Repository navigation
Board PE Reverse
LING71671 edited this page Jun 28, 2026
·
1 revision
9 categories · 19 articles — Windows PE binary analysis.
| # | Category | Articles | Topics |
|---|---|---|---|
| 01 | Triage | 1 | AOB signature scanning |
| 02 | PE Structure | 1 | PE header/section parsing |
| 03 | Static Analysis | 4 | Struct reconstruction, disassembly, x64dbg breakpoints, ReClass |
| 04 | Dynamic Analysis | 8 | DLL injection, trampoline/detour, external memory R/W, naked function hook, anti-debug bypass, manual map, direct syscall, Procmon patterns |
| 05 | Crypto/Unpack | 1 | PE unpacking and dump |
| 06 | IOC Extraction | 1 | Indicators of compromise |
| 07 | YARA/Sigma | 1 | Detection rule writing |
| 08 | Patch | 1 | Code patching techniques |
| 09 | AV Evasion | 1 | AI-powered evasion |
Sample hash/type/protection → Ghidra static → x64dbg/Frida/Procmon dynamic
→ Unpack/config recovery → IOC → YARA/Sigma → Patch copy → Report
triage_pe · ghidra_headless_analyze · ghidra_summary_* · make_x64dbg_breakpoint_script · sample_full_workup · make_yara_stub · make_sigma_stub · patch_pe_bytes