|
||||
- Flask
|
||||
- React
|
||||
- .NET MAUI
|
||||
|
||||
### Analysis/Training Methods:
|
||||
Scope: Monitoring features to begin with, and AI enhancements to further the focus of the models and feature. Increase accurcy and integrityare of the utmost concern.
|
||||
|
||||
### Market Research:
|
||||
- SSV
|
||||
- [OpenCV](https://docs.opencv.org/3.4/index.html)
|
||||
- FaceNet
|
||||
- [Deepface](https://research.facebook.com/publications/deepface-closing-the-gap-to-human-level-performance-in-face-verification/)
|
||||
- [PyGaze](http://www.pygaze.org/about/)
|
||||
- this will allow for naive tracking, and will work on a computer that does not have a eyetracker
|
||||
- [OGAMA](http://www.ogama.net/)
|
||||
- [Tobii](http://www.tobii.com/)
|
||||
- [Gaze Recorder](https://gazerecorder.com/)
|
||||
- [Arsfutura](https://arsfutura.com/magazine)
|
||||
- [FFMPEG](https://ffmpeg.org/)
|
||||
- [EthoVision XT](https://www.noldus.com/ethovision-xt)
|
||||
- [Pupil](https://pupil-labs.com/products/core/)
|
||||
- [RasterVision](https://docs.rastervision.io/en/stable/usage/basics.html)
|
||||
|
||||
#### Systematic Possiblities:
|
||||
[1. CNN-based image recognition for topology optimization](https://www.sciencedirect.com/science/article/abs/pii/S0950705120302379)
|
||||
[2. Support Vector Machine (SVM) for Anomaly Detection](https://towardsdatascience.com/support-vector-machine-svm-for-anomaly-detection-73a8d676c331)
|
||||
|
||||
#### Medium Articles:
|
||||
[1. A FaceNet-Style Approach to Facial Recognition on the Google Coral Development board](https://towardsdatascience.com/a-facenet-style-approach-to-facial-recognition-dc0944efe8d1)
|
||||
|
||||
#### Datasets:
|
||||
[1. One-dimensional CNN for human behavior classification](https://towardsdatascience.com/one-dimensional-cnn-for-human-behavior-classification-fb4371d03633)
|
||||
[2. Machine learning for cognitive behavioral analysis: datasets, methods, paradigms, and research directions](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC10390406/)
|
||||
|
||||
|
||||
```
|
||||
|
||||
`main.cpp`:
|
||||
|
||||
```cpp
|
||||
#include <iostream>
|
||||
#include <tensorflow/cc/client/client_session.h>
|
||||
#include <tensorflow/cc/ops/standard_ops.h>
|
||||
#include <tensorflow/core/framework/tensor.h>
|
||||
|
||||
using namespace tensorflow;
|
||||
using namespace tensorflow::ops;
|
||||
|
||||
class NN
|
||||
{
|
||||
public:
|
||||
NeuralNetwork(int input_size, int output_size, int hidden_size):
|
||||
input_size(input_size), output_size(output_size), hidden_size(hidden_size) {
|
||||
// Define the input the output placeholders
|
||||
x_ = Placeholder<float>(Placeholder<float>::Shape({-1, input_size}));
|
||||
y_ = Placeholder<float>(Placeholder<float>::Shape({-1, output_size}));
|
||||
|
||||
// Define the weights and biases
|
||||
w1_ = Variable(Shape({input_size, hidden_size}), DT_FLOAT);
|
||||
b1_ = Variable(Shape({hidden_size}, DT_FLOAT));
|
||||
w2_ = Variable(Shape({hidden_size, output_size}), DT_FLOAT);
|
||||
b2_ = Variable(Shape({output_size}, DT_FLOAT));
|
||||
|
||||
// Define the graph
|
||||
h1_ = Tanh(MatMul(x_, w1_) + b1_);
|
||||
y_hat_ = Tanh(MatMul(h1_, w2_) + b2_);
|
||||
|
||||
// Define the output of the neural network
|
||||
auto hidden = Tanh(MatMul(x_, w1_) + b1_);
|
||||
output_ = Softmax(MatMul(hidden, w2_) + b2_);
|
||||
|
||||
// Define the loss function
|
||||
loss_ = ReduceMean(Square(output_ - y_), {0,1});
|
||||
|
||||
// Define the optimizer
|
||||
optimizer_ = GradientDescentOptimizer(0.5f);
|
||||
train_op_ = optimizer_.Minimize(loss_);
|
||||
|
||||
// Initialize the session and variables
|
||||
session_ = new ClientSession();
|
||||
TF_CHECK_OK(session_->Run({
|
||||
