@remnux/mcp-server 0.1.76 → 0.1.78

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (17) hide show
  1. package/data/tools-index.json +1224 -245
  2. package/dist/analysis/summarizer.d.ts +2 -0
  3. package/dist/analysis/summarizer.d.ts.map +1 -1
  4. package/dist/analysis/summarizer.js +1 -1
  5. package/dist/analysis/summarizer.js.map +1 -1
  6. package/dist/handlers/analyze-file.d.ts +2 -0
  7. package/dist/handlers/analyze-file.d.ts.map +1 -1
  8. package/dist/handlers/analyze-file.js +7 -1
  9. package/dist/handlers/analyze-file.js.map +1 -1
  10. package/dist/tools/definitions.d.ts.map +1 -1
  11. package/dist/tools/definitions.js +23 -0
  12. package/dist/tools/definitions.js.map +1 -1
  13. package/dist/tools/registry.d.ts +14 -2
  14. package/dist/tools/registry.d.ts.map +1 -1
  15. package/dist/tools/registry.js +11 -3
  16. package/dist/tools/registry.js.map +1 -1
  17. package/package.json +1 -1
package/data/tools-index.json CHANGED
@@ -1,1665 +1,2644 @@
1
1
  {
2
- "version": "1.0.0",
3
- "updated": "2026-10-07",
2
+ "version": "1.1.0",
3
+ "updated": "2026-10-08",
4
4
  "tools": [
5
5
  {
6
6
  "command": "1768",
7
7
  "name": "1768.py",
8
8
  "category": "Examine Static Properties: Deobfuscation",
9
9
  "description": "Analyze Cobalt Strike beacons.",
10
- "website": "https://blog.didierstevens.com/2021/05/22/update-1768-py-version-0-0-6/"
10
+ "website": "https://blog.didierstevens.com/2021/05/22/update-1768-py-version-0-0-6/",
11
+ "architectures": [
12
+ "amd64",
13
+ "arm64"
14
+ ]
11
15
  },
12
16
  {
13
17
  "command": "7-zip",
14
18
  "name": "7-Zip",
15
19
  "category": "General Utilities",
16
20
  "description": "Compress and decompress files using a variety of algorithms.",
17
- "website": "https://www.7-zip.org"
21
+ "website": "https://www.7-zip.org",
22
+ "architectures": [
23
+ "amd64",
24
+ "arm64"
25
+ ]
18
26
  },
19
27
  {
20
28
  "command": "accept-all-ips",
21
29
  "name": "accept-all-ips",
22
30
  "category": "Explore Network Interactions: Services",
23
31
  "description": "Accept connections to all IPv4 and IPv6 addresses and redirect it to the corresponding local port.",
24
- "website": "https://github.com/REMnux/distro/blob/master/files/accept-all-ips"
32
+ "website": "https://github.com/REMnux/distro/blob/master/files/accept-all-ips",
33
+ "architectures": [
34
+ "amd64",
35
+ "arm64"
36
+ ]
25
37
  },
26
38
  {
27
39
  "command": "aeskeyfinder",
28
40
  "name": "AESKeyFinder",
29
41
  "category": "Perform Memory Forensics",
30
42
  "description": "Find 128-bit and 256-bit AES keys in a memory image.",
31
- "website": "https://citp.princeton.edu/our-work/memory/"
43
+ "website": "https://citp.princeton.edu/our-work/memory/",
44
+ "architectures": [
45
+ "amd64",
46
+ "arm64"
47
+ ]
32
48
  },
33
49
  {
34
50
  "command": "aidebug",
35
51
  "name": "AIDebug",
36
52
  "category": "Statically Analyze Code: General",
37
53
  "description": "AI-assisted malware reverse-engineering debugger with ATT&CK, YARA, IOC, JSON, and analyst report output.",
38
- "website": "https://github.com/anpa1200/AIDebug"
54
+ "website": "https://github.com/anpa1200/AIDebug",
55
+ "architectures": [
56
+ "amd64",
57
+ "arm64"
58
+ ]
39
59
  },
40
60
  {
41
61
  "command": "androguard",
42
62
  "name": "androguard",
43
63
  "category": "Statically Analyze Code: Android",
44
64
  "description": "Examine Android files.",
45
- "website": "https://github.com/androguard/androguard"
65
+ "website": "https://github.com/androguard/androguard",
66
+ "architectures": [
67
+ "amd64",
68
+ "arm64"
69
+ ]
46
70
  },
47
71
  {
48
72
  "command": "androidprojectcreator",
49
73
  "name": "AndroidProjectCreator",
50
74
  "category": "Statically Analyze Code: Android",
51
75
  "description": "Convert an Android APK application file into an Android Studio project for easier analysis.",
52
- "website": "https://maxkersten.nl/projects/androidprojectcreator"
76
+ "website": "https://maxkersten.nl/projects/androidprojectcreator",
77
+ "architectures": [
78
+ "amd64",
79
+ "arm64"
80
+ ]
53
81
  },
54
82
  {
55
83
  "command": "anomy",
56
84
  "name": "Anomy",
57
85
  "category": "Explore Network Interactions: Connecting",
58
86
  "description": "A wrapper around wget, ssh, sftp, ftp, and telnet to route these connections through Tor to anonymize your traffic.",
59
- "website": "https://github.com/izm1chael/Anomy"
87
+ "website": "https://github.com/izm1chael/Anomy",
88
+ "architectures": [
89
+ "amd64",
90
+ "arm64"
91
+ ]
60
92
  },
61
93
  {
62
94
  "command": "apkid",
63
95
  "name": "APKiD",
64
96
  "category": "Statically Analyze Code: Android",
65
97
  "description": "Identify compilers, packers, and obfuscators used to protect Android APK and DEX files.",
66
- "website": "https://github.com/rednaga/APKiD"
98
+ "website": "https://github.com/rednaga/APKiD",
99
+ "architectures": [
100
+ "amd64",
101
+ "arm64"
102
+ ]
67
103
  },
68
104
  {
69
105
  "command": "apktool",
70
106
  "name": "apktool",
71
107
  "category": "Statically Analyze Code: Android",
72
108
  "description": "Reverse-engineer Android APK files.",
73
- "website": "https://ibotpeaches.github.io/Apktool/"
109
+ "website": "https://ibotpeaches.github.io/Apktool/",
110
+ "architectures": [
111
+ "amd64",
112
+ "arm64"
113
+ ]
74
114
  },
75
115
  {
76
116
  "command": "autoit-ripper",
77
117
  "name": "AutoIt-Ripper",
78
118
  "category": "Statically Analyze Code: Scripts",
79
119
  "description": "Extract AutoIt scripts embedded in PE binaries.",
80
- "website": "https://github.com/nazywam/AutoIt-Ripper"
120
+ "website": "https://github.com/nazywam/AutoIt-Ripper",
121
+ "architectures": [
122
+ "amd64",
123
+ "arm64"
124
+ ]
81
125
  },
82
126
  {
83
127
  "command": "baksmali",
84
128
  "name": "baksmali",
85
129
  "category": "Statically Analyze Code: Android",
86
130
  "description": "Disassembler for the dex format used by Dalvik, Android's Java VM implementation.",
87
- "website": "https://bitbucket.org/JesusFreke/smali"
131
+ "website": "https://bitbucket.org/JesusFreke/smali",
132
+ "architectures": [
133
+ "amd64",
134
+ "arm64"
135
+ ]
88
136
  },
89
137
  {
90
138
  "command": "balbuzard",
91
139
  "name": "Balbuzard",
92
140
  "category": "Examine Static Properties: Deobfuscation",
93
141
  "description": "Extract and deobfuscate patterns from suspicious files.",
94
- "website": "https://github.com/digitalsleuth/balbuzard"
142
+ "website": "https://github.com/digitalsleuth/balbuzard",
143
+ "architectures": [
144
+ "amd64",
145
+ "arm64"
146
+ ]
95
147
  },
96
148
  {
97
149
  "command": "base64dump",
98
150
  "name": "base64dump.py",
99
151
  "category": "Examine Static Properties: Deobfuscation",
100
152
  "description": "Locate and decode strings encoded in Base64 and other common encodings.",
101
- "website": "https://blog.didierstevens.com/2020/07/03/update-base64dump-py-version-0-0-12/"
153
+ "website": "https://blog.didierstevens.com/2020/07/03/update-base64dump-py-version-0-0-12/",
154
+ "architectures": [
155
+ "amd64",
156
+ "arm64"
157
+ ]
102
158
  },
103
159
  {
104
160
  "command": "bearparser",
105
161
  "name": "bearparser",
106
162
  "category": "Examine Static Properties: PE Files",
107
163
  "description": "Parse PE file contents.",
108
- "website": "https://github.com/hasherezade/bearparser/wiki"
164
+ "website": "https://github.com/hasherezade/bearparser/wiki",
165
+ "architectures": [
166
+ "amd64",
167
+ "arm64"
168
+ ]
109
169
  },
110
170
  {
111
171
  "command": "binee-binary-emulation-environment",
112
172
  "name": "binee (Binary Emulation Environment)",
113
173
  "category": "Statically Analyze Code: PE Files",
114
174
  "description": "Analyze I/O operations of a suspicious PE file by emulating its execution.",
115
- "website": "https://github.com/carbonblack/binee"
175
+ "website": "https://github.com/carbonblack/binee",
176
+ "architectures": [
177
+ "amd64"
178
+ ],
179
+ "arch_notes": {
180
+ "arm64": "Use speakeasy or qiling instead."
181
+ }
116
182
  },
117
183
  {
118
184
  "command": "binwalk",
119
185
  "name": "binwalk",
120
186
  "category": "Examine Static Properties: General",
121
187
  "description": "Extract and analyze firmware images.",
122
- "website": "https://github.com/ReFirmLabs/binwalk"
188
+ "website": "https://github.com/ReFirmLabs/binwalk",
189
+ "architectures": [
190
+ "amd64",
191
+ "arm64"
192
+ ]
123
193
  },
124
194
  {
125
195
  "command": "box-js",
126
196
  "name": "box-js",
127
197
  "category": "Dynamically Reverse-Engineer Code: Scripts",
128
198
  "description": "Analyze suspicious JavaScript scripts.",
129
- "website": "https://github.com/CapacitorSet/box-js"
199
+ "website": "https://github.com/CapacitorSet/box-js",
200
+ "architectures": [
201
+ "amd64",
202
+ "arm64"
203
+ ]
130
204
  },
131
205
  {
132
206
  "command": "brxorpy",
133
207
  "name": "brxor.py",
134
208
  "category": "Examine Static Properties: Deobfuscation",
135
209
  "description": "Bruteforce XOR'ed strings to find those that are English words.",
136
- "website": "https://github.com/REMnux/distro/blob/master/files/brxor.py"
210
+ "website": "https://github.com/REMnux/distro/blob/master/files/brxor.py",
211
+ "architectures": [
212
+ "amd64",
213
+ "arm64"
214
+ ]
137
215
  },
138
216
  {
139
217
  "command": "bulkextractor",
140
218
  "name": "bulk_extractor",
141
219
  "category": "Examine Static Properties: General",
142
220
  "description": "Extract interesting strings from binary files.",
143
- "website": "https://github.com/simsong/bulk_extractor/"
221
+ "website": "https://github.com/simsong/bulk_extractor/",
222
+ "architectures": [
223
+ "amd64",
224
+ "arm64"
225
+ ]
144
226
  },
145
227
  {
146
228
  "command": "burp-suite-community-edition",
147
229
  "name": "Burp Suite Community Edition",
148
230
  "category": "Explore Network Interactions: Monitoring",
149
231
  "description": "Investigate website interactions using this web proxy.",
150
- "website": "https://portswigger.net"
232
+ "website": "https://portswigger.net",
233
+ "architectures": [
234
+ "amd64",
235
+ "arm64"
236
+ ],
237
+ "arch_notes": {
238
+ "arm64": "The built-in browser doesn't run."
239
+ }
151
240
  },
152
241
  {
153
242
  "command": "bytehist",
154
243
  "name": "Bytehist",
155
244
  "category": "Statically Analyze Code: Unpacking",
156
245
  "description": "Generate byte-usage-histograms for all types of files with a focus on PE files.",
157
- "website": "https://www.cert.at/downloads/software/bytehist_en.html"
246
+ "website": "https://www.cert.at/downloads/software/bytehist_en.html",
247
+ "architectures": [
248
+ "amd64"
249
+ ],
250
+ "arch_notes": {
251
+ "arm64": "No alternative identified."
