Top Related Projects
A collection of software installations scripts for Windows systems that allows you to easily setup and maintain a reverse engineering environment on a VM.
Loki - Simple IOC and YARA Scanner
Quick Overview
Retoolkit is a comprehensive collection of reverse engineering tools for Windows, designed to simplify the setup process for reverse engineers. It provides a portable environment with a curated set of tools, eliminating the need for individual installations and configurations.
Pros
- Portable and easy to set up, allowing for quick deployment on different systems
- Comprehensive collection of popular reverse engineering tools in one package
- Regular updates to include new tools and maintain existing ones
- Customizable environment with the ability to add or remove tools as needed
Cons
- Limited to Windows operating systems
- May include tools that some users don't need, potentially increasing the package size
- Requires manual updates to keep tools current
- Some advanced users might prefer more control over individual tool installations
Getting Started
- Download the latest release from the GitHub repository.
- Extract the contents to a desired location on your Windows system.
- Run the
retoolkit.exefile to launch the toolkit. - Use the provided menu to access and launch various reverse engineering tools.
Note: Ensure that you have administrative privileges on your system to use certain tools effectively.
Competitor Comparisons
A collection of software installations scripts for Windows systems that allows you to easily setup and maintain a reverse engineering environment on a VM.
Pros of FLARE-VM
- More comprehensive tool suite, including a wider range of reverse engineering and malware analysis tools
- Better integration with Windows environment and automated setup process
- Regularly updated and maintained by a well-known cybersecurity company (Mandiant)
Cons of FLARE-VM
- Larger footprint and potentially slower setup due to the extensive tool collection
- May include tools that are not necessary for all users, leading to potential bloat
- Requires a Windows environment, limiting flexibility for users who prefer other operating systems
Code Comparison
FLARE-VM (PowerShell):
cinst -y --force --allow-empty-checksums vcredist2008 vcredist2010 vcredist2012 vcredist2013 vcredist140 vcredist2015 vcredist2017
cinst -y --force --allow-empty-checksums dotnet3.5 dotnet4.0 dotnet4.5 dotnet4.5.2 dotnet4.6 dotnet4.6.1 dotnet4.7 dotnet4.8
RetoolKit (Bash):
sudo apt update
sudo apt install -y build-essential git python3-pip
pip3 install --user virtualenv
The code snippets show different approaches to setting up dependencies, with FLARE-VM using Chocolatey on Windows and RetoolKit using apt and pip on Linux-based systems.
Pros of DeepBlueCLI
- Focused on Windows event log analysis, providing deep insights into security events
- Utilizes PowerShell, making it easily integrable into existing Windows environments
- Offers specific detections for common attack techniques and suspicious activities
Cons of DeepBlueCLI
- Limited to Windows systems, lacking cross-platform support
- Requires PowerShell knowledge for effective use and customization
- May have a steeper learning curve for users unfamiliar with PowerShell scripting
Code Comparison
DeepBlueCLI:
$events = Get-WinEvent -FilterHashtable @{LogName='Security';ID=4624}
foreach ($event in $events) {
# Analysis logic here
}
Retoolkit:
#!/bin/bash
# No direct code comparison available as Retoolkit is a collection of tools
# rather than a single script or application
Retoolkit is a comprehensive reverse engineering toolkit that includes various tools for different platforms, while DeepBlueCLI is specifically designed for Windows event log analysis. Retoolkit offers a broader range of functionality for reverse engineering tasks, whereas DeepBlueCLI provides in-depth analysis of Windows security events. The choice between the two depends on the specific needs of the user, with Retoolkit being more versatile for general reverse engineering and DeepBlueCLI excelling in Windows security analysis.
Loki - Simple IOC and YARA Scanner
Pros of Loki
- Focused on malware and threat detection with a large set of YARA rules
- Regularly updated with new IOCs and detection capabilities
- Lightweight and can be run on live systems without installation
Cons of Loki
- Limited to scanning and detection, lacks broader reverse engineering tools
- Primarily command-line based, may be less user-friendly for some users
- Requires frequent updates to maintain effectiveness against new threats
Code Comparison
Loki (Python):
def scan_path(path):
for root, directories, files in os.walk(path):
for filename in files:
try:
filePath = os.path.join(root, filename)
self.scan_file(filePath)
except Exception as e:
log.error("Error scanning file %s" % filePath)
Retoolkit (PowerShell):
function Get-Tools {
$tools = Get-ChildItem -Path $toolsPath -Recurse | Where-Object { $_.PSIsContainer -eq $false }
foreach ($tool in $tools) {
Write-Output $tool.FullName
}
}
While both repositories focus on security analysis, Loki is more specialized in threat detection, whereas Retoolkit provides a broader set of reverse engineering tools. Loki's code emphasizes file scanning and analysis, while Retoolkit's code manages a collection of diverse tools. Loki is better suited for rapid threat hunting, while Retoolkit offers a more comprehensive toolkit for in-depth reverse engineering tasks.
Convert 
designs to code with AI
Introducing Visual Copilot: A new AI model to turn Figma designs to high quality code using your components.
Try Visual CopilotREADME
English || Türkçe || Français || ä¸æç®ä½ || æ¥æ¬èª
Reverse Engineer's Toolkit
What?
This is a collection of tools you may like if you are interested in reverse engineering and/or malware analysis on x86 and x64 Windows systems. After installing this program, you'll have two ways to access the tools:
- Double-click the
retoolkiticon in the Desktop. - Right-click on a file, choose
retoolkit. This way the selected file is passed as argument to the desired program.
Why do I need it?
You don't. Obviously, you can download such tools from their own website and install them by yourself in a new VM. But if you download retoolkit, it will probably save you some time. Additionally, the tools come pre-configured so you'll find things like x64dbg with a few plugins, command-line tools working from any directory, etc. You may like it if you're setting up a new analysis VM.
Download
The *.iss files you see here are the source code for our setup program built with Inno Setup. To download the real thing, you have to go to the Releases section and download the setup program.
Included tools
Have a look at the wiki for a detailed list. By the way, you won't find cracked software there.
Is it safe to install it in my environment?
I don't know. Some included tools are not open source and come from shady places. You should use it exclusively in virtual machines and under your own responsibility.
Can you add tool X?
It depends. The idea is to keep it simple. We won't add a tool just because it's not here yet. But if you think there's a good reason to do so, and the license allows us to redistribute the software, please open an issue here if it doesn't exist yet.
Changelog
See CHANGELOG.md.
Similar projects
We're happy retoolkit inspired other people to create their own forks:
- https://github.com/indetectables-net/toolkit is also focused on RE tools and include a nice autoupdater program.
- https://github.com/cristianzsh/forensictools is focused on forensic tools.
Top Related Projects
A collection of software installations scripts for Windows systems that allows you to easily setup and maintain a reverse engineering environment on a VM.
Loki - Simple IOC and YARA Scanner
Convert designs to code with AI
Introducing Visual Copilot: A new AI model to turn Figma designs to high quality code using your components.
Try Visual Copilot