Assign(w1_, RandomNormal(Shape({input_size, hidden_size}))),
|
||||
Assign(b1_, RandomNormal(Shape({hidden_size})),
|
||||
Assign(w2_, RandomNormal(Shape({hidden_size, output_size})),
|
||||
Assign(b2_, RandomNormal(Shape({output_size}))))
|
||||
)}
|
||||
));
|
||||
|
||||
}
|
||||
|
||||
~NeuralNetwork() {
|
||||
delete session_;
|
||||
}
|
||||
|
||||
void Train(const Tensor& x_data, const Tensor& y_data) {
|
||||
// Predict the output for the input data
|
||||
Tensor output_data;
|
||||
TF_CHECK_OK(session_->Run({{x_, x_data}}, {output__}, &output_data));
|
||||
return output_data;
|
||||
}
|
||||
|
||||
private:
|
||||
int input_size;
|
||||
int output_size;
|
||||
int hidden_size;
|
||||
Placeholder<float> x_;
|
||||
Placeholder<float> y_;
|
||||
Variable w1_;
|
||||
Variable b1_;
|
||||
Variable w2_;
|
||||
Variable b2_;
|
||||
SoftmaxOutput output_;
|
||||
ReduceMean loss_;
|
||||
GradientDescentOptimizer optimizer_;
|
||||
Operation train_op_;
|
||||
ClientSession* session_;
|
||||
|
||||
};
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
int main()
|
||||
{
|
||||
cout << "Hello World!" << endl;
|
||||
|
||||
// Define the input and output sizes
|
||||
const int input_size = 784;
|
||||
const int output_size = 10;
|
||||
const int hidden_size = 100;
|
||||
|
||||
// Create the neural network
|
||||
NeuralNetwork nn(input_size, output_size, hidden_size);
|
||||
|
||||
// Train the neural network
|
||||
for(int i=0; i<1000; i++) {
|
||||
// Generate random input and output data
|
||||
Tensor x_data(DT_FLOAT, TensorShape({100, input_size}));
|
||||
Tensor y_data(DT_FLOAT, TensorShape({100, output_size}));
|
||||
auto x_data_map = x_data.tensor<float, 2>();
|
||||
auto y_data_map = y_data.tensor<float, 2>();
|
||||
for (int j = 0; j < 100; j++){
|
||||
for (int k = 0; k < input_size; k++){
|
||||
x_data_map(j, k) = rand() % 100;
|
||||
}
|
||||
for (int k = 0; k < output_size; k++){
|
||||
y_data_map(j, k) = rand() % 100;
|
||||
}
|
||||
}
|
||||
// Train the network on the input and output data
|
||||
nn.Train(x_data, y_data);
|
||||
}
|
||||
|
||||
// Predict the output for some input data
|
||||
Tensor x_test(DT_FLOAT, TensorShape({1, input_size}));
|
||||
auto x_test_map = x_test.tensor<float, 2>();
|
||||
for (int i = 0; i < input_size; i++){
|
||||
x_test_map(0, i) = rand() % 100;
|
||||
}
|
||||
|
||||
Tensor y_test = nn.Predict(x_test);
|
||||
std::cout << "Output: " << Y_test.tensor<float, 2>()(0, 0) << std::endl;
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
||||
```
|
||||
|
||||
`notebook.ipynb`:
|
||||
|
||||
```ipynb
|
||||
Jupyter Notebook Summary:
|
||||
Total cells: 2 (0 code, 2 markdown, 0 raw)
|
||||
|
||||
(No code cells found)
|
||||
|
||||
```
|
||||
|
||||
`requirements.txt`:
|
||||
|
||||
```txt
|
||||
# notebooks
|
||||
imutils
|
||||
opencv-python
|
||||
|
||||
```
|
||||
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,25 @@
|
||||
Project Path: arc_stuxnet147_Known-Driver-Mappers_3rx783au
|
||||
|
||||
Source Tree:
|
||||
|
||||
```txt
|
||||
arc_stuxnet147_Known-Driver-Mappers_3rx783au
|
||||
└── README.md
|
||||
|
||||
```
|
||||
|
||||
`README.md`:
|
||||
|
||||
```md
|
||||
# Known-Driver-Mappers
|
||||
|
||||
## Mapper
|
||||
|
||||
| Name | URL | Description |
|
||||
| ----------------- | ------------------------------------------- | --------------------------------------------------------- |
|
||||
| LpMapper | https://github.com/VollRagm/lpmapper | Execute shellcode in drivers .data section |
|
||||
| SinMapper | https://github.com/armvirus/SinMapper | |
|
||||
| KdMapper | https://github.com/TheCruZ/kdmapper | |
|
||||
| CosMapper | https://github.com/armvirus/CosMapper | |
|
||||
|
||||
```
|
||||
Reference in New Issue
Block a user