252
+ }
158
253
  },
159
254
  {
160
255
  "command": "cabextract",
161
256
  "name": "cabextract",
162
257
  "category": "General Utilities",
163
258
  "description": "Extract Microsoft cabinet (cab) files.",
164
- "website": "https://www.cabextract.org.uk"
259
+ "website": "https://www.cabextract.org.uk",
260
+ "architectures": [
261
+ "amd64",
262
+ "arm64"
263
+ ]
165
264
  },
166
265
  {
167
266
  "command": "capa",
168
267
  "name": "capa",
169
268
  "category": "Statically Analyze Code: PE Files",
170
269
  "description": "Detect suspicious capabilities in PE files.",
171
- "website": "https://github.com/mandiant/capa"
270
+ "website": "https://github.com/mandiant/capa",
271
+ "architectures": [
272
+ "amd64",
273
+ "arm64"
274
+ ]
172
275
  },
173
276
  {
174
277
  "command": "cfr",
175
278
  "name": "cfr",
176
279
  "category": "Statically Analyze Code: Java",
177
280
  "description": "Java decompiler.",
178
- "website": "https://www.benf.org/other/cfr/"
281
+ "website": "https://www.benf.org/other/cfr/",
282
+ "architectures": [
283
+ "amd64",
284
+ "arm64"
285
+ ]
179
286
  },
180
287
  {
181
288
  "command": "chepy",
182
289
  "name": "Chepy",
183
290
  "category": "Examine Static Properties: Deobfuscation",
184
291
  "description": "Decode and otherwise analyze data using this command-line tool and Python library.",
185
- "website": "https://github.com/securisec/chepy"
292
+ "website": "https://github.com/securisec/chepy",
293
+ "architectures": [
294
+ "amd64",
295
+ "arm64"
296
+ ]
186
297
  },
187
298
  {
188
299
  "command": "clamav",
189
300
  "name": "ClamAV",
190
301
  "category": "Examine Static Properties: General",
191
302
  "description": "Scan files for malware signatures.",
192
- "website": "https://www.clamav.net"
303
+ "website": "https://www.clamav.net",
304
+ "architectures": [
305
+ "amd64",
306
+ "arm64"
307
+ ]
193
308
  },
194
309
  {
195
310
  "command": "cobalt-strike-configuration-extractor-csce-and-parser",
196
311
  "name": "Cobalt Strike Configuration Extractor (CSCE) and Parser",
197
312
  "category": "Examine Static Properties: Deobfuscation",
198
313
  "description": "Analyze Cobalt Strike beacons.",
199
- "website": "https://github.com/strozfriedberg/cobaltstrike-config-extractor"
314
+ "website": "https://github.com/strozfriedberg/cobaltstrike-config-extractor",
315
+ "architectures": [
316
+ "amd64",
317
+ "arm64"
318
+ ]
200
319
  },
201
320
  {
202
321
  "command": "cs-analyze-processdump",
203
322
  "name": "cs-analyze-processdump.py",
204
323
  "category": "Examine Static Properties: Deobfuscation",
205
324
  "description": "Analyze Cobalt Strike beacon process dumps to detect sleep mask encoding.",
206
- "website": "https://blog.didierstevens.com/2021/11/25/new-tool-cs-analyze-processdump-py/"
325
+ "website": "https://blog.didierstevens.com/2021/11/25/new-tool-cs-analyze-processdump-py/",
326
+ "architectures": [
327
+ "amd64",
328
+ "arm64"
329
+ ]
207
330
  },
208
331
  {
209
332
  "command": "cs-decrypt-metadata",
210
333
  "name": "cs-decrypt-metadata.py",
211
334
  "category": "Examine Static Properties: Deobfuscation",
212
335
  "description": "Decrypt Cobalt Strike metadata.",
213
- "website": "https://blog.didierstevens.com/2021/11/12/update-cs-decrypt-metadata-py-version-0-0-2/"
336
+ "website": "https://blog.didierstevens.com/2021/11/12/update-cs-decrypt-metadata-py-version-0-0-2/",
337
+ "architectures": [
338
+ "amd64",
339
+ "arm64"
340
+ ]
214
341
  },
215
342
  {
216
343
  "command": "cs-extract-key",
217
344
  "name": "cs-extract-key.py",
218
345
  "category": "Examine Static Properties: Deobfuscation",
219
346
  "description": "Extract AES and HMAC keys from Cobalt Strike beacon process memory.",
220
- "website": "https://blog.didierstevens.com/2021/11/03/new-tool-cs-extract-key-py/"
347
+ "website": "https://blog.didierstevens.com/2021/11/03/new-tool-cs-extract-key-py/",
348
+ "architectures": [
349
+ "amd64",
350
+ "arm64"
351
+ ]
221
352
  },
222
353
  {
223
354
  "command": "cs-parse-traffic",
224
355
  "name": "cs-parse-traffic.py",
225
356
  "category": "Explore Network Interactions: Monitoring",
226
357
  "description": "Decrypt and parse Cobalt Strike beacon network traffic.",
227
- "website": "https://blog.didierstevens.com/2021/11/29/new-tool-cs-parse-traffic-py/"
358
+ "website": "https://blog.didierstevens.com/2021/11/29/new-tool-cs-parse-traffic-py/",
359
+ "architectures": [
360
+ "amd64",
361
+ "arm64"
362
+ ]
228
363
  },
229
364
  {
230
365
  "command": "curl",
231
366
  "name": "cURL",
232
367
  "category": "General Utilities",
233
368
  "description": "Interact with servers via supported protocols, including HTTP, HTTPS, FTP, IMAP, etc. using this command-line tool.",
234
- "website": "https://curl.se"
369
+ "website": "https://curl.se",
370
+ "architectures": [
371
+ "amd64",
372
+ "arm64"
373
+ ]
235
374
  },
236
375
  {
237
376
  "command": "cut-bytes",
238
377
  "name": "cut-bytes.py",
239
378
  "category": "Examine Static Properties: Deobfuscation",
240
379
  "description": "Cut out a part of a data stream.",
241
- "website": "https://blog.didierstevens.com/2015/10/14/cut-bytes-py/"
380
+ "website": "https://blog.didierstevens.com/2015/10/14/cut-bytes-py/",
381
+ "architectures": [
382
+ "amd64",
383
+ "arm64"
384
+ ]
242
385
  },
243
386
  {
244
387
  "command": "cutter",
245
388
  "name": "Cutter",
246
389
  "category": "Statically Analyze Code: General",
247
390
  "description": "Reverse engineering platform powered by Rizin.",
248
- "website": "https://cutter.re"
391
+ "website": "https://cutter.re",
392
+ "architectures": [
393
+ "amd64",
394
+ "arm64"
395
+ ]
249
396
  },
250
397
  {
251
398
  "command": "cyberchef",
252
399
  "name": "CyberChef",
253
400
  "category": "Examine Static Properties: Deobfuscation",
254
401
  "description": "Decode and otherwise analyze data using this browser app.",
255
- "website": "https://github.com/gchq/CyberChef/"
402
+ "website": "https://github.com/gchq/CyberChef/",
403
+ "architectures": [
404
+ "amd64",
405
+ "arm64"
406
+ ]
256
407
  },
257
408
  {
258
409
  "command": "dc3-mwcp",
259
410
  "name": "DC3-MWCP",
260
411
  "category": "Examine Static Properties: Deobfuscation",
261
412
  "description": "Parsing configuration information from malware.",
262
- "website": "https://github.com/Defense-Cyber-Crime-Center/DC3-mwcp"
413
+ "website": "https://github.com/Defense-Cyber-Crime-Center/DC3-mwcp",
414
+ "architectures": [
415
+ "amd64",
416
+ "arm64"
417
+ ]
263
418
  },
264
419
  {
265
420
  "command": "debloat",
266
421
  "name": "debloat",
267
422
  "category": "Examine Static Properties: PE Files",
268
423
  "description": "Remove junk contents from bloated Windows executables.",
269
- "website": "https://github.com/Squiblydoo/debloat"
424
+ "website": "https://github.com/Squiblydoo/debloat",
425
+ "architectures": [
426
+ "amd64",
427
+ "arm64"
428
+ ]
270
429
  },
271
430
  {
272
431
  "command": "decode-vbe",
273
432
  "name": "decode-vbe.py",
274
433
  "category": "Statically Analyze Code: Scripts",
275
434
  "description": "Decode encoded VBS scripts (VBE).",
276
- "website": "https://blog.didierstevens.com/2016/03/29/decoding-vbe/"
435
+ "website": "https://blog.didierstevens.com/2016/03/29/decoding-vbe/",
436
+ "architectures": [
437
+ "amd64",
438
+ "arm64"
439
+ ]
277
440
  },
278
441
  {
279
442
  "command": "decompyle",
280
443
  "name": "Decompyle++",
281
444
  "category": "Statically Analyze Code: Python",
282
445
  "description": "Python bytecode disassembler and decompiler.",
283
- "website": "https://github.com/zrax/pycdc"
446
+ "website": "https://github.com/zrax/pycdc",
447
+ "architectures": [
448
+ "amd64",
449
+ "arm64"
450
+ ]
284
451
  },
285
452
  {
286
453
  "command": "detect-it-easy",
287
454
  "name": "Detect-It-Easy",
288
455
  "category": "Examine Static Properties: General",
289
456
  "description": "Determine types of files and examine file properties.",
290
- "website": "https://github.com/horsicq/Detect-It-Easy"
457
+ "website": "https://github.com/horsicq/Detect-It-Easy",
458
+ "architectures": [
459
+ "amd64",
460
+ "arm64"
461
+ ]
291
462
  },
292
463
  {
293
464
  "command": "dex2jar",
294
465
  "name": "dex2jar",
295
466
  "category": "Statically Analyze Code: Android",
296
467
  "description": "Examine Dalvik Executable (dex) files.",
297
- "website": "https://github.com/pxb1988/dex2jar"
468
+ "website": "https://github.com/pxb1988/dex2jar",
469
+ "architectures": [
470
+ "amd64",
471
+ "arm64"
472
+ ]
298
473
  },
299
474
  {
300
475
  "command": "dexray",
301
476
  "name": "DeXRAY",
302
477
  "category": "Gather and Analyze Data",
303
478
  "description": "Extract and decode data from antivirus quarantine files.",
304
- "website": "https://www.hexacorn.com/blog/category/software-releases/dexray/"
479
+ "website": "https://www.hexacorn.com/blog/category/software-releases/dexray/",
480
+ "architectures": [
481
+ "amd64",
482
+ "arm64"
483
+ ]
305
484
  },
306
485
  {
307
486
  "command": "didier-stevens-scripts",
308
487
  "name": "Didier Stevens Scripts",
309
488
  "category": "Examine Static Properties: Deobfuscation",
310
489
  "description": "A collection of Python scripts for analyzing suspicious files and data from Didier Stevens.",
311
- "website": "https://blog.didierstevens.com"
490
+ "website": "https://blog.didierstevens.com",
491
+ "architectures": [
492
+ "amd64",
493
+ "arm64"
494
+ ]
312
495
  },
313
496
  {
314
497
  "command": "disitool",
315
498
  "name": "disitool.py",
316
499
  "category": "Examine Static Properties: PE Files",
317
500
  "description": "Extract, delete, copy, and inject digital signatures in PE files.",
318
- "website": "https://blog.didierstevens.com/programs/disitool/"
501
+ "website": "https://blog.didierstevens.com/programs/disitool/",
502
+ "architectures": [
503
+ "amd64",
504
+ "arm64"
505
+ ]
319
506
  },
320
507
  {
321
508
  "command": "dissect",
322
509
  "name": "dissect",
323
510
  "category": "Gather and Analyze Data",
324
511
  "description": "Perform a variety of forensics and incident response tasks using this DFIR framework and toolset.",
325
- "website": "https://github.com/fox-it/dissect"
512
+ "website": "https://github.com/fox-it/dissect",
513
+ "architectures": [
514
+ "amd64",
515
+ "arm64"
516
+ ]
326
517
  },
327
518
  {
328
519
  "command": "dllcharacteristicspy",
329
520
  "name": "dllcharacteristics.py",
330
521
  "category": "Examine Static Properties: PE Files",
331
522
  "description": "Read and set DLL characteristics of a PE file.",
332
- "website": "https://github.com/accidentalrebel/dllcharacteristics.py"
523
+ "website": "https://github.com/accidentalrebel/dllcharacteristics.py",
524
+ "architectures": [
525
+ "amd64",
526
+ "arm64"
527
+ ]
333
528
  },
334
529
  {
335
530
  "command": "dnfile",
336
531
  "name": "dnfile",
337
532
  "category": "Examine Static Properties: .NET",
338
533
  "description": "Analyze static properties of .NET files.",
339
- "website": "https://github.com/malwarefrank/dnfile"
534
+ "website": "https://github.com/malwarefrank/dnfile",
535
+ "architectures": [
536
+ "amd64",
537
+ "arm64"
538
+ ]
340
539
  },
341
540
  {
342
541
  "command": "dnslib",
343
542
  "name": "dnslib",
344
543
  "category": "Gather and Analyze Data",
345
544
  "description": "Python library to encode/decode DNS wire-format packets.",
346
- "website": "https://github.com/paulc/dnslib"
545
+ "website": "https://github.com/paulc/dnslib",
546
+ "architectures": [
547
+ "amd64",
548
+ "arm64"
549
+ ]
347
550
  },
348
551
  {
349
552
  "command": "dnsresolver",
350
553
  "name": "dnsresolver.py",
351
554
  "category": "Explore Network Interactions: Services",
352
555
  "description": "DNS resolver tool for dynamic analysis with wildcard and tracking support.",
353
- "website": "https://blog.didierstevens.com/2021/07/15/new-tool-dnsresolver-py/"
556
+ "website": "https://blog.didierstevens.com/2021/07/15/new-tool-dnsresolver-py/",
557
+ "architectures": [
558
+ "amd64",
559
+ "arm64"
560
+ ]
354
561
  },
355
562
  {
356
563
  "command": "docker",
357
564
  "name": "Docker",
358
565
  "category": "General Utilities",
359
566
  "description": "Run and manage containers.",
360
- "website": "https://www.docker.com"
567
+ "website": "https://www.docker.com",
568
+ "architectures": [
569
+ "amd64",
570
+ "arm64"
571
+ ]
361
572
  },
362
573
  {
363
574
  "command": "dos2unix",
364
575
  "name": "dos2unix",
365
576
  "category": "View or Edit Files",
366
577
  "description": "Convert text files with Windows or macOS line breaks to Unix line breaks and vice versa.",
367
- "website": "https://waterlan.home.xs4all.nl/dos2unix.html"
578
+ "website": "https://waterlan.home.xs4all.nl/dos2unix.html",
579
+ "architectures": [
580
+ "amd64",
581
+ "arm64"
582
+ ]
368
583
  },
369
584
  {
370
585
  "command": "dotnetfile",
371
586
  "name": "dotnetfile",
372
587
  "category": "Examine Static Properties: .NET",
373
588
  "description": "Analyze static properties of .NET files.",
374
- "website": "https://github.com/pan-unit42/dotnetfile"
589
+ "website": "https://github.com/pan-unit42/dotnetfile",
590
+ "architectures": [
591
+ "amd64",
592
+ "arm64"
593
+ ]
375
594
  },
376
595
  {
377
596
  "command": "droidlysis",
378
597
  "name": "DroidLysis",
379
598
  "category": "Statically Analyze Code: Android",
380
599
  "description": "Perform static analysis of Android applications.",
381
- "website": "https://github.com/cryptax/droidlysis"
600
+ "website": "https://github.com/cryptax/droidlysis",
601
+ "architectures": [
602
+ "amd64",
603
+ "arm64"
604
+ ]
382
605
  },
383
606
  {
384
607
  "command": "edb",
385
608
  "name": "edb",
386
609
  "category": "Dynamically Reverse-Engineer Code: ELF Files",
387
610
  "description": "An AArch32/x86/x86-64 debugger, well suited for debugging ELF files.",
388
- "website": "https://github.com/eteran/edb-debugger"
611
+ "website": "https://github.com/eteran/edb-debugger",
612
+ "architectures": [
613
+ "amd64"
614
+ ],
615
+ "arch_notes": {
616
+ "arm64": "Use gdb or radare2 instead."
