redballoonsecurity / ofrak

OFRAK: unpack, modify, and repack binaries.
https://ofrak.com
Other
1.85k stars 127 forks source link

Integrate forensics tools into OFRAK #295

Open rbs-jacob opened 1 year ago

rbs-jacob commented 1 year ago

What is the use case for the feature?

As an OFRAK user, I would sometimes like to extract files (and other data) using forensic tools, so that I can unpack the data further. This is mostly useful for using OFRAK as an unpacking and extraction tool, as opposed to using its repacking abilities.

Does the feature contain any proprietary information about another company's intellectual property?

No.

How would you implement this feature?

Though it would one day be interesting to fully integrate many forensics tools as unpackers, as a short-term stop gap, it could be good to have a few tools integrated as analyzers. In particular, analysis provided by the following tools would enable OFRAK users to carve (and thus unpack) portions of memory dumps and disk images.

Are you interested in implementing it yourself?

Perhaps someday.