Malware Tools Repository
repository·main·Indexed 41 days ago
https://github.com/ashemery/malware-toolsA curated collection of tools and resources for malware analysis, incident response, and reverse engineering. It categorizes utilities across domains including memory forensics, networking, dynamic analysis, PE analysis, and decompilers, while providing links to learning resources and technical research papers.
What's inside Malware Tools
- This repository serves as a curated collection of tools and resources for malware analysis, incident response, and digital forensics. It categorizes tools into several specialized domains to assist security researchers and responders in various stages of the investigation lifecycle.
Understand the capabilities of the mydoc theme and Jekyll
mainThe
mydoctheme is built on Jekyll and is designed for technical documentation. It leverages a lightweight, static-site architecture that provides several key capabilities:- Content Re-use: Achieved through Liquid, allowing you to re-use variables, code snippets, and entire pages (similar to DITA's
conrefandkeyref). - Authoring: Supports Markdown (specifically
kramdown), HTML, and Liquid for advanced logic. - Design: Uses the Bootstrap framework for responsive design and is highly skinnable using standard web technologies (HTML5, CSS, JavaScript, jQuery).
- Collaboration & Versioning: Since content is stored as text files, you use standard version control systems (Git, Mercurial, Perforce, etc.) instead of a CMS.
- Deployment: Builds are performed locally, and the resulting static HTML files can be pushed to any web server. Note that if you use Ruby plugins, you cannot host directly on GitHub Pages; you must push the output to a different web server.
- Performance & Security: Static files ensure fast loading times (~0.5s per page) and a reduced attack surface compared to database-driven CMS platforms.
- Offline Viewing: Uses relative linking, allowing the site to be viewed offline or on any web server without complex URL configuration.
- Content Re-use: Achieved through Liquid, allowing you to re-use variables, code snippets, and entire pages (similar to DITA's
Ensure sidebar item highlighting works
mainThe sidebar highlights the current page by applying an
activeclass to the list item (<li>) when thepage.urlmatches the item'surlattribute.Important Implementation Details:
- URL Matching: The
urlvalue in your sidebar data file must match the Jekyll{{page.url}}exactly. - Permalinks: Because the site uses permalinks to pull topics out of subfolders into the root directory during build, your sidebar
urlvalues should not include the project folder path. They should represent the final URL path as it appears in the browser.
If the URLs match, the
activeclass is applied, which also ensures the parent accordion section remains expanded.# Example sidebar data entry - title: Understanding how the sidebar works url: mydoc_understand_sidebar.html output: web, pdf- URL Matching: The
Configure the search via search.json
mainThe search functionality is driven by a
search.jsonfile located in the root directory. This file generates a JSON array of page data that a JavaScript client uses to perform keyword matching. The search scans the following fields:titlesummarykeywordstags
Note that the search is a simple keyword matcher; it does not provide a dedicated results page or keyword highlighting (bolding), but instead displays a list of matching page titles instantly as you type.
[ { "title": "search", "tags": "tags", "keywords": "keywords", "url": "url", "summary": "summary" } ]How the PDF generation process works
mainThe PDF generation process follows a specific sequence to ensure all links and styles are correctly applied:
- Jekyll Build: A Jekyll build is triggered using a specialized configuration file (e.g.,
pdfconfigs/config_mydoc_pdf.yml). This build generates a printer-friendly HTML site. - Link List Generation: A file named
prince-list.txtis generated. This file iterates through your sidebar YML and creates a list of URLs for every item marked withoutput: pdf. - Prince XML Execution: The Prince command is called using the
--input-listflag, pointing toprince-list.txt. Prince reads the list of HTML files, processes them (including JavaScript if--javascriptis enabled), and compiles them into a single PDF.
This mechanism ensures that Prince has a continuous stream of pages to process, allowing it to handle page numbering and cross-references accurately.
- Jekyll Build: A Jekyll build is triggered using a specialized configuration file (e.g.,
Use the Or operator in Liquid conditions
mainThe
oroperator allows you to check multiple conditions. When usingor, you must specify the full condition for each side of the operator; you cannot shorthand the second condition.{% if page.audience contains "vegan" or page.audience == "vegetarian" %} Then run this... {% endif %}Use relative links for offline viewing
mainVersion 6.0 implements relative linking throughout the sidebar and inline links. This allows you to view the documentation site offline (directly from your file system) or on any web server without needing to configureurlorbaseurlsettings in Jekyll.Ensure correct list alignment for kramdown Markdown
mainWhen using kramdown-flavored Markdown, you must ensure the first character of every list item aligns symmetrically on the left edge. If the items do not line up, the list will not render correctly.
Alignment Rule:
- For numbers 1 through 9: Use two spaces after the dot.
- For numbers 10 and up: Use one space after the dot.
Lining up the left edge ensures the list stays intact.
Use Prince JavaScript functions for dynamic PDF content
mainThe PDF generation process supports running JavaScript functions within CSS using
prince-script(). This allows you to inject dynamic data like datestamps or guide names into headers and footers.- Define the function in your HTML (e.g., in
_includes/head_print.html) usingPrince.addScriptFunc:Prince.addScriptFunc("datestamp", function() { return "PDF last generated: " + new Date().toLocaleDateString(); }); - Call the function in CSS:
@page { @top-right { content: prince-script(datestamp); } }
Note: You must include the
--javascriptflag in yourprinceCLI command for these functions to work.<script> Prince.addScriptFunc("datestamp", function() { return "PDF last generated: {{ site.time | date: '%B %d, %Y' }}"; }); </script>- Define the function in your HTML (e.g., in
How YAML and Liquid work together in Jekyll
mainIn Jekyll, you can separate data from presentation by storing structured data in YAML files (located in the
_datafolder) and using Liquid templating to inject that data into HTML. This is a common pattern for building dynamic components like Tables of Contents (TOC).Workflow:
- Store Data: Define your structure in a
.ymlfile within the_datadirectory. - Access Data: Use Liquid syntax to access the data via
site.data.[filename].[key]. - Render: Use Liquid
forloops and conditions to iterate through lists and mappings to generate HTML structure.
<!-- Accessing a file named samplelist.yml --> {{ site.data.samplelist.some_key }}- Store Data: Define your structure in a
Understand Mercurial (hg) branching: Bookmarks vs Named Branches
mainMercurial offers two primary ways to manage development lines:
- Bookmarks: These are tags that move forward automatically to subsequent changesets. They do not leave a permanent mark on the history. You can switch to a bookmark's state using
hg update [bookmark_name]. - Named Branches: These are indelible marks that are part of the changeset itself. They are pushed and pulled between repositories.
Key differences:
- Bookmarks are essentially moving tags; Named branches are permanent metadata.
- Named branches travel between repositories; Bookmarks do not.
- The default branch name is
default.
# Creating and switching between bookmarks hg bookmark main hg bookmark feature hg update feature- Bookmarks: These are tags that move forward automatically to subsequent changesets. They do not leave a permanent mark on the history. You can switch to a bookmark's state using
Organize pages using subfolders
mainYou can organize your documentation by creating folders and subfolders for your pages, similar to how posts are organized. Note that during the Jekyll build process, all pages are flattened and pushed into the root directory as single HTML files rather than maintaining the folder structure in the output.