617
+ }
389
618
  },
390
619
  {
391
620
  "command": "emldump",
392
621
  "name": "emldump.py",
393
622
  "category": "Analyze Documents: Email Messages",
394
623
  "description": "Parse and analyze EML files.",
395
- "website": "https://blog.didierstevens.com/2020/11/29/update-emldump-py-version-0-0-11/"
624
+ "website": "https://blog.didierstevens.com/2020/11/29/update-emldump-py-version-0-0-11/",
625
+ "architectures": [
626
+ "amd64",
627
+ "arm64"
628
+ ]
396
629
  },
397
630
  {
398
631
  "command": "epic-irc-client",
399
632
  "name": "EPIC IRC Client",
400
633
  "category": "Explore Network Interactions: Connecting",
401
634
  "description": "Examine IRC activities with this IRC client.",
402
- "website": "https://www.epicsol.org/"
635
+ "website": "https://www.epicsol.org/",
636
+ "architectures": [
637
+ "amd64",
638
+ "arm64"
639
+ ]
403
640
  },
404
641
  {
405
642
  "command": "etl-parser",
406
643
  "name": "etl-parser",
407
644
  "category": "Gather and Analyze Data",
408
645
  "description": "Parse Windows Event Trace Log (ETL) files.",
409
- "website": "https://github.com/airbus-cert/etl-parser"
646
+ "website": "https://github.com/airbus-cert/etl-parser",
647
+ "architectures": [
648
+ "amd64",
649
+ "arm64"
650
+ ]
410
651
  },
411
652
  {
412
653
  "command": "evilclippy",
413
654
  "name": "EvilClippy",
414
655
  "category": "Analyze Documents: Microsoft Office",
415
656
  "description": "Modify aspects of Microsoft Office documents.",
416
- "website": "https://github.com/outflanknl/EvilClippy"
657
+ "website": "https://github.com/outflanknl/EvilClippy",
658
+ "architectures": [
659
+ "amd64",
660
+ "arm64"
661
+ ]
417
662
  },
418
663
  {
419
664
  "command": "evince",
420
665
  "name": "Evince",
421
666
  "category": "View or Edit Files",
422
667
  "description": "View documents in a variety of formats, including PDF.",
423
- "website": "https://wiki.gnome.org/Apps/Evince"
668
+ "website": "https://wiki.gnome.org/Apps/Evince",
669
+ "architectures": [
670
+ "amd64",
671
+ "arm64"
672
+ ]
424
673
  },
425
674
  {
426
675
  "command": "exiftool",
427
676
  "name": "ExifTool",
428
677
  "category": "Examine Static Properties: General",
429
678
  "description": "Tool to read from, write to, and edit EXIF metadata of various file types.",
430
- "website": "https://exiftool.org/"
679
+ "website": "https://exiftool.org/",
680
+ "architectures": [
681
+ "amd64",
682
+ "arm64"
683
+ ]
431
684
  },
432
685
  {
433
686
  "command": "expexorpy",
434
687
  "name": "ex_pe_xor.py",
435
688
  "category": "Examine Static Properties: Deobfuscation",
436
689
  "description": "Search an XOR'ed file for indications of executable binaries.",
437
- "website": "https://hooked-on-mnemonics.blogspot.com/2014/04/expexorpy.html"
690
+ "website": "https://hooked-on-mnemonics.blogspot.com/2014/04/expexorpy.html",
691
+ "architectures": [
692
+ "amd64",
693
+ "arm64"
694
+ ]
438
695
  },
439
696
  {
440
697
  "command": "fakedns",
441
698
  "name": "fakedns",
442
699
  "category": "Explore Network Interactions: Services",
443
700
  "description": "Respond to DNS queries with the specified IP address.",
444
- "website": "https://github.com/SocialExploits/fakedns/blob/main/fakedns.py"
701
+ "website": "https://github.com/SocialExploits/fakedns/blob/main/fakedns.py",
702
+ "architectures": [
703
+ "amd64",
704
+ "arm64"
705
+ ]
445
706
  },
446
707
  {
447
708
  "command": "fakemail",
448
709
  "name": "fakemail",
449
710
  "category": "Explore Network Interactions: Services",
450
711
  "description": "Intercept and examine SMTP email activity with this fake SMTP server.",
451
- "website": "https://hg.sr.ht/~olly/fakemail"
712
+ "website": "https://hg.sr.ht/~olly/fakemail",
713
+ "architectures": [
714
+ "amd64",
715
+ "arm64"
716
+ ]
452
717
  },
453
718
  {
454
719
  "command": "fakenet-ng",
455
720
  "name": "FakeNet-NG",
456
721
  "category": "Explore Network Interactions: Services",
457
722
  "description": "Emulate common network services and interact with malware.",
458
- "website": "https://github.com/mandiant/flare-fakenet-ng"
723
+ "website": "https://github.com/mandiant/flare-fakenet-ng",
724
+ "architectures": [
725
+ "amd64",
726
+ "arm64"
727
+ ]
459
728
  },
460
729
  {
461
730
  "command": "feh",
462
731
  "name": "feh",
463
732
  "category": "View or Edit Files",
464
733
  "description": "View images.",
465
- "website": "https://feh.finalrewind.org"
734
+ "website": "https://feh.finalrewind.org",
735
+ "architectures": [
736
+ "amd64",
737
+ "arm64"
738
+ ]
466
739
  },
467
740
  {
468
741
  "command": "file",
469
742
  "name": "file",
470
743
  "category": "Examine Static Properties: General",
471
744
  "description": "Identify file type using \"magic\" numbers.",
472
- "website": "https://github.com/file/file"
745
+ "website": "https://github.com/file/file",
746
+ "architectures": [
747
+ "amd64",
748
+ "arm64"
749
+ ]
473
750
  },
474
751
  {
475
752
  "command": "file-magic",
476
753
  "name": "file-magic.py",
477
754
  "category": "Examine Static Properties: General",
478
755
  "description": "Identify file types using the Python magic module.",
479
- "website": "https://blog.didierstevens.com/2018/07/11/new-tool-file-magic-py/"
756
+ "website": "https://blog.didierstevens.com/2018/07/11/new-tool-file-magic-py/",
757
+ "architectures": [
758
+ "amd64",
759
+ "arm64"
760
+ ]
480
761
  },
481
762
  {
482
763
  "command": "firefox",
483
764
  "name": "Firefox",
484
765
  "category": "General Utilities",
485
766
  "description": "Web browser.",
486
- "website": "https://www.mozilla.org/firefox/"
767
+ "website": "https://www.mozilla.org/firefox/",
768
+ "architectures": [
769
+ "amd64",
770
+ "arm64"
771
+ ]
487
772
  },
488
773
  {
489
774
  "command": "floss",
490
775
  "name": "FLOSS",
491
776
  "category": "Examine Static Properties: Deobfuscation",
492
777
  "description": "Extract and deobfuscate strings from PE executables.",
493
- "website": "https://github.com/mandiant/flare-floss"
778
+ "website": "https://github.com/mandiant/flare-floss",
779
+ "architectures": [
780
+ "amd64",
781
+ "arm64"
782
+ ]
494
783
  },
495
784
  {
496
785
  "command": "format-bytes",
497
786
  "name": "format-bytes.py",
498
787
  "category": "Examine Static Properties: Deobfuscation",
499
788
  "description": "Decompose structured binary data with format strings.",
500
- "website": "https://blog.didierstevens.com/2020/02/17/update-format-bytes-py-version-0-0-13/"
789
+ "website": "https://blog.didierstevens.com/2020/02/17/update-format-bytes-py-version-0-0-13/",
790
+ "architectures": [
791
+ "amd64",
792
+ "arm64"
793
+ ]
501
794
  },
502
795
  {
503
796
  "command": "frida",
504
797
  "name": "Frida",
505
798
  "category": "Dynamically Reverse-Engineer Code: General",
506
799
  "description": "Trace the execution of a process to analyze its behavior.",
507
- "website": "https://frida.re"
800
+ "website": "https://frida.re",
801
+ "architectures": [
802
+ "amd64",
803
+ "arm64"
804
+ ]
508
805
  },
509
806
  {
510
807
  "command": "ghidra",
511
808
  "name": "Ghidra",
512
809
  "category": "Statically Analyze Code: General",
513
810
  "description": "Software reverse engineering tool suite.",
514
- "website": "https://ghidra-sre.org"
811
+ "website": "https://ghidra-sre.org",
812
+ "architectures": [
813
+ "amd64",
814
+ "arm64"
815
+ ],
816
+ "arch_notes": {
817
+ "arm64": "Ghidra can't open 7-Zip archives."
818
+ }
515
819
  },
516
820
  {
517
821
  "command": "ghidrassistmcp",
518
822
  "name": "GhidrAssistMCP",
519
823
  "category": "Use Artificial Intelligence",
520
824
  "description": "MCP server for AI-assisted reverse engineering in Ghidra.",
521
- "website": "https://github.com/jtang613/GhidrAssistMCP"
825
+ "website": "https://github.com/jtang613/GhidrAssistMCP",
826
+ "architectures": [
827
+ "amd64",
828
+ "arm64"
829
+ ]
522
830
  },
523
831
  {
524
832
  "command": "gnome-calculator",
525
833
  "name": "GNOME Calculator",
526
834
  "category": "General Utilities",
527
835
  "description": "Calculator.",
528
- "website": "https://wiki.gnome.org/Apps/Calculator"
836
+ "website": "https://wiki.gnome.org/Apps/Calculator",
837
+ "architectures": [
838
+ "amd64",
839
+ "arm64"
840
+ ]
529
841
  },
530
842
  {
531
843
  "command": "gnu-project-debugger",
532
844
  "name": "GNU Project Debugger",
533
845
  "category": "Dynamically Reverse-Engineer Code: ELF Files",
534
846
  "description": "Multi-language debugger.",
535
- "website": "https://www.sourceware.org/gdb/"
847
+ "website": "https://www.sourceware.org/gdb/",
848
+ "architectures": [
849
+ "amd64",
850
+ "arm64"
851
+ ]
536
852
  },
537
853
  {
538
854
  "command": "gnu-wget",
539
855
  "name": "GNU Wget",
540
856
  "category": "Explore Network Interactions: Connecting",
541
857
  "description": "Interact with servers via HTTP, HTTPS, FTP, and FTPS using this command-line tool.",
542
- "website": "https://www.gnu.org/software/wget/"
858
+ "website": "https://www.gnu.org/software/wget/",
859
+ "architectures": [
860
+ "amd64",
861
+ "arm64"
862
+ ]
543
863
  },
544
864
  {
545
865
  "command": "gootloader-decode",
546
866
  "name": "GootLoaderAutoJsDecode.py",
547
867
  "category": "Statically Analyze Code: Scripts",
548
868
  "description": "Statically deobfuscate GootLoader (GOOTLOADER) malicious JScript to recover the payload and extract C2 domains.",
549
- "website": "https://github.com/mandiant/gootloader"
869
+ "website": "https://github.com/mandiant/gootloader",
870
+ "architectures": [
871
+ "amd64",
872
+ "arm64"
873
+ ]
550
874
  },
551
875
  {
552
876
  "command": "goresym",
553
877
  "name": "GoReSym",
554
878
  "category": "Examine Static Properties: Go",
555
879
  "description": "Extract metadata and symbols from Go binaries, including stripped ones.",
556
- "website": "https://github.com/mandiant/GoReSym"
880
+ "website": "https://github.com/mandiant/GoReSym",
881
+ "architectures": [
882
+ "amd64",
883
+ "arm64"
884
+ ]
557
885
  },
558
886
  {
559
887
  "command": "hachoir",
560
888
  "name": "Hachoir",
561
889
  "category": "Examine Static Properties: General",
562
890
  "description": "View, edit, and carve contents of various binary file types.",
563
- "website": "https://github.com/vstinner/hachoir"
891
+ "website": "https://github.com/vstinner/hachoir",
892
+ "architectures": [
893
+ "amd64",
894
+ "arm64"
895
+ ]
564
896
  },
565
897
  {
566
898
  "command": "hex-to-bin",
567
899
  "name": "hex-to-bin.py",
568
900
  "category": "Examine Static Properties: Deobfuscation",
569
901
  "description": "Convert hexadecimal text dumps to binary data.",
570
- "website": "https://blog.didierstevens.com/2020/04/19/update-hex-to-bin-py-version-0-0-5/"
902
+ "website": "https://blog.didierstevens.com/2020/04/19/update-hex-to-bin-py-version-0-0-5/",
903
+ "architectures": [
904
+ "amd64",
905
+ "arm64"
906
+ ]
571
907
  },
572
908
  {
573
909
  "command": "ibus",
574
910
  "name": "IBus",
575
911
  "category": "General Utilities",
576
912
  "description": "Adjust input methods for the GUI.",
577
- "website": "https://github.com/ibus/ibus"
913
+ "website": "https://github.com/ibus/ibus",
914
+ "architectures": [
915
+ "amd64",
916
+ "arm64"
917
+ ]
578
918
  },
579
919
  {
580
920
  "command": "ilspy",
581
921
  "name": "ILSpy",
582
922
  "category": "Statically Analyze Code: .NET",
583
923
  "description": "Examine and decompile .NET programs.",
584
- "website": "https://github.com/icsharpcode/ILSpy"
924
+ "website": "https://github.com/icsharpcode/ILSpy",
925
+ "architectures": [
926
+ "amd64",
927
+ "arm64"
928
+ ]
585
929
  },
586
930
  {
587
931
  "command": "imagemagick",
588
932
  "name": "ImageMagick",
589
933
  "category": "View or Edit Files",
590
934
  "description": "View and manipulate image and related files.",
591
- "website": "https://imagemagick.org/"
935
+ "website": "https://imagemagick.org/",
936
+ "architectures": [
937
+ "amd64",
938
+ "arm64"
939
+ ]
592
940
  },
593
941
  {
594
942
  "command": "inetsim",
595
943
  "name": "INetSim",
596
944
  "category": "Explore Network Interactions: Services",
597
945
  "description": "Emulate common network services and interact with malware.",
598
- "website": "https://www.inetsim.org/"
946
+ "website": "https://www.inetsim.org/",
947
+ "architectures": [
948
+ "amd64",
949
+ "arm64"
950
+ ]
599
951
  },
600
952
  {
601
953
  "command": "info-zip",
602
954
  "name": "Info-ZIP",
603
955
  "category": "General Utilities",
604
956
  "description": "Compress and decompress files using the zip algorithm.",
605
- "website": "http://infozip.sourceforge.net"
957
+ "website": "http://infozip.sourceforge.net",
958
+ "architectures": [
959
+ "amd64",
960
+ "arm64"
961
+ ]
606
962
  },
607
963
  {
608
964
  "command": "inspircd-3",
609
965
  "name": "inspircd 3",
610
966
  "category": "Explore Network Interactions: Services",
611
967
  "description": "Examine IRC activity with this IRC server.",
612
- "website": "https://www.inspircd.org/"
968
+ "website": "https://www.inspircd.org/",
969
+ "architectures": [
970
+ "amd64",
971
+ "arm64"
972
+ ]
613
973
  },
614
974
  {
615
975
  "command": "iocparser",
616
976
  "name": "ioc_parser",
617
977
  "category": "Gather and Analyze Data",
618
978
  "description": "Extract IOCs from security report PDFs.",
619
- "website": "https://github.com/buffer/ioc_parser"
979
+ "website": "https://github.com/buffer/ioc_parser",
980
+ "architectures": [
981
+ "amd64",
982
+ "arm64"
983
+ ]
620
984
  },
621
985
  {
622
986
  "command": "ipwhois",
623
987
  "name": "ipwhois",
624
988
  "category": "Gather and Analyze Data",
625
989
  "description": "Retrieve and parse whois data for IP addresses.",
626
- "website": "https://github.com/secynic/ipwhois"
990
+ "website": "https://github.com/secynic/ipwhois",
991
+ "architectures": [
992
+ "amd64",
993
+ "arm64"
994
+ ]
627
995
  },
628
996
  {
629
997
  "command": "jadx",
630
998
  "name": "JADX",
631
999
  "category": "Statically Analyze Code: Android",
632
1000
  "description": "Generate Java source code from Dalvik Executable (dex) and Android APK files.",
633
- "website": "https://github.com/skylot/jadx"
1001
+ "website": "https://github.com/skylot/jadx",
1002
+ "architectures": [
1003
+ "amd64",
1004
+ "arm64"
1005
+ ]
634
1006
  },
635
1007
  {
636
1008
  "command": "java-idx-parser",
637
1009
  "name": "Java IDX Parser",
638
1010
  "category": "Statically Analyze Code: Java",
639
1011
  "description": "Analyze Java IDX files.",
640
- "website": "https://github.com/digitalsleuth/Java_IDX_Parser"
1012
+ "website": "https://github.com/digitalsleuth/Java_IDX_Parser",
1013
+ "architectures": [
1014
+ "amd64",
1015
+ "arm64"
1016
+ ]
641
1017
  },
642
1018
  {
643
1019
  "command": "javassist",
644
1020
  "name": "Javassist",
645
1021
  "category": "Statically Analyze Code: Java",
646
1022
  "description": "Java bytecode engineering toolkit/library.",
647
- "website": "https://www.javassist.org/"
1023
+ "website": "https://www.javassist.org/",
1024
+ "architectures": [
1025
+ "amd64",
1026
+ "arm64"
1027
+ ]
648
1028
  },
649
1029
  {
650
1030
  "command": "jd-gui-java-decompiler",
651
1031
  "name": "JD-GUI Java Decompiler",
652
1032
  "category": "Statically Analyze Code: Java",
653
1033
  "description": "Java decompiler with GUI.",
654
- "website": "https://java-decompiler.github.io/"
1034
+ "website": "https://java-decompiler.github.io/",
1035
+ "architectures": [
1036
+ "amd64",
1037
+ "arm64"
1038
+ ]
655
1039
  },
656
1040
  {
657
1041
  "command": "js-beautifier",
658
1042
  "name": "JS Beautifier",
659
1043
  "category": "Statically Analyze Code: Scripts",
660
1044
  "description": "Reformat JavaScript scripts for easier analysis.",
661
- "website": "https://beautifier.io/"
1045
+ "website": "https://beautifier.io/",
1046
+ "architectures": [
1047
+ "amd64",
1048
+ "arm64"
1049
+ ]
662
1050
  },
663
1051
  {
664
1052
  "command": "js-deobfuscator",
665
1053
  "name": "JavaScript Deobfuscator",
666
1054
  "category": "Dynamically Reverse-Engineer Code: Scripts",
667
1055
  "description": "Deobfuscate JavaScript by removing common obfuscation techniques such as string arrays and proxy functions.",
668
- "website": "https://github.com/ben-sb/javascript-deobfuscator"
1056
+ "website": "https://github.com/ben-sb/javascript-deobfuscator",
1057
+ "architectures": [
1058
+ "amd64",
1059
+ "arm64"
1060
+ ]
669
1061
  },
670
1062
  {
671
1063
  "command": "js_unshroud",
672
1064
  "name": "js_unshroud",
673
1065
  "category": "Dynamically Reverse-Engineer Code: Scripts",
674
1066
  "description": "Monitor and deobfuscate JavaScript behavior in a headless browser to analyze malicious web pages.",
675
- "website": "https://github.com/edygert/js_unshroud"
1067
+ "website": "https://github.com/edygert/js_unshroud",
1068
+ "architectures": [
1069
+ "amd64"
1070
+ ],
1071
+ "arch_notes": {
1072
+ "arm64": "No alternative identified."
