GView
GView copied to clipboard
gdt050579
GView is a cross-platform framework for reverse-engineering. Users can leverage the diverse range of available visualization options to effectively analyze and interpret the information.
43 44 30 30 31 CD001 ISO ISO-9660 CD Disc Image This signature usually occurs at byte offset 32769 (0x8001), 34817 (0x8801), or 36865 (0x9001). More information can be found...
Position should be cached when cycling through views (same type or different) For example: - a type plugin has multiple buffer view - all should keep the same position -...
https://learn.microsoft.com/en-us/openspecs/exchange_server_protocols/ms-oxmsg/b046868c-9fbf-41ae-9ffb-8de2bd4eec82
https://en.wikipedia.org/wiki/Microsoft_Compiled_HTML_Help https://docs.fileformat.com/web/chm/#:~:text=The%20CHM%20file%20format%20represents,via%20the%20provided%20search%20option. http://www.russotto.net/chm/chmformat.html Example: https://www.bleepingcomputer.com/news/security/apt37-hackers-deploy-new-fadestealer-eavesdropping-malware 
https://github.com/blacktop/go-macho
ELF UPXed binaries seem to have no sections (only segments). https://blogs.jpcert.or.jp/en/2023/05/gobrat.html eg. 2c1566a2e03c63b67fbdd80b4a67535e9ed969ea3e3013f0ba503cfa58e287e3 (malicious)
Should create a feature in order to automatically detect and extract compiled AutoIT scripts ([Aut2Exe](https://www.autoitscript.com/autoit3/docs/intro/compiler.htm)) from binaries. https://github.com/nazywam/AutoIt-Ripper http://files.planet-dl.org/Cw2k/MyAutToExe/index.html [Github mirror I](https://github.com/dzzie/myaut_contrib) [Github mirror II](https://github.com/PonyPC/myaut_contrib) https://github.com/sujuhu/autoit https://github.com/Cisco-Talos/clamav-devel/blob/31824a659dff37ae03e3419395bb68e659c2b165/libclamav/autoit.c
Create a proper way to keep track of window hierarchy. We should know, at any moment, which windows spawned which, and what their order is (to be able to go...