Toolkit
The tooling the wiki's samples are written against — plus the lab scaffolding we use to detonate and observe them. Everything here is open source and pinned to a known-good revision.
# build & debug
Open-source user-mode debugger; the default for stepping through loader samples.
Kernel and user-mode debugging, plus the !address and !peb views used across the wiki.
Cross-compile every C sample on this site from Linux without a Windows toolchain.
Pinned configs for the non-C sample variants, including static CRT and stripped symbols.
# analysis
Fast PE header and section inspection; used in every "verify the image" walkthrough.
Memory forensics framework behind the malfind and module-list detections.
Traces the exact call chain a technique makes, in the order the wiki documents it.
A tuned Sysmon config that produces the events every Sigma rule here expects.
# lab infrastructure
One-command Windows 11 and Ubuntu analyst VMs, snapshotted and network-isolated.
Reverse-engineering distribution; our profile trims it to what the samples need.
Fake internet for detonation — DNS, HTTP and TLS responders with no egress.
# standing the lab up
# isolated detonation VM, no host networking git clone https://github.com/thehackersbrain/maldev-lab-kit && cd maldev-lab-kit vagrant up win11-analyst --provider=libvirt ./lab snapshot clean # always revert here before detonating
# isolated detonation VM, no host networking
git clone https://github.com/thehackersbrain/maldev-lab-kit && cd maldev-lab-kit
vagrant up win11-analyst --provider=libvirt
./lab snapshot clean # always revert here before detonatingRevert to the clean snapshot before every detonation. Nothing on this site should be run outside an isolated VM.