1073
+ }
676
1074
  },
677
1075
  {
678
1076
  "command": "jstillery",
679
1077
  "name": "JStillery",
680
1078
  "category": "Dynamically Reverse-Engineer Code: Scripts",
681
1079
  "description": "Deobfuscate JavaScript scripts using AST and Partial Evaluation techniques.",
682
- "website": "https://github.com/mindedsecurity/jstillery"
1080
+ "website": "https://github.com/mindedsecurity/jstillery",
1081
+ "architectures": [
1082
+ "amd64",
1083
+ "arm64"
1084
+ ]
683
1085
  },
684
1086
  {
685
1087
  "command": "libemu",
686
1088
  "name": "libemu",
687
1089
  "category": "Dynamically Reverse-Engineer Code: Shellcode",
688
1090
  "description": "A library for x86 code emulation and shellcode detection.",
689
- "website": "https://github.com/buffer/libemu"
1091
+ "website": "https://github.com/buffer/libemu",
1092
+ "architectures": [
1093
+ "amd64",
1094
+ "arm64"
1095
+ ]
690
1096
  },
691
1097
  {
692
1098
  "command": "libolecf",
693
1099
  "name": "libolecf",
694
1100
  "category": "Analyze Documents: Microsoft Office",
695
1101
  "description": "Microsoft Office OLE2 compound documents.",
696
- "website": "https://github.com/libyal/libolecf"
1102
+ "website": "https://github.com/libyal/libolecf",
1103
+ "architectures": [
1104
+ "amd64",
1105
+ "arm64"
1106
+ ]
697
1107
  },
698
1108
  {
699
1109
  "command": "lief",
700
1110
  "name": "LIEF",
701
1111
  "category": "Examine Static Properties: General",
702
1112
  "description": "Parse and analyze PE, ELF, MachO, DEX, OAT, VDEX, ART, and DWARF executable formats.",
703
- "website": "https://lief.re"
1113
+ "website": "https://lief.re",
1114
+ "architectures": [
1115
+ "amd64",
1116
+ "arm64"
1117
+ ]
704
1118
  },
705
1119
  {
706
1120
  "command": "ltrace",
707
1121
  "name": "ltrace",
708
1122
  "category": "Dynamically Reverse-Engineer Code: ELF Files",
709
1123
  "description": "Trace library calls and signals.",
710
- "website": "https://ltrace.org"
1124
+ "website": "https://ltrace.org",
1125
+ "architectures": [
1126
+ "amd64",
1127
+ "arm64"
1128
+ ]
711
1129
  },
712
1130
  {
713
1131
  "command": "magika",
714
1132
  "name": "Magika",
715
1133
  "category": "Examine Static Properties: General",
716
1134
  "description": "Identify file type using signatures.",
717
- "website": "https://google.github.io/magika"
1135
+ "website": "https://google.github.io/magika",
1136
+ "architectures": [
1137
+ "amd64",
1138
+ "arm64"
1139
+ ]
718
1140
  },
719
1141
  {
720
1142
  "command": "mail-parser",
721
1143
  "name": "mail-parser",
722
1144
  "category": "Analyze Documents: Email Messages",
723
1145
  "description": "Parse raw SMTP and .MSG email messages and generate a parsed object from them.",
724
- "website": "https://github.com/SpamScope/mail-parser"
1146
+ "website": "https://github.com/SpamScope/mail-parser",
1147
+ "architectures": [
1148
+ "amd64",
1149
+ "arm64"
1150
+ ]
725
1151
  },
726
1152
  {
727
1153
  "command": "malcat-lite",
728
1154
  "name": "Malcat Lite",
729
1155
  "category": "Examine Static Properties: General",
730
1156
  "description": "Analyze binary files using a hex editor, disassembler, and file dissector.",
731
- "website": "https://malcat.fr"
1157
+ "website": "https://malcat.fr",
1158
+ "architectures": [
1159
+ "amd64"
1160
+ ],
1161
+ "arch_notes": {
1162
+ "arm64": "Use Ghidra or radare2 instead."
1163
+ }
732
1164
  },
733
1165
  {
734
1166
  "command": "malchive",
735
1167
  "name": "Malchive",
736
1168
  "category": "Statically Analyze Code: PE Files",
737
1169
  "description": "Perform static analysis of various aspects of malicious code.",
738
- "website": "https://github.com/MITRECND/malchive"
1170
+ "website": "https://github.com/MITRECND/malchive",
1171
+ "architectures": [
1172
+ "amd64",
1173
+ "arm64"
1174
+ ]
739
1175
  },
740
1176
  {
741
1177
  "command": "malwoverview",
742
1178
  "name": "malwoverview",
743
1179
  "category": "Gather and Analyze Data",
744
1180
  "description": "Query public repositories of malware data (e.g., VirusTotal, HybridAnalysis).",
745
- "website": "https://github.com/alexandreborges/malwoverview"
1181
+ "website": "https://github.com/alexandreborges/malwoverview",
1182
+ "architectures": [
1183
+ "amd64",
1184
+ "arm64"
1185
+ ]
746
1186
  },
747
1187
  {
748
1188
  "command": "manalyze",
749
1189
  "name": "Manalyze",
750
1190
  "category": "Examine Static Properties: PE Files",
751
1191
  "description": "Perform static analysis of suspicious PE files.",
752
- "website": "https://github.com/JusticeRage/Manalyze"
753
- },
754
- {
755
- "command": "manalyze",
756
- "name": "Manalyze",
757
- "category": "Examine Static Properties: PE Files",
758
- "description": "Perform static analysis of suspicious PE files.",
759
- "website": "https://github.com/JusticeRage/Manalyze"
1192
+ "website": "https://github.com/JusticeRage/Manalyze",
1193
+ "architectures": [
1194
+ "amd64",
1195
+ "arm64"
1196
+ ]
760
1197
  },
761
1198
  {
762
1199
  "command": "mermaid-view",
763
1200
  "name": "Mermaid Viewer",
764
1201
  "category": "View or Edit Files",
765
1202
  "description": "View Mermaid diagrams, such as AI-generated code-analysis workflow diagrams, in a local browser.",
766
- "website": "https://mermaid.js.org/"
1203
+ "website": "https://mermaid.js.org/",
1204
+ "architectures": [
1205
+ "amd64",
1206
+ "arm64"
1207
+ ]
767
1208
  },
768
1209
  {
769
1210
  "command": "mitmproxy",
770
1211
  "name": "mitmproxy",
771
1212
  "category": "Explore Network Interactions: Monitoring",
772
1213
  "description": "Investigate website interactions using this web proxy.",
773
- "website": "https://mitmproxy.org/"
1214
+ "website": "https://mitmproxy.org/",
1215
+ "architectures": [
1216
+ "amd64",
1217
+ "arm64"
1218
+ ]
774
1219
  },
775
1220
  {
776
1221
  "command": "monitor-network",
777
1222
  "name": "monitor-network",
778
1223
  "category": "Explore Network Interactions: Monitoring",
779
1224
  "description": "Monitor traffic on the first active network interface using tshark, printing a live summary to the screen or saving it to a pcapng file.",
780
- "website": "https://github.com/REMnux/distro/blob/master/files/monitor-network"
1225
+ "website": "https://github.com/REMnux/distro/blob/master/files/monitor-network",
1226
+ "architectures": [
1227
+ "amd64",
1228
+ "arm64"
1229
+ ]
781
1230
  },
782
1231
  {
783
1232
  "command": "monodis",
784
1233
  "name": "monodis",
785
1234
  "category": "Examine Static Properties: .NET",
786
1235
  "description": "Disassemble and extract resources from .NET assemblies.",
787
- "website": "https://www.mono-project.com/docs/tools+libraries/tools/monodis/"
1236
+ "website": "https://www.mono-project.com/docs/tools+libraries/tools/monodis/",
1237
+ "architectures": [
1238
+ "amd64",
1239
+ "arm64"
1240
+ ]
788
1241
  },
789
1242
  {
790
1243
  "command": "msg-extractor",
791
1244
  "name": "msg-extractor",
792
1245
  "category": "Analyze Documents: Email Messages",
793
1246
  "description": "Extract emails and attachments from MSG files.",
794
- "website": "https://github.com/TeamMsgExtractor/msg-extractor"
1247
+ "website": "https://github.com/TeamMsgExtractor/msg-extractor",
1248
+ "architectures": [
1249
+ "amd64",
1250
+ "arm64"
1251
+ ]
795
1252
  },
796
1253
  {
797
1254
  "command": "msgconvert",
798
1255
  "name": "msgconvert",
799
1256
  "category": "Analyze Documents: Email Messages",
800
1257
  "description": "Convert MSG files to MBOX files.",
801
- "website": "https://www.matijs.net/software/msgconv/"
1258
+ "website": "https://www.matijs.net/software/msgconv/",
1259
+ "architectures": [
1260
+ "amd64",
1261
+ "arm64"
1262
+ ]
802
1263
  },
803
1264
  {
804
1265
  "command": "msitools",
805
1266
  "name": "msitools",
806
1267
  "category": "Examine Static Properties: General",
807
1268
  "description": "Create, inspect and extract Windows Installer (.msi) files.",
808
- "website": "https://wiki.gnome.org/msitools"
1269
+ "website": "https://wiki.gnome.org/msitools",
1270
+ "architectures": [
1271
+ "amd64",
1272
+ "arm64"
1273
+ ]
809
1274
  },
810
1275
  {
811
1276
  "command": "msoffcrypto-crack",
812
1277
  "name": "msoffcrypto-crack.py",
813
1278
  "category": "Analyze Documents: Microsoft Office",
814
1279
  "description": "Recover the password of an encrypted Microsoft Office document.",
815
- "website": "https://blog.didierstevens.com/2018/12/31/new-tool-msoffcrypto-crack-py/"
1280
+ "website": "https://blog.didierstevens.com/2018/12/31/new-tool-msoffcrypto-crack-py/",
1281
+ "architectures": [
1282
+ "amd64",
1283
+ "arm64"
1284
+ ]
816
1285
  },
817
1286
  {
818
1287
  "command": "msoffcrypto-tool",
819
1288
  "name": "msoffcrypto-tool",
820
1289
  "category": "Analyze Documents: Microsoft Office",
821
1290
  "description": "Decrypt a Microsoft Office file with password, intermediate key, or private key which generated its escrow key.",
822
- "website": "https://github.com/nolze/msoffcrypto-tool"
1291
+ "website": "https://github.com/nolze/msoffcrypto-tool",
1292
+ "architectures": [
1293
+ "amd64",
1294
+ "arm64"
1295
+ ]
823
1296
  },
824
1297
  {
825
1298
  "command": "msoffice-crypt",
826
1299
  "name": "msoffice-crypt",
827
1300
  "category": "Analyze Documents: Microsoft Office",
828
1301
  "description": "Encrypt and decrypt OOXML Microsoft Office documents.",
829
- "website": "https://github.com/herumi/msoffice"
1302
+ "website": "https://github.com/herumi/msoffice",
1303
+ "architectures": [
1304
+ "amd64",
1305
+ "arm64"
1306
+ ]
830
1307
  },
831
1308
  {
832
1309
  "command": "mutool",
833
1310
  "name": "mutool",
834
1311
  "category": "Analyze Documents: PDF",
835
1312
  "description": "Examine, convert, and manipulate PDF files, including extracting embedded streams and repairing malformed documents.",
836
- "website": "https://mupdf.com"
1313
+ "website": "https://mupdf.com",
1314
+ "architectures": [
1315
+ "amd64",
1316
+ "arm64"
1317
+ ]
837
1318
  },
838
1319
  {
839
1320
  "command": "myip",
840
1321
  "name": "myip",
841
1322
  "category": "General Utilities",
842
1323
  "description": "Determine the IP address of the default network interface.",
843
- "website": "https://github.com/REMnux/distro/blob/master/files/myip"
1324
+ "website": "https://github.com/REMnux/distro/blob/master/files/myip",
1325
+ "architectures": [
1326
+ "amd64",
1327
+ "arm64"
1328
+ ]
844
1329
  },
845
1330
  {
846
1331
  "command": "name-that-hash",
847
1332
  "name": "Name-That-Hash",
848
1333
  "category": "Examine Static Properties: General",
849
1334
  "description": "Identify dfferent types of hashes.",
850
- "website": "https://github.com/HashPals/Name-That-Hash"
1335
+ "website": "https://github.com/HashPals/Name-That-Hash",
1336
+ "architectures": [
1337
+ "amd64",
1338
+ "arm64"
1339
+ ]
851
1340
  },
852
1341
  {
853
1342
  "command": "nasm",
854
1343
  "name": "nasm",
855
1344
  "category": "General Utilities",
856
1345
  "description": "An x86-64 assembler.",
857
- "website": "https://www.nasm.us"
1346
+ "website": "https://www.nasm.us",
1347
+ "architectures": [
1348
+ "amd64",
1349
+ "arm64"
1350
+ ]
858
1351
  },
859
1352
  {
860
1353
  "command": "nautilus",
861
1354
  "name": "Nautilus",
862
1355
