ShellForge

"ShellForge is a python program that builds shellcodes from C. It is inspired from Stealth's Hellkit. Some wrapper functions arround system calls are defined in header files. The C program uses them instead of libc calls. ShellForge uses gcc to convert it into assembler. It then modifies it a bit, compiles it, extract code from the object, may encode it and add a loader at the begining." read more...

Website: http://www.secdev.org/projects/shellforge/

Read More

FxCop: A Free Static Code Analysis Tool that Checks .NET managed code

"FxCop is an application that analyzes managed code assemblies (code that targets the .NET Framework common language runtime) and reports information about the assemblies, such as possible design, localization, performance, and security improvements. Many of the issues concern violations of the programming and design rules set forth in the Design Guidelines for Class Library Developers, which are the Microsoft guidelines for writing robust and easily maintainable code by using the .NET Framework. FxCop is intended for class library developers. However, anyone creating applications that should comply with the .NET Framework best practices will benefit. FxCop is also useful as an educational tool for people who are new to the .NET Framework or who are unfamiliar with the .NET Framework Design Guidelines. FxCop is designed to be fully integrated into the software development cycle and is distributed as both a fully featured application that has a graphical user interface (FxCop.exe) for interactive work, and a command-line tool (FxCopCmd.exe) suited for use as part of automated build processes or integrated with Microsoft Visual Studio® .NET as an external tool." read more...

Website1: http://msdn.microsoft.com/en-us/library/bb429476(VS.80).aspx

Website2: FxCop and Code Analysis: Writing Your Own Custom Rules

Read More

SysAnalyzer: An Automated Malcode Analyzer

"SysAnalyzer is an automated malcode run time analysis application that monitors various aspects of system and process states. SysAnalyzer was designed to enable analysts to quickly build a comprehensive report as to the actions a binary takes on a system. SysAnalyzer can automatically monitor and compare: Running Processes, Open Ports, Loaded Drivers, Injected Libraries, Key Registry Changes, APIs called by a target process, File Modifications, HTTP, IRC, and DNS traffic. SysAnalyzer also comes with a ProcessAnalyzer tool which can perform the following tasks: Create a memory dump of target process, parse memory dump for strings, parse strings output for exe, reg, and url references and scan memory dump for known exploit signatures." read more...

Website: http://labs.idefense.com/software/malcode.php

Read More

Portable Executable File Viewer/Disassembler

"PEBrowse Professional is a static-analysis tool and disassembler for Win32/Win64 executables and Microsoft .NET assemblies produced according to the Portable Executable specifications published by Microsoft. For Microsoft Windows Vista, Windows XP, Windows 2000, and others.

With the PEBrowse disassembler, one can open and examine any executable without the need to have it loaded as part of an active process with a debugger. Applications, system DLLs, device-drivers and Microsoft .NET assemblies are all candidates for offline analysis using PEBrowse." read more...

Download:
http://www.smidgeonsoft.com/download/PEBrowse.zip

Read More

OllyDbg - A Powerful Debugger

"OllyDbg is a 32-bit assembler level analyzing debugger for Microsoft Windows. Emphasis on binary code analysis makes it particularly useful in cases where source is unavailable. It predicts contents of registers, recognizes procedures, API calls, switches, tables, constants and strings, locates routines from object files and libraries, allows custom labels and comments in disassembled code, writes patches back to executable file and more." read more...

Website: http://www.OllyDbg.de

Read More