Collaborative RCE Tool Library - Test and Sandbox Environments (including sub-categories)

Tool Added: Pokas x86 Emulator for Generic Unpacking

Sun, 18 Jul 2010 16:32:01 GMT

Listed in categories: Assembler IDE Tools, Assemblers, Automated Unpackers, Debuggers, Disassembler Libraries, Disassemblers, OEP Finders, PE Executable Editors, Programming Libraries, Tracers, Unpacking Tools, Virtual Machines, X86 Disassembler Libraries, X86 Emulators, X86 Sandboxes

Most recent version:
1.0.0.0

Most recent release date:
July 18, 2010

Description:
Pokas x86 Emulator is an Application-Only emulator created for generic unpacking and testing the antivirus detection algorithms.
This Emulator has many features some of them are:
1. Has an assembler and a disassembler from and to mnemonics.
2. Support adding new APIs and adding the emulation function to them.
3. Support a very powerful debugger that has a parser that parses the condition you give and create a very fast native code that perform the check on this condition.
4. Support seh and support tib, teb, peb and peb_ldr_data.
5. It monitors all the memory writes and log up to 10 previous Eips and saves the last accessed and the last modified place in memory.
6. it support 6 APIs:GetModuleHandleA, LoadLibrayA, GetProcAddress, VirtualAlloc, VirtualFree and VirtualProtect.
7. With all of these it's FREE and open source.

It successfully emulates:
1. UPX
2. FSG
3. MEW
4. Aspack
5. PECompact
6. Morphine

But it does contain bugs and it still in the beta version. It surely will be fixed soon ith the help of your feedback.

It still doesn't support multithreading and doesn't support Linux ELF executables.
It's still working only on windows but the Linux version will be available soon.

you can download it from https://sourceforge.net/projects/x86emu/

AmrThabet
amr.thabet_*at*_student.alx.edu.eg

Tool Updated: VMware Server

Sun, 21 Feb 2010 12:39:57 GMT

Listed in categories: Virtual Machines

Most recent version:
2.0.2

Most recent release date:
October 26, 2009

Description:
The free VMware Server is based upon VMware's proven virtualization technology. With this robust yet easy to use software you can:

* Streamline software development and testing by allowing developers to create multiple environments with different operating systems on the same server.
* Simplify IT testing of patches, new applications and operating systems by allowing systems administrators to test in secure virtual machines and be able to roll back to a clean state by leveraging snapshots.
* Simplify server provisioning by building a virtual machine once and deploying it multiple times.
* Evaluate software in ready-to-run virtual machines without installation and configuration.
* Re-host legacy operating systems such as Windows NT Server 4.0 and Windows 2000 Server in a virtual machine running on new hardware and operating system.
* Leverage pre-built, ready-to-run virtual appliances that include virtual hardware, operating system and application environments. Virtual appliances for Web, file, print, DNS, email, proxy and other infrastructure services are available for download on Virtual Appliance Marketplace.

Tool Added: Buster Sandbox Analyzer

Mon, 07 Dec 2009 01:55:12 GMT

Listed in categories: File Monitoring Tools, File System Diff Tools, Network Monitoring Tools, Registry Diff Tools, Registry Monitoring Tools, X86 Sandboxes

Most recent version:
1.03

Most recent release date:
December 07, 2009

Description:
Buster Sandbox Analyzer is a tool that has been designed to analyze the behaviour of sandboxed processes and the changes made to system and then evaluate if they are malware suspicious.

The changes made to system can be of several types: file system changes, registry changes and port changes.

A file system change happens when a file is created, deleted or modified. Depending of what type of file has been created (executable, library, javascript, batch, etc) and where was created (what folder) we will be able to get valuable information.

Registry changes are those changes made to Windows registry. In this case we will be able to get valuable information from the modified value keys and the new created or deleted registry keys.

Port changes are produced when a connection is done outside, to other computers, or a port is opened locally and this port starts listening for incoming connections.

From all these changes we will obtain necessary information to evaluate the "risk" of some of the actions taken by sandboxed applications.

Watching all these operations in an easy and safe manner is possible thanks to Sandboxie (http://sandboxie.com), an excellent tool created by Ronen Tzur.

Even if Buster Sandbox Analyzer´s main goal is to consider if sandboxed processes have a malware behaviour, the tool can be used also to simply obtain a list of changes made to system, so if you install a software you will know exactly what installs and where.

Additionally apart of system changes we can consider other actions as malware suspicious: keyboard logging, end the Windows session, load a driver, start a service, connect to Internet, etc.

All the above operations can be considered as not malicious but if they are performed when it´s not expected, that´s something we must take in consideration. Therefore it´s not only important to consider what actions are performed. It´s also important to consider if it´s reasonable certain actions are performed.