  "category": "General Utilities",
863
1356
  "description": "Graphical file manager.",
864
- "website": "https://gitlab.gnome.org/GNOME/nautilus"
1357
+ "website": "https://gitlab.gnome.org/GNOME/nautilus",
1358
+ "architectures": [
1359
+ "amd64",
1360
+ "arm64"
1361
+ ]
865
1362
  },
866
1363
  {
867
1364
  "command": "netcat",
868
1365
  "name": "netcat",
869
1366
  "category": "Explore Network Interactions: Services",
870
1367
  "description": "Read and write data across network connections.",
871
- "website": "https://nc110.sourceforge.io/"
1368
+ "website": "https://nc110.sourceforge.io/",
1369
+ "architectures": [
1370
+ "amd64",
1371
+ "arm64"
1372
+ ]
872
1373
  },
873
1374
  {
874
1375
  "command": "network-miner-free-edition",
875
1376
  "name": "Network Miner Free Edition",
876
1377
  "category": "Explore Network Interactions: Monitoring",
877
1378
  "description": "Examine network traffic and carve PCAP capture files.",
878
- "website": "https://www.netresec.com/"
1379
+ "website": "https://www.netresec.com/",
1380
+ "architectures": [
1381
+ "amd64",
1382
+ "arm64"
1383
+ ]
879
1384
  },
880
1385
  {
881
1386
  "command": "nginx",
882
1387
  "name": "Nginx",
883
1388
  "category": "Explore Network Interactions: Services",
884
1389
  "description": "Web server.",
885
- "website": "https://nginx.org"
1390
+ "website": "https://nginx.org",
1391
+ "architectures": [
1392
+ "amd64",
1393
+ "arm64"
1394
+ ]
886
1395
  },
887
1396
  {
888
1397
  "command": "ngrep",
889
1398
  "name": "ngrep",
890
1399
  "category": "Explore Network Interactions: Monitoring",
891
1400
  "description": "Look for patterns in network traffic.",
892
- "website": "https://github.com/jpr5/ngrep/"
1401
+ "website": "https://github.com/jpr5/ngrep/",
1402
+ "architectures": [
1403
+ "amd64",
1404
+ "arm64"
1405
+ ]
893
1406
  },
894
1407
  {
895
1408
  "command": "nomorexorpy",
896
1409
  "name": "NoMoreXOR.py",
897
1410
  "category": "Examine Static Properties: Deobfuscation",
898
1411
  "description": "Help guess a file's 256-byte XOR by using frequency analysis.",
899
- "website": "https://github.com/digitalsleuth/NoMoreXOR"
1412
+ "website": "https://github.com/digitalsleuth/NoMoreXOR",
1413
+ "architectures": [
1414
+ "amd64",
1415
+ "arm64"
1416
+ ]
900
1417
  },
901
1418
  {
902
1419
  "command": "numbers-to-string",
903
1420
  "name": "numbers-to-string.py",
904
1421
  "category": "Examine Static Properties: Deobfuscation",
905
1422
  "description": "Translate number sequences into ASCII characters.",
906
- "website": "https://blog.didierstevens.com/2020/12/12/update-numbers-to-string-py-version-0-0-11/"
1423
+ "website": "https://blog.didierstevens.com/2020/12/12/update-numbers-to-string-py-version-0-0-11/",
1424
+ "architectures": [
1425
+ "amd64",
1426
+ "arm64"
1427
+ ]
907
1428
  },
908
1429
  {
909
1430
  "command": "objdump",
910
1431
  "name": "objdump",
911
1432
  "category": "Statically Analyze Code: General",
912
1433
  "description": "Disassemble binary files.",
913
- "website": "https://en.wikipedia.org/wiki/Objdump"
1434
+ "website": "https://en.wikipedia.org/wiki/Objdump",
1435
+ "architectures": [
1436
+ "amd64",
1437
+ "arm64"
1438
+ ]
914
1439
  },
915
1440
  {
916
1441
  "command": "oledump",
917
1442
  "name": "oledump.py",
918
1443
  "category": "Analyze Documents: Microsoft Office",
919
1444
  "description": "Analyze OLE2 Structured Storage files.",
920
- "website": "https://blog.didierstevens.com/programs/oledump-py/"
1445
+ "website": "https://blog.didierstevens.com/programs/oledump-py/",
1446
+ "architectures": [
1447
+ "amd64",
1448
+ "arm64"
1449
+ ]
921
1450
  },
922
1451
  {
923
1452
  "command": "olefile",
924
1453
  "name": "olefile",
925
1454
  "category": "Analyze Documents: Microsoft Office",
926
1455
  "description": "Python package to parse, read and write MS OLE2 files.",
927
- "website": "https://github.com/decalage2/olefile"
1456
+ "website": "https://github.com/decalage2/olefile",
1457
+ "architectures": [
1458
+ "amd64",
1459
+ "arm64"
1460
+ ]
928
1461
  },
929
1462
  {
930
1463
  "command": "oletools",
931
1464
  "name": "oletools",
932
1465
  "category": "Analyze Documents: Microsoft Office",
933
1466
  "description": "Microsoft Office OLE2 compound documents.",
934
- "website": "https://www.decalage.info/python/oletools"
1467
+ "website": "https://www.decalage.info/python/oletools",
1468
+ "architectures": [
1469
+ "amd64",
1470
+ "arm64"
1471
+ ]
935
1472
  },
936
1473
  {
937
1474
  "command": "onedump",
938
1475
  "name": "onedump.py",
939
1476
  "category": "Analyze Documents: Microsoft Office",
940
1477
  "description": "Extract and analyze embedded files from OneNote documents.",
941
- "website": "https://blog.didierstevens.com/2023/01/22/new-tool-onedump-py/"
1478
+ "website": "https://blog.didierstevens.com/2023/01/22/new-tool-onedump-py/",
1479
+ "architectures": [
1480
+ "amd64",
1481
+ "arm64"
1482
+ ]
942
1483
  },
943
1484
  {
944
1485
  "command": "opencode",
945
1486
  "name": "OpenCode",
946
1487
  "category": "Use Artificial Intelligence",
947
1488
  "description": "Open-source AI coding agent for the terminal.",
948
- "website": "https://opencode.ai"
1489
+ "website": "https://opencode.ai",
1490
+ "architectures": [
1491
+ "amd64",
1492
+ "arm64"
1493
+ ]
949
1494
  },
950
1495
  {
951
1496
  "command": "openssh",
952
1497
  "name": "OpenSSH",
953
1498
  "category": "General Utilities",
954
1499
  "description": "Initiate and receive SSH and SFTP connections.",
955
- "website": "https://www.openssh.com"
1500
+ "website": "https://www.openssh.com",
1501
+ "architectures": [
1502
+ "amd64",
1503
+ "arm64"
1504
+ ]
956
1505
  },
957
1506
  {
958
1507
  "command": "origamindee",
959
1508
  "name": "Origamindee",
960
1509
  "category": "Analyze Documents: PDF",
961
1510
  "description": "Parse, modify, generate PDF files.",
962
- "website": "https://github.com/mindee/origamindee"
1511
+ "website": "https://github.com/mindee/origamindee",
1512
+ "architectures": [
1513
+ "amd64",
1514
+ "arm64"
1515
+ ]
963
1516
  },
964
1517
  {
965
1518
  "command": "pcode2code",
966
1519
  "name": "pcode2code",
967
1520
  "category": "Analyze Documents: Microsoft Office",
968
1521
  "description": "Decompile VBA macro p-code from Microsoft Office documents.",
969
- "website": "https://github.com/Big5-sec/pcode2code"
1522
+ "website": "https://github.com/Big5-sec/pcode2code",
1523
+ "architectures": [
1524
+ "amd64",
1525
+ "arm64"
1526
+ ]
970
1527
  },
971
1528
  {
972
1529
  "command": "pcodedmp",
973
1530
  "name": "pcodedmp",
974
1531
  "category": "Analyze Documents: Microsoft Office",
975
1532
  "description": "Disassemble VBA p-code.",
976
- "website": "https://github.com/bontchev/pcodedmp"
1533
+ "website": "https://github.com/bontchev/pcodedmp",
1534
+ "architectures": [
1535
+ "amd64",
1536
+ "arm64"
1537
+ ]
977
1538
  },
978
1539
  {
979
1540
  "command": "pdf-parser",
980
1541
  "name": "pdf-parser.py",
981
1542
  "category": "Analyze Documents: PDF",
982
1543
  "description": "Examine elements of the PDF file.",
983
- "website": "https://blog.didierstevens.com/programs/pdf-tools/"
1544
+ "website": "https://blog.didierstevens.com/programs/pdf-tools/",
1545
+ "architectures": [
1546
+ "amd64",
1547
+ "arm64"
1548
+ ]
984
1549
  },
985
1550
  {
986
1551
  "command": "pdfid",
987
1552
  "name": "pdfid.py",
988
1553
  "category": "Analyze Documents: PDF",
989
1554
  "description": "Identify suspicious elements of the PDF file.",
990
- "website": "https://blog.didierstevens.com/programs/pdf-tools/"
1555
+ "website": "https://blog.didierstevens.com/programs/pdf-tools/",
1556
+ "architectures": [
1557
+ "amd64",
1558
+ "arm64"
1559
+ ]
991
1560
  },
992
1561
  {
993
1562
  "command": "pdfresurrect",
994
1563
  "name": "pdfresurrect",
995
1564
  "category": "Analyze Documents: PDF",
996
1565
  "description": "Extract previous versions of content from PDF files.",
997
- "website": "https://github.com/enferex/pdfresurrect"
1566
+ "website": "https://github.com/enferex/pdfresurrect",
1567
+ "architectures": [
1568
+ "amd64",
1569
+ "arm64"
1570
+ ]
998
1571
  },
999
1572
  {
1000
1573
  "command": "pdftk-java",
1001
1574
  "name": "pdftk-java",
1002
1575
  "category": "Analyze Documents: PDF",
1003
1576
  "description": "Edit, create, and examine PDF files.",
1004
- "website": "https://gitlab.com/pdftk-java/pdftk"
1577
+ "website": "https://gitlab.com/pdftk-java/pdftk",
1578
+ "architectures": [
1579
+ "amd64",
1580
+ "arm64"
1581
+ ]
1005
1582
  },
1006
1583
  {
1007
1584
  "command": "pdftool",
1008
1585
  "name": "pdftool.py",
1009
1586
  "category": "Analyze Documents: PDF",
1010
1587
  "description": "Analyze PDF files to identify incremental updates to the document.",
1011
- "website": "https://blog.didierstevens.com/2021/01/31/new-tool-pdftool-py/"
1588
+ "website": "https://blog.didierstevens.com/2021/01/31/new-tool-pdftool-py/",
1589
+ "architectures": [
1590
+ "amd64",
1591
+ "arm64"
1592
+ ]
1012
1593
  },
1013
1594
  {
1014
1595
  "command": "pdnstool",
1015
1596
  "name": "pdnstool",
1016
1597
  "category": "Gather and Analyze Data",
1017
1598
  "description": "Query passive DNS databases for DNS data.",
1018
- "website": "https://github.com/chrislee35/passivedns-client"
1599
+ "website": "https://github.com/chrislee35/passivedns-client",
1600
+ "architectures": [
1601
+ "amd64",
1602
+ "arm64"
1603
+ ]
1019
1604
  },
1020
1605
  {
1021
1606
  "command": "pe-tree",
1022
1607
  "name": "PE Tree",
1023
1608
  "category": "Examine Static Properties: PE Files",
1024
1609
  "description": "Examine contents and structure of PE files.",
1025
- "website": "https://github.com/blackberry/pe_tree"
1610
+ "website": "https://github.com/blackberry/pe_tree",
1611
+ "architectures": [
1612
+ "amd64",
1613
+ "arm64"
1614
+ ]
1026
1615
  },
1027
1616
  {
1028
1617
  "command": "pecheck",
1029
1618
  "name": "pecheck.py",
1030
1619
  "category": "Examine Static Properties: PE Files",
1031
1620
  "description": "Analyze static properties of PE files.",
1032
- "website": "https://blog.didierstevens.com/2020/03/15/pecheck-py-version-0-7-10/"
1621
+ "website": "https://blog.didierstevens.com/2020/03/15/pecheck-py-version-0-7-10/",
1622
+ "architectures": [
1623
+ "amd64",
1624
+ "arm64"
1625
+ ]
1033
1626
  },
1034
1627
  {
1035
1628
  "command": "pedump",
1036
1629
  "name": "pedump",
1037
1630
  "category": "Examine Static Properties: PE Files",
1038
1631
  "description": "Statically analyze PE files and extract their components (e.g., resources).",
1039
- "website": "https://github.com/zed-0xff/pedump"
1632
+ "website": "https://github.com/zed-0xff/pedump",
1633
+ "architectures": [
1634
+ "amd64",
1635
+ "arm64"
1636
+ ]
1040
1637
  },
1041
1638
  {
1042
1639
  "command": "peepdf-3",
1043
1640
  "name": "peepdf-3",
1044
1641
  "category": "Analyze Documents: PDF",
1045
1642
  "description": "Examine elements of the PDF file.",
1046
- "website": "https://github.com/digitalsleuth/peepdf-3"
1643
+ "website": "https://github.com/digitalsleuth/peepdf-3",
1644
+ "architectures": [
1645
+ "amd64",
1646
+ "arm64"
1647
+ ],
1648
+ "arch_notes": {
1649
+ "arm64": "JavaScript emulation is unavailable."
1650
+ }
1047
1651
  },
1048
1652
  {
1049
1653
  "command": "peframe",
1050
1654
  "name": "PEframe",
1051
1655
  "category": "Examine Static Properties: PE Files",
1052
1656
  "description": "Statically analyze PE and Microsoft Office files.",
1053
- "website": "https://github.com/digitalsleuth/peframe"
1657
+ "website": "https://github.com/digitalsleuth/peframe",
1658
+ "architectures": [
1659
+ "amd64",
1660
+ "arm64"
1661
+ ]
1054
1662
  },
1055
1663
  {
1056
1664
  "command": "polarproxy",
1057
1665
  "name": "PolarProxy",
1058
1666
  "category": "Explore Network Interactions: Monitoring",
1059
1667
  "description": "Intercept and decrypt TLS traffic.",
1060
- "website": "https://www.netresec.com/"
1668
+ "website": "https://www.netresec.com/",
1669
+ "architectures": [
1670
+ "amd64",
1671
+ "arm64"
1672
+ ]
1061
1673
  },
1062
1674
  {
1063
1675
  "command": "portex",
1064
1676
  "name": "PortEx",
1065
1677
  "category": "Examine Static Properties: PE Files",
1066
1678
  "description": "Statically analyze PE files.",
1067
- "website": "https://github.com/katjahahn/PortEx"
1679
+ "website": "https://github.com/katjahahn/PortEx",
1680
+ "architectures": [
1681
+ "amd64",
1682
+ "arm64"
1683
+ ]
1068
1684
  },
1069
1685
  {
1070
1686
  "command": "powershell-core",
1071
1687
  "name": "PowerShell Core",
1072
1688
  "category": "Dynamically Reverse-Engineer Code: Scripts",
1073
1689
  "description": "Run PowerShell scripts and commands.",
1074
- "website": "https://github.com/powershell/powershell"
1690
+ "website": "https://github.com/powershell/powershell",
1691
+ "architectures": [
1692
+ "amd64",
1693
+ "arm64"
1694
+ ]
1075
1695
  },
1076
1696
  {
1077
1697
  "command": "procmon-mcp",
1078
1698
  "name": "ProcmonMCP",
1079
1699
  "category": "Use Artificial Intelligence",
1080
1700
  "description": "MCP server that lets AI assistants analyze Process Monitor (Procmon) XML captures.",
1081
- "website": "https://github.com/JameZUK/ProcmonMCP"
1701
+ "website": "https://github.com/JameZUK/ProcmonMCP",
1702
+ "architectures": [
1703
+ "amd64",
1704
+ "arm64"
1705
+ ]
1082
1706
  },
1083
1707
  {
1084
1708
  "command": "procyon",
1085
1709
  "name": "Procyon",
1086
1710
  "category": "Statically Analyze Code: Java",
1087
1711
  "description": "Java decompiler.",
1088
- "website": "https://github.com/mstrobel/procyon"
1712
+ "website": "https://github.com/mstrobel/procyon",
1713
+ "architectures": [
1714
+ "amd64",
1715
+ "arm64"
1716
+ ]
1089
1717
  },
1090
1718
  {
1091
1719
  "command": "pyelftools",
1092
1720
  "name": "pyelftools",
1093
1721
  "category": "Examine Static Properties: ELF Files",
1094
1722
  "description": "Python library for parsing and analyzing ELF files and DWARF debugging information.",
1095
- "website": "https://github.com/eliben/pyelftools"
1723
+ "website": "https://github.com/eliben/pyelftools",
1724
+ "architectures": [
1725
+ "amd64",
1726
+ "arm64"
1727
+ ]
1096
1728
  },
1097
1729
  {
1098
1730
  "command": "pyinstaller-extractor",
1099
1731
  "name": "PyInstaller Extractor",
1100
1732
  "category": "Statically Analyze Code: Python",
1101
1733
  "description": "Extract contents of a PyInstaller-generated PE files.",
1102
- "website": "https://github.com/extremecoders-re/pyinstxtractor"
1734
+ "website": "https://github.com/extremecoders-re/pyinstxtractor",
1735
+ "architectures": [
1736
+ "amd64",
1737
+ "arm64"
1738
+ ]
1103
1739
  },
1104
1740
  {
1105
1741
  "command": "pyinstxtractor-ng",
1106
1742
  "name": "pyinstxtractor-ng",
1107
1743
  "category": "Statically Analyze Code: Python",
1108
1744
  "description": "Extract contents of PyInstaller-generated executables without requiring a matching Python version.",
1109
- "website": "https://github.com/pyinstxtractor/pyinstxtractor-ng"
1745
+ "website": "https://github.com/pyinstxtractor/pyinstxtractor-ng",
1746
+ "architectures": [
1747
+ "amd64",
1748
+ "arm64"
1749
+ ]
1110
1750
  },
1111
1751
  {
1112
1752
  "command": "qiling",
1113
1753
  "name": "Qiling",
1114
1754
  "category": "Statically Analyze Code: General",
1115
1755
  "description": "Emulate code execution of PE files, shellcode, etc. for a variety of OS and hardware platforms.",
1116
- "website": "https://www.qiling.io"
1756
+ "website": "https://www.qiling.io",
1757
+ "architectures": [
1758
+ "amd64",
1759
+ "arm64"
1760
+ ]
1117
1761
  },
1118
1762
  {
1119
1763
  "command": "qpdf",
1120
1764
  "name": "qpdf",
1121
1765
  "category": "Analyze Documents: PDF",
1122
1766
  "description": "Manipulate (merge, convert, transform) PDF files.",
1123
- "website": "http://qpdf.sourceforge.net/"
1767
+ "website": "http://qpdf.sourceforge.net/",
1768
+ "architectures": [
1769
+ "amd64",
1770
+ "arm64"
1771
+ ]
1124
1772
  },
1125
1773
  {
1126
1774
  "command": "r2decomp",
1127
1775
  "name": "r2decomp",
1128
1776
  "category": "Statically Analyze Code: General",
1129
1777
  "description": "Decompile the function behind a capa match using radare2 and the Ghidra decompiler.",
1130
- "website": "https://github.com/lennyzeltser/r2decomp"
1778
+ "website": "https://github.com/lennyzeltser/r2decomp",
1779
+ "architectures": [
1780
+ "amd64",
1781
+ "arm64"
1782
+ ]
1131
1783
  },
1132
1784
  {
1133
1785
  "command": "r2pipe",
1134
1786
  "name": "r2pipe",
1135
1787
  "category": "Dynamically Reverse-Engineer Code: General",
1136
1788
  "description": "Examine binary files, including disassembling and debugging.",
1137
- "website": "https://rada.re/n/r2pipe.html"
1789
+ "website": "https://rada.re/n/r2pipe.html",
1790
+ "architectures": [
1791
+ "amd64",
1792
+ "arm64"
1793
+ ]
1138
1794
  },
1139
1795
  {
1140
1796
  "command": "radare2",
1141
1797
  "name": "radare2",
1142
1798
  "category": "Dynamically Reverse-Engineer Code: General",
1143
1799
  "description": "Examine binary files, including disassembling and debugging. Includes r2ai and decai plugins for LLM-powered analysis (API key or local Ollama required), plus the r2ghidra plugin for Ghidra decompilation via the pdg command.",
1144
- "website": "https://www.radare.org/n/radare2.html"
1800
+ "website": "https://www.radare.org/n/radare2.html",
1801
+ "architectures": [
1802
+ "amd64",
1803
+ "arm64"
1804
+ ]
1145
1805
  },
1146
1806
  {
1147
1807
  "command": "rar",
1148
1808
  "name": "RAR",
1149
1809
  "category": "General Utilities",
1150
1810
  "description": "Compress and decompress files using a variety of algorithms.",
1151
- "website": "https://www.rarlab.com"
1811
+ "website": "https://www.rarlab.com",
1812
+ "architectures": [
1813
+ "amd64"
1814
+ ],
1815
+ "arch_notes": {
1816
+ "arm64": "To extract RAR archives, use unrar or 7zz instead."
1817
+ }
1152
1818
  },
1153
1819
  {
1154
1820
  "command": "re-search",
1155
1821
  "name": "re-search.py",
1156
1822
  "category": "Examine Static Properties: Deobfuscation",
1157
1823
  "description": "Search files using regular expressions from a built-in library or custom patterns.",
1158
- "website": "https://blog.didierstevens.com/2023/04/03/update-re-search-py-version-0-0-22/"
1824
+ "website": "https://blog.didierstevens.com/2023/04/03/update-re-search-py-version-0-0-22/",
1825
+ "architectures": [
1826
+ "amd64",
1827
+ "arm64"
1828
+ ]
1159
1829
  },
1160
1830
  {
1161
1831
  "command": "readpe-formerly-pev",
1162
1832
  "name": "readpe (formerly pev)",
1163
1833
  "category": "Examine Static Properties: PE Files",
1164
1834
  "description": "Analyze PE files and extract strings from them.",
1165
- "website": "https://github.com/mentebinaria/readpe"
1835
+ "website": "https://github.com/mentebinaria/readpe",
1836
+ "architectures": [
1837
+ "amd64",
1838
+ "arm64"
1839
+ ]
1166
1840
  },
1167
1841
  {
1168
1842
  "command": "redress",
1169
1843
  "name": "Redress",
1170
1844
  "category": "Examine Static Properties: Go",
1171
1845
  "description": "Analyze stripped Go binaries to recover symbols, types, source structure, and integrate with Radare2.",
1172
- "website": "https://github.com/goretk/redress"
1846
+ "website": "https://github.com/goretk/redress",
1847
+ "architectures": [
1848
+ "amd64",
1849
+ "arm64"
1850
+ ]
1173
1851
  },
1174
1852
  {
1175
1853
  "command": "remnux-installer",
1176
1854
  "name": "REMnux Installer",
1177
1855
  "category": "General Utilities",
1178
1856
  "description": "Install and update the REMnux distro.",
1179
- "website": "https://github.com/REMnux/distro/blob/master/files/remnux-installer.sh"
1857
+ "website": "https://github.com/REMnux/distro/blob/master/files/remnux-installer.sh",
1858
+ "architectures": [
1859
+ "amd64",
1860
+ "arm64"
1861
+ ]
1180
1862
  },
1181
1863
  {
1182
1864
  "command": "remnux-mcp-server",
1183
1865
  "name": "REMnux MCP Server",
1184
1866
  "category": "Use Artificial Intelligence",
1185
1867
  "description": "MCP server for using the REMnux malware analysis toolkit via AI assistants.",
1186
- "website": "https://github.com/REMnux/remnux-mcp-server"
1868
+ "website": "https://github.com/REMnux/remnux-mcp-server",
1869
+ "architectures": [
1870
+ "amd64",
1871
+ "arm64"
1872
+ ]
1187
1873
  },
1188
1874
  {
1189
1875
  "command": "restrict-egress",
1190
1876
  "name": "restrict-egress",
1191
1877
  "category": "General Utilities",
1192
1878
  "description": "Restrict outbound network access to an allowlist of domains and CIDRs using an nftables default-deny egress policy. It installs a persistent, self-refreshing lockdown on a VM or host, or enforces a one-shot lockdown inside a container with the apply command. Where dnsmasq and systemd-resolved are present, domain entries are coupled to DNS: a local dnsmasq inserts each answered IP into the allow set before the client sees it, so rotating load-balancer addresses never miss.",
1193
- "website": "https://github.com/REMnux/distro/blob/master/files/restrict-egress"
1879
+ "website": "https://github.com/REMnux/distro/blob/master/files/restrict-egress",
1880
+ "architectures": [
1881
+ "amd64",
1882
+ "arm64"
1883
+ ]
1194
1884
  },
1195
1885
  {
1196
1886
  "command": "rhino-debugger",
1197
1887
  "name": "Rhino Debugger",
1198
1888
  "category": "Dynamically Reverse-Engineer Code: Scripts",
1199
1889
  "description": "GUI JavaScript debugger.",
1200
- "website": "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/Rhino/Debugger"
1890
+ "website": "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/Rhino/Debugger",
1891
+ "architectures": [
1892
+ "amd64",
1893
+ "arm64"
1894
+ ]
1201
1895
  },
1202
1896
  {
1203
1897
  "command": "rsakeyfinder",
1204
1898
  "name": "RSAKeyFinder",
1205
1899
  "category": "Perform Memory Forensics",
1206
1900
  "description": "Find BER-encoded RSA private keys in a memory image.",
1207
- "website": "https://citp.princeton.edu/our-work/memory/"
1901
+ "website": "https://citp.princeton.edu/our-work/memory/",
1902
+ "architectures": [
1903
+ "amd64",
1904
+ "arm64"
1905
+ ]
1208
1906
  },
1209
1907
  {
1210
1908
  "command": "rtfdump",
1211
1909
  "name": "rtfdump.py",
1212
1910
  "category": "Analyze Documents: Microsoft Office",
1213
1911
  "description": "Analyze a suspicious RTF file.",
1214
- "website": "https://blog.didierstevens.com/2018/12/10/update-rtfdump-py-version-0-0-9/"
1912
+ "website": "https://blog.didierstevens.com/2018/12/10/update-rtfdump-py-version-0-0-9/",
1913
+ "architectures": [
1914
+ "amd64",
1915
+ "arm64"
1916
+ ]
1215
1917
  },
1216
1918
  {
1217
1919
  "command": "runsc",
1218
1920
  "name": "runsc",
1219
1921
  "category": "Dynamically Reverse-Engineer Code: Shellcode",
1220
1922
  "description": "Run shellcode to trace and analyze its execution.",
1221
- "website": "https://github.com/edygert/runsc"
1923
+ "website": "https://github.com/edygert/runsc",
1924
+ "architectures": [
1925
+ "amd64"
1926
+ ],
1927
+ "arch_notes": {
1928
+ "arm64": "Use speakeasy or qiling instead."
1929
+ }
1222
1930
  },
1223
1931
  {
1224
1932
  "command": "sandfly-processdecloak",
1225
1933
  "name": "sandfly-processdecloak",
1226
1934
  "category": "Investigate System Interactions",
1227
1935
  "description": "Find hidden processes on the local Linux system.",
1228
- "website": "https://github.com/sandflysecurity/sandfly-processdecloak"
1936
+ "website": "https://github.com/sandflysecurity/sandfly-processdecloak",
1937
+ "architectures": [
1938
+ "amd64",
1939
+ "arm64"
1940
+ ]
1229
1941
  },
1230
1942
  {
1231
1943
  "command": "scalpel",
1232
1944
  "name": "Scalpel",
1233
1945
  "category": "Gather and Analyze Data",
1234
1946
  "description": "Carve contents out of binary files, such as partitions.",
1235
- "website": "https://github.com/sleuthkit/scalpel"
1947
+ "website": "https://github.com/sleuthkit/scalpel",
1948
+ "architectures": [
1949
+ "amd64",
1950
+ "arm64"
1951
+ ]
1236
1952
  },
1237
1953
  {
1238
1954
  "command": "scdbg",
1239
1955
  "name": "scdbg",
1240
1956
  "category": "Dynamically Reverse-Engineer Code: Shellcode",
1241
1957
  "description": "Analyze shellcode by emulating its execution.",
1242
- "website": "http://sandsprite.com/blogs/index.php?uid=7&pid=152"
1958
+ "website": "http://sandsprite.com/blogs/index.php?uid=7&pid=152",
1959
+ "architectures": [
1960
+ "amd64"
1961
+ ],
1962
+ "arch_notes": {
1963
+ "arm64": "Use speakeasy or qiling instead."
1964
+ }
1243
1965
  },
1244
1966
  {
1245
1967
  "command": "scite",
1246
1968
  "name": "SciTE",
1247
1969
  "category": "View or Edit Files",
1248
1970
  "description": "Edit text files.",
1249
- "website": "https://www.scintilla.org/SciTE.html"
1971
+ "website": "https://www.scintilla.org/SciTE.html",
1972
+ "architectures": [
1973
+ "amd64",
1974
+ "arm64"
1975
+ ]
1250
1976
  },
1251
1977
  {
1252
1978
  "command": "sets",
1253
1979
  "name": "sets.py",
1254
1980
  "category": "Examine Static Properties: Deobfuscation",
1255
1981
  "description": "Perform set operations on lines or bytes in text files.",
1256
- "website": "https://blog.didierstevens.com/2017/03/05/new-tool-sets-py/"
1982
+ "website": "https://blog.didierstevens.com/2017/03/05/new-tool-sets-py/",
1983
+ "architectures": [
1984
+ "amd64",
1985
+ "arm64"
1986
+ ]
1257
1987
  },
1258
1988
  {
1259
1989
  "command": "shcode2exe",
1260
1990
  "name": "shcode2exe",
1261
1991
  "category": "Dynamically Reverse-Engineer Code: Shellcode",
1262
1992
  "description": "Convert 32 and 64-bit shellcode to a Windows executable file.",
1263
- "website": "https://github.com/accidentalrebel/shcode2exe"
1993
+ "website": "https://github.com/accidentalrebel/shcode2exe",
1994
+ "architectures": [
1995
+ "amd64",
1996
+ "arm64"
1997
+ ]
1264
1998
  },
1265
1999
  {
1266
2000
  "command": "shellcode2exebat",
1267
2001
  "name": "shellcode2exe.bat",
1268
2002
  "category": "Dynamically Reverse-Engineer Code: Shellcode",
1269
2003
  "description": "Convert 32 and 64-bit shellcode to a Windows executable file.",
1270
- "website": "https://github.com/repnz/shellcode2exe"
2004
+ "website": "https://github.com/repnz/shellcode2exe",
2005
+ "architectures": [
2006
+ "amd64"
2007
+ ],
2008
+ "arch_notes": {
2009
+ "arm64": "Use speakeasy or qiling instead."