Tool Updated: Sandboxie

Mon, 07 Dec 2009 01:54:02 GMT

Listed in categories: File Monitoring Tools, File System Diff Tools, Network Monitoring Tools, Registry Diff Tools, Registry Monitoring Tools, X86 Sandboxes

Most recent version:
3.42

Most recent release date:
December 1, 2009

Description:
Sandboxie runs your programs in an isolated space which prevents them from making permanent changes to other programs and data in your computer.

You can also access all the changes that were made during the program execution.

Tool Updated: VirusTotal

Fri, 27 Mar 2009 15:08:34 GMT

Listed in categories: Online Multi Engine AV Scanners

Most recent version:

Most recent release date:

Description:
VirusTotal is a service that analyzes suspicious files and facilitates the quick detection of viruses, worms, trojans, and all kinds of malware detected by antivirus engines.

Specs:

* Free, independent service
* Use of multiple antivirus engines
* Real-time automatic updates of virus signatures
* Detailed results from each antivirus engine
* Real time global statistics

Tool Updated: VirSCAN

Fri, 27 Mar 2009 15:08:22 GMT

Listed in categories: Online Multi Engine AV Scanners

Most recent version:

Most recent release date:

Description:
VirSCAN.org is a FREE on-line scan service, which checks uploaded files for malware, using antivirus engines, indicated in the VirSCAN list. On uploading files you want to be checked , you can see the result of scanning and the degree of uploaded files being dangerous.

Tool Updated: NoVirusThanks

Fri, 27 Mar 2009 15:08:13 GMT

Listed in categories: Online Multi Engine AV Scanners

Most recent version:

Most recent release date:

Description:
If you have a suspicious file you can submit it and our system will analyze your file with 24 AntiVirus Engines and will report back the analysis report.

Tool Added: Joebox

Thu, 26 Mar 2009 20:06:46 GMT

Listed in categories: X86 Sandboxes

Most recent version:

Most recent release date:

Description:
Joebox is a simple sandbox application with a unique special concept. It is designed for automatic behaviour analysis of malware on Windows based operating systems.

Key Features:

* Modular design and structure
* XML and HTML based analysis reports
* 100% complete network traffic reports
* Applicable on Windows XP and Windows Vista
* No emulation or virtualization software necessary
* Ability to build and differentiate behaviour baselines
* Scalable to analyse several binaries at once
* Analyses exe, dlls and even sys
* Fully scriptable
* Simply extensible
* Highly configurable

Tool Updated: Anubis

Thu, 26 Mar 2009 20:01:27 GMT

Listed in categories: X86 Sandboxes

Most recent version:

Most recent release date:

Description:
Anubis is a service for analyzing malware. Submit your Windows executable and receive an analysis report telling you what it does.

Tool Added: ThreatExpert

Thu, 26 Mar 2009 19:57:26 GMT

Listed in categories: X86 Sandboxes

Most recent version:

Most recent release date:

Description:
ThreatExpert is an advanced automated threat analysis system designed to analyze and report the behavior of computer viruses, worms, trojans, adware, spyware, and other security-related risks in a fully automated mode.

In only a few minutes ThreatExpert can process a sample and generate a highly detailed threat report with the level of technical detail that matches or exceeds antivirus industry standards such as those normally found in online virus encyclopedias.

Good behavioral analysis!

Tool Updated: Bochs

Fri, 03 Oct 2008 13:58:34 GMT

Listed in categories: X86 Emulators

Most recent version:
2.3.7

Most recent release date:
June 3, 2008

Description:
Bochs is a highly portable open source IA-32 (x86) PC emulator written in C++, that runs on most popular platforms. It includes emulation of the Intel x86 CPU, common I/O devices, and a custom BIOS. Currently, Bochs can be compiled to emulate a 386, 486, Pentium/PentiumII/PentiumIII/Pentium4 or x86-64 CPU including optional MMX, SSEx and 3DNow! instructions.
Bochs is capable of running most Operating Systems inside the emulation including Linux, DOS, Windows® 95/98 and Windows® NT/2000/XP or Windows Vista. Bochs was written by Kevin Lawton and is currently maintained by this project.
Bochs can be compiled and used in a variety of modes, some which are still in development. The 'typical' use of bochs is to provide complete x86 PC emulation, including the x86 processor, hardware devices, and memory. This allows you to run OS's and software within the emulator on your workstation, much like you have a machine inside of a machine. For instance, let's say your workstation is a Unix/X11 workstation, but you want to run Win'95 applications. Bochs will allow you to run Win 95 and associated software on your Unix/X11 workstation, displaying a window on your workstation, simulating a monitor on a PC.