2010
+ }
1271
2011
  },
1272
2012
  {
1273
2013
  "command": "signsrch",
1274
2014
  "name": "signsrch",
1275
2015
  "category": "Examine Static Properties: General",
1276
2016
  "description": "Find patterns of common encryption, compression, or encoding algorithms.",
1277
- "website": "http://aluigi.altervista.org/mytoolz.htm"
2017
+ "website": "http://aluigi.altervista.org/mytoolz.htm",
2018
+ "architectures": [
2019
+ "amd64",
2020
+ "arm64"
2021
+ ]
1278
2022
  },
1279
2023
  {
1280
2024
  "command": "sleuth-kit",
1281
2025
  "name": "Sleuth Kit",
1282
2026
  "category": "Examine Static Properties: General",
1283
2027
  "description": "Analyze disk images and recover files from them.",
1284
- "website": "https://www.sleuthkit.org/sleuthkit"
2028
+ "website": "https://www.sleuthkit.org/sleuthkit",
2029
+ "architectures": [
2030
+ "amd64",
2031
+ "arm64"
2032
+ ]
1285
2033
  },
1286
2034
  {
1287
2035
  "command": "speakeasy",
1288
2036
  "name": "Speakeasy",
1289
2037
  "category": "Statically Analyze Code: PE Files",
1290
2038
  "description": "Emulate code execution, including shellcode, Windows drivers, and Windows PE files.",
1291
- "website": "https://github.com/mandiant/speakeasy"
2039
+ "website": "https://github.com/mandiant/speakeasy",
2040
+ "architectures": [
2041
+ "amd64",
2042
+ "arm64"
2043
+ ]
1292
2044
  },
1293
2045
  {
1294
2046
  "command": "spidermonkey",
1295
2047
  "name": "SpiderMonkey",
1296
2048
  "category": "Dynamically Reverse-Engineer Code: Scripts",
1297
2049
  "description": "Execute and deobfuscate JavaScript using Mozilla's standalone JavaScript engine.",
1298
- "website": "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/SpiderMonkey"
2050
+ "website": "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/SpiderMonkey",
2051
+ "architectures": [
2052
+ "amd64",
2053
+ "arm64"
2054
+ ]
1299
2055
  },
1300
2056
  {
1301
2057
  "command": "spidermonkey-patched",
1302
2058
  "name": "SpiderMonkey (Patched)",
1303
2059
  "category": "Dynamically Reverse-Engineer Code: Scripts",
1304
2060
  "description": "Execute and deobfuscate JavaScript using a patched version of Mozilla's standalone JavaScript engine.",
1305
- "website": "https://blog.didierstevens.com/2018/04/19/update-patched-spidermonkey/"
2061
+ "website": "https://blog.didierstevens.com/2018/04/19/update-patched-spidermonkey/",
2062
+ "architectures": [
2063
+ "amd64"
2064
+ ],
2065
+ "arch_notes": {
2066
+ "arm64": "Use js115 instead."
2067
+ }
1306
2068
  },
1307
2069
  {
1308
2070
  "command": "sqlite",
1309
2071
  "name": "SQLite",
1310
2072
  "category": "General Utilities",
1311
2073
  "description": "Manage and interact with SQL database files.",
1312
- "website": "http://www.sqlite.org"
2074
+ "website": "http://www.sqlite.org",
2075
+ "architectures": [
2076
+ "amd64",
2077
+ "arm64"
2078
+ ]
1313
2079
  },
1314
2080
  {
1315
2081
  "command": "ssdeep",
1316
2082
  "name": "ssdeep",
1317
2083
  "category": "Examine Static Properties: General",
1318
2084
  "description": "Compute Context Triggered Piecewise Hashes (CTPH), also known as fuzzy hashes.",
1319
- "website": "https://ssdeep-project.github.io/ssdeep/index.html"
2085
+ "website": "https://ssdeep-project.github.io/ssdeep/index.html",
2086
+ "architectures": [
2087
+ "amd64",
2088
+ "arm64"
2089
+ ]
1320
2090
  },
1321
2091
  {
1322
2092
  "command": "sshpass",
1323
2093
  "name": "sshpass",
1324
2094
  "category": "General Utilities",
1325
2095
  "description": "Supply a password to SSH non-interactively for automated logins.",
1326
- "website": "https://sourceforge.net/projects/sshpass/"
2096
+ "website": "https://sourceforge.net/projects/sshpass/",
2097
+ "architectures": [
2098
+ "amd64",
2099
+ "arm64"
2100
+ ]
1327
2101
  },
1328
2102
  {
1329
2103
  "command": "ssview",
1330
2104
  "name": "SSView",
1331
2105
  "category": "Analyze Documents: Microsoft Office",
1332
2106
  "description": "Analyze OLE2 Structured Storage files.",
1333
- "website": "https://www.mitec.cz/ssv.html"
2107
+ "website": "https://www.mitec.cz/ssv.html",
2108
+ "architectures": [
2109
+ "amd64"
2110
+ ],
2111
+ "arch_notes": {
2112
+ "arm64": "Use oledir or olebrowse from oletools instead."
2113
+ }
1334
2114
  },
1335
2115
  {
1336
2116
  "command": "stpyv8",
1337
2117
  "name": "STPyV8",
1338
2118
  "category": "Dynamically Reverse-Engineer Code: Scripts",
1339
2119
  "description": "Python3 and JavaScript interop engine, fork of the original PyV8 project.",
1340
- "website": "https://github.com/cloudflare/stpyv8"
2120
+ "website": "https://github.com/cloudflare/stpyv8",
2121
+ "architectures": [
2122
+ "amd64"
2123
+ ],
2124
+ "arch_notes": {
2125
+ "arm64": "No alternative identified."
2126
+ }
1341
2127
  },
1342
2128
  {
1343
2129
  "command": "strace",
1344
2130
  "name": "strace",
1345
2131
  "category": "Dynamically Reverse-Engineer Code: ELF Files",
1346
2132
  "description": "Trace process' system calls and signals.",
1347
- "website": "https://strace.io"
2133
+ "website": "https://strace.io",
2134
+ "architectures": [
2135
+ "amd64",
2136
+ "arm64"
2137
+ ]
1348
2138
  },
1349
2139
  {
1350
2140
  "command": "strdeobpl",
1351
2141
  "name": "strdeob.pl",
1352
2142
  "category": "Examine Static Properties: Deobfuscation",
1353
2143
  "description": "Locate and decode stack strings in executable files.",
1354
- "website": "https://github.com/REMnux/distro/blob/master/files/strdeob.pl"
2144
+ "website": "https://github.com/REMnux/distro/blob/master/files/strdeob.pl",
2145
+ "architectures": [
2146
+ "amd64",
2147
+ "arm64"
2148
+ ]
1355
2149
  },
1356
2150
  {
1357
2151
  "command": "strings",
1358
2152
  "name": "strings.py",
1359
2153
  "category": "Examine Static Properties: General",
1360
2154
  "description": "Extract ASCII and Unicode strings from binary files with length sorting and filtering.",
1361
- "website": "https://blog.didierstevens.com/2020/12/19/update-strings-py-version-0-0-6/"
2155
+ "website": "https://blog.didierstevens.com/2020/12/19/update-strings-py-version-0-0-6/",
2156
+ "architectures": [
2157
+ "amd64",
2158
+ "arm64"
2159
+ ]
1362
2160
  },
1363
2161
  {
1364
2162
  "command": "tcpdump",
1365
2163
  "name": "tcpdump",
1366
2164
  "category": "Explore Network Interactions: Monitoring",
1367
2165
  "description": "Capture and analyze network traffic with this command-line sniffer.",
1368
- "website": "https://www.tcpdump.org/"
2166
+ "website": "https://www.tcpdump.org/",
2167
+ "architectures": [
2168
+ "amd64",
2169
+ "arm64"
2170
+ ]
1369
2171
  },
1370
2172
  {
1371
2173
  "command": "tcpflow",
1372
2174
  "name": "tcpflow",
1373
2175
  "category": "Explore Network Interactions: Monitoring",
1374
2176
  "description": "Analyze the flow of network traffic.",
1375
- "website": "https://downloads.digitalcorpora.org/downloads/tcpflow/"
2177
+ "website": "https://downloads.digitalcorpora.org/downloads/tcpflow/",
2178
+ "architectures": [
2179
+ "amd64",
2180
+ "arm64"
2181
+ ]
1376
2182
  },
1377
2183
  {
1378
2184
  "command": "tcpick",
1379
2185
  "name": "tcpick",
1380
2186
  "category": "Explore Network Interactions: Monitoring",
1381
2187
  "description": "Capture and analyze network traffic with this command-line sniffer.",
1382
- "website": "http://tcpick.sourceforge.net"
2188
+ "website": "http://tcpick.sourceforge.net",
2189
+ "architectures": [
2190
+ "amd64",
2191
+ "arm64"
2192
+ ]
1383
2193
  },
1384
2194
  {
1385
2195
  "command": "tcpxtract",
1386
2196
  "name": "tcpxtract",
1387
2197
  "category": "Explore Network Interactions: Monitoring",
1388
2198
  "description": "Extract files from network traffic.",
1389
- "website": "http://tcpxtract.sourceforge.net/"
2199
+ "website": "http://tcpxtract.sourceforge.net/",
2200
+ "architectures": [
2201
+ "amd64",
2202
+ "arm64"
2203
+ ]
1390
2204
  },
1391
2205
  {
1392
2206
  "command": "tesseract-ocr",
1393
2207
  "name": "Tesseract OCR",
1394
2208
  "category": "Analyze Documents: General",
1395
2209
  "description": "Examine images to identify and extract text using optical character recognition (OCR).",
1396
- "website": "https://github.com/tesseract-ocr/tesseract"
2210
+ "website": "https://github.com/tesseract-ocr/tesseract",
2211
+ "architectures": [
2212
+ "amd64",
2213
+ "arm64"
2214
+ ]
1397
2215
  },
1398
2216
  {
1399
2217
  "command": "thefuzz",
1400
2218
  "name": "thefuzz",
1401
2219
  "category": "Examine Static Properties: General",
1402
2220
  "description": "Fuzzy String Matching in Python.",
1403
- "website": "https://github.com/seatgeek/thefuzz"
2221
+ "website": "https://github.com/seatgeek/thefuzz",
2222
+ "architectures": [
2223
+ "amd64",
2224
+ "arm64"
2225
+ ]
1404
2226
  },
1405
2227
  {
1406
2228
  "command": "thug",
1407
2229
  "name": "thug",
1408
2230
  "category": "Explore Network Interactions: Connecting",
1409
2231
  "description": "Examine suspicious website using this low-interaction honeyclient.",
1410
- "website": "https://github.com/buffer/thug"
2232
+ "website": "https://github.com/buffer/thug",
2233
+ "architectures": [
2234
+ "amd64"
2235
+ ],
2236
+ "arch_notes": {
2237
+ "arm64": "Run thug on an amd64 system, for example in the remnux/thug container."
2238
+ }
1411
2239
  },
1412
2240
  {
1413
2241
  "command": "time-decode",
1414
2242
  "name": "time-decode",
1415
2243
  "category": "Gather and Analyze Data",
1416
2244
  "description": "Decode and encode date and timestamps.",
1417
- "website": "https://github.com/digitalsleuth/time_decode"
2245
+ "website": "https://github.com/digitalsleuth/time_decode",
2246
+ "architectures": [
2247
+ "amd64",
2248
+ "arm64"
2249
+ ]
1418
2250
  },
1419
2251
  {
1420
2252
  "command": "tor",
1421
2253
  "name": "tor",
1422
2254
  "category": "Explore Network Interactions: Connecting",
1423
2255
  "description": "Obfuscate your origins by routing traffic through a network of anonymizing nodes.",
1424
- "website": "https://www.torproject.org"
2256
+ "website": "https://www.torproject.org",
2257
+ "architectures": [
2258
+ "amd64",
2259
+ "arm64"
2260
+ ]
1425
2261
  },
1426
2262
  {
1427
2263
  "command": "translate",
1428
2264
  "name": "translate.py",
1429
2265
  "category": "Examine Static Properties: Deobfuscation",
1430
2266
  "description": "Translate bytes according to a Python expression.",
1431
- "website": "https://blog.didierstevens.com/programs/translate/"
2267
+ "website": "https://blog.didierstevens.com/programs/translate/",
2268
+ "architectures": [
2269
+ "amd64",
2270
+ "arm64"
2271
+ ]
1432
2272
  },
1433
2273
  {
1434
2274
  "command": "trid",
1435
2275
  "name": "TrID",
1436
2276
  "category": "Examine Static Properties: General",
1437
2277
  "description": "Identify file type using signatures.",
1438
- "website": "https://mark0.net/soft-trid-e.html"
2278
+ "website": "https://mark0.net/soft-trid-e.html",
2279
+ "architectures": [
2280
+ "amd64"
2281
+ ],
2282
+ "arch_notes": {
2283
+ "arm64": "Use `file` or Detect It Easy instead."
2284
+ }
1439
2285
  },
1440
2286
  {
1441
2287
  "command": "tshark",
1442
2288
  "name": "tshark",
1443
2289
  "category": "Explore Network Interactions: Monitoring",
1444
2290
  "description": "Capture and analyze network traffic with this console-based sniffer.",
1445
- "website": "https://www.wireshark.org"
2291
+ "website": "https://www.wireshark.org",
2292
+ "architectures": [
2293
+ "amd64",
2294
+ "arm64"
2295
+ ]
1446
2296
  },
1447
2297
  {
1448
2298
  "command": "uncompyle6",
1449
2299
  "name": "uncompyle6",
1450
2300
  "category": "Statically Analyze Code: Python",
1451
2301
  "description": "Python cross-version bytecode decompiler for Python 1.0 through 3.8.",
1452
- "website": "https://github.com/rocky/python-uncompyle6"
2302
+ "website": "https://github.com/rocky/python-uncompyle6",
2303
+ "architectures": [
2304
+ "amd64",
2305
+ "arm64"
2306
+ ]
1453
2307
  },
1454
2308
  {
1455
2309
  "command": "unfurl",
1456
2310
  "name": "Unfurl",
1457
2311
  "category": "Explore Network Interactions: Connecting",
1458
2312
  "description": "Deconstruct and decode data from a URL.",
1459
- "website": "https://github.com/obsidianforensics/unfurl"
2313
+ "website": "https://github.com/obsidianforensics/unfurl",
2314
+ "architectures": [
2315
+ "amd64",
2316
+ "arm64"
2317
+ ]
1460
2318
  },
1461
2319
  {
1462
2320
  "command": "unhide",
1463
2321
  "name": "Unhide",
1464
2322
  "category": "Investigate System Interactions",
1465
2323
  "description": "Find hidden processes or connections on the local Linux system.",
1466
- "website": "http://www.unhide-forensics.info"
2324
+ "website": "http://www.unhide-forensics.info",
2325
+ "architectures": [
2326
+ "amd64",
2327
+ "arm64"
2328
+ ]
1467
2329
  },
1468
2330
  {
1469
2331
  "command": "unicode",
1470
2332
  "name": "unicode",
1471
2333
  "category": "Examine Static Properties: Deobfuscation",
1472
2334
  "description": "Display Unicode character properties.",
1473
- "website": "https://github.com/garabik/unicode"
2335
+ "website": "https://github.com/garabik/unicode",
2336
+ "architectures": [
2337
+ "amd64",
2338
+ "arm64"
2339
+ ]
1474
2340
  },
1475
2341
  {
1476
2342
  "command": "unrar-free",
1477
2343
  "name": "unrar-free",
1478
2344
  "category": "General Utilities",
1479
2345
  "description": "Decompress files using a variety of algorithms.",
1480
- "website": "https://www.rarlab.com"
2346
+ "website": "https://www.rarlab.com",
2347
+ "architectures": [
2348
+ "amd64",
2349
+ "arm64"
2350
+ ]
1481
2351
  },
1482
2352
  {
1483
2353
  "command": "unxor",
1484
2354
  "name": "unXOR",
1485
2355
  "category": "Examine Static Properties: Deobfuscation",
1486
2356
  "description": "Deobfuscate XOR'ed files.",
1487
- "website": "https://github.com/tomchop/unxor/"
2357
+ "website": "https://github.com/tomchop/unxor/",
2358
+ "architectures": [
2359
+ "amd64",
2360
+ "arm64"
2361
+ ]
1488
2362
  },
1489
2363
  {
1490
2364
  "command": "upx",
1491
2365
  "name": "UPX",
1492
2366
  "category": "Statically Analyze Code: Unpacking",
1493
2367
  "description": "Pack and unpack PE files.",
1494
- "website": "https://upx.github.io"
2368
+ "website": "https://upx.github.io",
2369
+ "architectures": [
2370
+ "amd64",
2371
+ "arm64"
2372
+ ]
1495
2373
  },
1496
2374
  {
1497
2375
  "command": "vbindiff",
1498
2376
  "name": "VBinDiff",
1499
2377
  "category": "View or Edit Files",
1500
2378
  "description": "Compare binary files.",
1501
- "website": "https://www.cjmweb.net/vbindiff/"
2379
+ "website": "https://www.cjmweb.net/vbindiff/",
2380
+ "architectures": [
2381
+ "amd64",
2382
+ "arm64"
2383
+ ]
1502
2384
  },
1503
2385
  {
1504
2386
  "command": "visual-studio-code",
1505
2387
  "name": "Visual Studio Code",
1506
2388
  "category": "View or Edit Files",
1507
2389
  "description": "Powerful source code editor.",
1508
- "website": "https://code.visualstudio.com/"
2390
+ "website": "https://code.visualstudio.com/",
2391
+ "architectures": [
2392
+ "amd64",
2393
+ "arm64"
2394
+ ]
1509
2395
  },
1510
2396
  {
1511
2397
  "command": "vivisect",
1512
2398
  "name": "Vivisect",
1513
2399
  "category": "Statically Analyze Code: General",
1514
2400
  "description": "Statically examine and emulate binary files.",
1515
- "website": "https://github.com/vivisect/vivisect"
2401
+ "website": "https://github.com/vivisect/vivisect",
2402
+ "architectures": [
2403
+ "amd64",
2404
+ "arm64"
2405
+ ],
2406
+ "arch_notes": {
2407
+ "arm64": "The graphical interface is unavailable."
2408
+ }
1516
2409
  },
1517
2410
  {
1518
2411
  "command": "volatility-framework",
1519
2412
  "name": "Volatility Framework",
1520
2413
  "category": "Perform Memory Forensics",
1521
2414
  "description": "Memory forensics tool and framework.",
1522
- "website": "https://github.com/volatilityfoundation/volatility3"
2415
+ "website": "https://github.com/volatilityfoundation/volatility3",
2416
+ "architectures": [
2417
+ "amd64",
2418
+ "arm64"
2419
+ ]
1523
2420
  },
1524
2421
  {
1525
2422
  "command": "webcrack",
1526
2423
  "name": "Webcrack",
1527
2424
  "category": "Dynamically Reverse-Engineer Code: Scripts",
1528
2425
  "description": "Deobfuscate, unminify, and unpack bundled JavaScript, including scripts protected with obfuscator.io.",
1529
- "website": "https://github.com/j4k0xb/webcrack"
2426
+ "website": "https://github.com/j4k0xb/webcrack",
2427
+ "architectures": [
2428
+ "amd64",
2429
+ "arm64"
2430
+ ]
1530
2431
  },
1531
2432
  {
1532
2433
  "command": "wine",
1533
2434
  "name": "Wine",
1534
2435
  "category": "Dynamically Reverse-Engineer Code: General",
1535
2436
  "description": "Run Windows applications.",
1536
- "website": "https://www.winehq.org"
2437
+ "website": "https://www.winehq.org",
2438
+ "architectures": [
2439
+ "amd64"
2440
+ ],
2441
+ "arch_notes": {
2442
+ "arm64": "No alternative identified. Hangover, which combines Wine with FEX or Box64, is an experimental option outside REMnux."
2443
+ }
1537
2444
  },
1538
2445
  {
1539
2446
  "command": "wireshark",
1540
2447
  "name": "wireshark",
1541
2448
  "category": "Explore Network Interactions: Monitoring",
1542
2449
  "description": "Capture and analyze network traffic with this sniffer.",
1543
- "website": "https://www.wireshark.org"
2450
+ "website": "https://www.wireshark.org",
2451
+ "architectures": [
2452
+ "amd64",
2453
+ "arm64"
2454
+ ]
1544
2455
  },
1545
2456
  {
1546
2457
  "command": "wxhexeditor",
1547
2458
  "name": "wxHexEditor",
1548
2459
  "category": "View or Edit Files",
1549
2460
  "description": "Hex editor.",
1550
- "website": "https://sourceforge.net/projects/wxhexeditor/"
2461
+ "website": "https://sourceforge.net/projects/wxhexeditor/",
2462
+ "architectures": [
2463
+ "amd64",
2464
+ "arm64"
2465
+ ]
1551
2466
  },
1552
2467
  {
1553
2468
  "command": "x64dbg-automate-mcp",
1554
2469
  "name": "x64dbg Automate MCP (OpenCode skills)",
1555
2470
  "category": "Use Artificial Intelligence",
1556
2471
  "description": "Drive x64dbg on a remote Windows VM from OpenCode on REMnux, with eight AI commands for tracing, unpacking, state snapshots, decompiling, YARA scanning, and vulnerability hunting.",
1557
- "website": "https://github.com/REMnux/x64dbg-skills-opencode"
2472
+ "website": "https://github.com/REMnux/x64dbg-skills-opencode",
2473
+ "architectures": [
2474
+ "amd64",
2475
+ "arm64"
2476
+ ]
1558
2477
  },
1559
2478
  {
1560
2479
  "command": "x64dbg-documentation",
1561
2480
  "name": "x64dbg Documentation",
1562
2481
  "category": "Dynamically Reverse-Engineer Code: General",
1563
2482
  "description": "Read the official x64dbg documentation offline, including the command reference and format specifiers.",
1564
- "website": "https://github.com/x64dbg/docs"
2483
+ "website": "https://github.com/x64dbg/docs",
2484
+ "architectures": [
2485
+ "amd64",
2486
+ "arm64"
2487
+ ]
1565
2488
  },
1566
2489
  {
1567
2490
  "command": "xlmmacrodeobfuscator",
1568
2491
  "name": "XLMMacroDeobfuscator",
1569
2492
  "category": "Analyze Documents: Microsoft Office",
1570
2493
  "description": "Deobfuscate XLM macros (also known as Excel 4.0 macros) from Microsoft Office files.",
1571
- "website": "https://github.com/DissectMalware/XLMMacroDeobfuscator"
2494
+ "website": "https://github.com/DissectMalware/XLMMacroDeobfuscator",
2495
+ "architectures": [
2496
+ "amd64",
2497
+ "arm64"
2498
+ ]
1572
2499
  },
1573
2500
  {
1574
2501
  "command": "xmldump",
1575
2502
  "name": "xmldump.py",
1576
2503
  "category": "Analyze Documents: Microsoft Office",
1577
2504
  "description": "Extract contents of XML files, in particular OOXML-formatted Microsoft Office documents.",
1578
- "website": "https://blog.didierstevens.com/2017/12/18/new-tool-xmldump-py/"
2505
+ "website": "https://blog.didierstevens.com/2017/12/18/new-tool-xmldump-py/",
2506
+ "architectures": [
2507
+ "amd64",
2508
+ "arm64"
2509
+ ]
1579
2510
  },
1580
2511
  {
1581
2512
  "command": "xor-kpa",
1582
2513
  "name": "xor-kpa.py",
1583
2514
  "category": "Examine Static Properties: Deobfuscation",
1584
2515
  "description": "Implement a XOR known plaintext attack.",
1585
- "website": "https://blog.didierstevens.com/2017/06/06/update-xor-kpa-py-version-0-0-5/"
2516
+ "website": "https://blog.didierstevens.com/2017/06/06/update-xor-kpa-py-version-0-0-5/",
2517
+ "architectures": [
2518
+ "amd64",
2519
+ "arm64"
2520
+ ]
1586
2521
  },
1587
2522
  {
1588
2523
  "command": "xorbruteforcerpy",
1589
2524
  "name": "xorBruteForcer.py",
1590
2525
  "category": "Examine Static Properties: Deobfuscation",
1591
2526
  "description": "Bruteforce an XOR-encoded file.",
1592
- "website": "https://eternal-todo.com/category/bruteforcer"
2527
+ "website": "https://eternal-todo.com/category/bruteforcer",
2528
+ "architectures": [
2529
+ "amd64",
2530
+ "arm64"
2531
+ ]
1593
2532
  },
1594
2533
  {
1595
2534
  "command": "xorsearch",
1596
2535
  "name": "xorsearch.py",
1597
2536
  "category": "Examine Static Properties: Deobfuscation",
1598
2537
  "description": "Search for XOR, ROL, ROT, and SHIFT encoded strings with YARA and regex support.",
1599
- "website": "https://blog.didierstevens.com/2020/08/23/new-tool-xorsearch-py/"
2538
+ "website": "https://blog.didierstevens.com/2020/08/23/new-tool-xorsearch-py/",
2539
+ "architectures": [
2540
+ "amd64",
2541
+ "arm64"
2542
+ ]
1600
2543
  },
1601
2544
  {
1602
2545
  "command": "xorsearch",
1603
2546
  "name": "XORSearch",
1604
2547
  "category": "Examine Static Properties: Deobfuscation",
1605
2548
  "description": "Locate and decode strings obfuscated using common techniques.",
1606
- "website": "https://blog.didierstevens.com/programs/xorsearch/"
2549
+ "website": "https://blog.didierstevens.com/programs/xorsearch/",
2550
+ "architectures": [
2551
+ "amd64",
2552
+ "arm64"
2553
+ ]
1607
2554
  },
1608
2555
  {
1609
2556
  "command": "xorstrings",
1610
2557
  "name": "XORStrings",
1611
2558
  "category": "Examine Static Properties: Deobfuscation",
1612
2559
  "description": "Search for XOR encoded strings in a file.",
1613
- "website": "https://blog.didierstevens.com/2013/04/15/new-tool-xorstrings/"
2560
+ "website": "https://blog.didierstevens.com/2013/04/15/new-tool-xorstrings/",
2561
+ "architectures": [
2562
+ "amd64",
2563
+ "arm64"
2564
+ ]
1614
2565
  },
1615
2566
  {
1616
2567
  "command": "xortool",
1617
2568
  "name": "xortool",
1618
2569
  "category": "Examine Static Properties: Deobfuscation",
1619
2570
  "description": "Analyze XOR-encoded data.",
1620
- "website": "https://github.com/hellman/xortool"
2571
+ "website": "https://github.com/hellman/xortool",
2572
+ "architectures": [
2573
+ "amd64",
2574
+ "arm64"
2575
+ ]
1621
2576
  },
1622
2577
  {
1623
2578
  "command": "yara",
1624
2579
  "name": "Yara",
1625
2580
  "category": "Gather and Analyze Data",
1626
2581
  "description": "Identify and classify malware samples using Yara rules.",
1627
- "website": "https://virustotal.github.io/yara/"
2582
+ "website": "https://virustotal.github.io/yara/",
2583
+ "architectures": [
2584
+ "amd64",
2585
+ "arm64"
2586
+ ]
1628
2587
  },
1629
2588
  {
1630
2589
  "command": "yara-forge-rules",
1631
2590
  "name": "YARA-Forge Rules",
1632
2591
  "category": "Examine Static Properties: General",
1633
2592
  "description": "Scan files with curated YARA rules from 45+ sources for malware family identification.",
1634
- "website": "https://yarahq.github.io/"
2593
+ "website": "https://yarahq.github.io/",
2594
+ "architectures": [
2595
+ "amd64",
2596
+ "arm64"
2597
+ ]
1635
2598
  },
1636
2599
  {
1637
2600
  "command": "yara-rules",
1638
2601
  "name": "Yara Rules",
1639
2602
  "category": "Examine Static Properties: General",
1640
2603
  "description": "Scan a file with YARA rules to identify capabilities and behaviors (packer detection, anti-debug, networking).",
1641
- "website": "https://github.com/Yara-Rules/rules"
2604
+ "website": "https://github.com/Yara-Rules/rules",
2605
+ "architectures": [
2606
+ "amd64",
2607
+ "arm64"
2608
+ ]
1642
2609
  },
1643
2610
  {
1644
2611
  "command": "yara-x",
1645
2612
  "name": "YARA-X",
1646
2613
  "category": "Gather and Analyze Data",
1647
2614
  "description": "Scan files using YARA rules, the next generation of YARA written in Rust.",
1648
- "website": "https://github.com/VirusTotal/yara-x"
2615
+ "website": "https://github.com/VirusTotal/yara-x",
2616
+ "architectures": [
2617
+ "amd64",
2618
+ "arm64"
2619
+ ]
1649
2620
  },
1650
2621
  {
1651
2622
  "command": "zbarimg",
1652
2623
  "name": "zbarimg",
1653
2624
  "category": "Explore Network Interactions: Connecting",
1654
2625
  "description": "Decode QR codes and barcodes from image files.",
1655
- "website": "https://github.com/mchehab/zbar"
2626
+ "website": "https://github.com/mchehab/zbar",
2627
+ "architectures": [
2628
+ "amd64",
2629
+ "arm64"
2630
+ ]
1656
2631
  },
1657
2632
  {
1658
2633
  "command": "zipdump",
1659
2634
  "name": "zipdump.py",
1660
2635
  "category": "Analyze Documents: Microsoft Office",
1661
2636
  "description": "Analyze zip-compressed files.",
1662
- "website": "https://blog.didierstevens.com/2020/07/27/update-zipdump-py-version-0-0-20/"
2637
+ "website": "https://blog.didierstevens.com/2020/07/27/update-zipdump-py-version-0-0-20/",
2638
+ "architectures": [
2639
+ "amd64",
2640
+ "arm64"
2641
+ ]
1663
2642
  }
1664
2643
  ]
1665
2644
  }