Tool Updated: VirtualBox

Fri, 22 Feb 2008 20:46:36 GMT

Listed in categories: Virtual Machines

Most recent version:
1.5.6

Most recent release date:
Feb 19, 2008

Description:
Innotek VirtualBox is a family of powerful x86 virtualization products for enterprise as well as home use. Not only is VirtualBox an extremely feature rich, high performance product for enterprise customers, it is also the only professional solution that is freely available as Open Source Software under the terms of the GNU General Public License (GPL).

Presently, VirtualBox runs on Windows, Linux and Macintosh hosts and supports a large number of guest operating systems including but not limited to Windows (NT 4.0, 2000, XP, Server 2003, Vista), DOS/Windows 3.x, Linux (2.4 and 2.6), and OpenBSD.

VirtualBox is being actively developed with frequent releases and has an ever growing list of features, supported guest operating systems and platforms it runs on. VirtualBox is a community effort backed by a dedicated company: everyone is encouraged to contribute while innotek ensures the product always meets professional quality criteria.

Tool Updated: CWSandbox

Sun, 11 Nov 2007 13:56:36 GMT

Listed in categories: X86 Sandboxes

Most recent version:
2.0

Most recent release date:

Description:
CWSandbox - Behavior-based Malware Analysis

Malicious software artifacts like viruses, worms and bots are currently one of the largest threats to the security of the Internet. Upon discovery, such malware must be analyzed to determine the danger which it poses. Because of the speed in which malware spreads and the large number of new malware samples which appear every day, malware analysis calls for automation. CWSandbox is an approach to automatically analyze malware which is based on behavior analysis: malware samples are executed for a finite time in a simulated environment, where all system calls are closely monitored. From these observations, CWSandbox is able to automatically generate a detailed report which greatly simplifies the task of a malware analyst.

Tool Added: Sunbelt Sandbox

Sat, 20 Oct 2007 21:33:17 GMT

Listed in categories: X86 Sandboxes

Most recent version:

Most recent release date:

Description:
Submit a malware sample to our automated sandbox server to see what the malware would do to your computer if it were installed.

Tool Updated: Norman SandBox

Sat, 20 Oct 2007 21:30:02 GMT

Listed in categories: X86 Sandboxes

Most recent version:

Most recent release date:

Description:
Norman Sandbox Information Center (NSIC) is a web site that offers

* Free uploads of program files that you suspect are malicious or infected by malicious components, and instant analysis by Norman SandBox. The result is also sent you by email.
* Comprehensive statistics of files that are uploaded to NSIC during the latest day, week and month. You will then be able to see tendencies in the creation of malicious software.
* In-dept information about the analysis performed by Norman SandBox of each malicious file that is uploaded.
* Search facility in all analyses after Registry keys, file names, etc.

Tool Added: Virtual Server

Sat, 20 Oct 2007 21:22:57 GMT

Listed in categories: Virtual Machines

Most recent version:
2005 R2

Most recent release date:
2006

Description:
Microsoft's virtual machine for servers.

Tool Added: Virtual PC

Sat, 20 Oct 2007 21:21:34 GMT

Listed in categories: Virtual Machines

Most recent version:
2007

Most recent release date:
2007

Description:
Microsoft's virtual machine for workstations. Not as advanced as VMware workstation, but quite fine anyway.

Tool Updated: VMware Workstation

Fri, 19 Oct 2007 18:00:02 GMT

Listed in categories: Virtual Machines

Most recent version:
1.6

Most recent release date:
Summer 2007

Description:
VMware Workstation 6 makes it simple to create and run multiple virtual machines on your desktop or laptop computer. You can convert an existing physical PC into a VMware virtual machine, or create a new virtual machine from scratch. Each virtual machine represents a complete PC, including the processor, memory, network connections and peripheral ports.

VMware Workstation lets you use your virtual machines to run Windows, Linux and a host of other operating systems side-by-side on the same computer. You can switch between operating systems instantly with a click of a mouse, share files between virtual machines with drag-and-drop functionality and access all the peripheral devices you rely on.

Tool Added: XenExpress

Fri, 19 Oct 2007 17:50:11 GMT

Listed in categories: Virtual Machines

Most recent version:
4.0

Most recent release date:
2007

Description:
XenExpress v4 is a free, production-ready virtualization platform that enables everyone to quickly get started with Xen virtualization. Easily installed and seamlessly upgradeable, XenExpress is your on-ramp to Xen and the XenSource v4 product family.

XenExpress v4 offers all of the base performance, tools, and easy to use features of XenEnterprise v4 and is built to run on the broadest range of standard server hardware. It supports dual socket servers with up to 4GB of RAM and can host up to four virtual machines on each system.