# REMnux: A Linux Toolkit for Malware Analysis

REMnux Documentation

<figure><img src="/files/-MCUkxh8JLbiP6ElSAIg" alt=""><figcaption></figcaption></figure>

This site provides documentation for [REMnux](https://remnux.org/)®, a Linux toolkit for reverse-engineering and analyzing malicious software. REMnux provides a curated collection of free tools created by the community. Analysts can use it to investigate malware without having to find, install, and configure the tools. The toolkit also includes AI-powered capabilities that let AI assistants [run REMnux tools automatically](/tips/using-ai).

## Install the REMnux Distro

The heart of the toolkit is the REMnux Linux distribution based on [Ubuntu](https://ubuntu.com), which incorporates many tools that malware analysts use to:

* [Examine static properties of a suspicious file.](/discover-the-tools/examine+static+properties)
* [Statically analyze malicious code.](/discover-the-tools/statically+analyze+code)
* [Dynamically reverse-engineer malicious code.](/discover-the-tools/dynamically+reverse-engineer+code)
* [Perform memory forensics of an infected system.](/discover-the-tools/perform+memory+forensics)
* [Explore network interactions for behavioral analysis.](/discover-the-tools/explore+network+interactions)
* [Investigate system-level interactions of malware.](/discover-the-tools/investigate+system+interactions)
* [Analyze malicious documents.](/discover-the-tools/analyze+documents)
* [Gather and analyze threat data.](/discover-the-tools/gather+and+analyze+data)

The [Discover the Tools](/discover-the-tools/examine+static+properties) section of this documentation site provides the REMnux tools listing and offers notes for using them.

To get started with REMnux, you can:

* [Download the virtual appliance](/install-distro/get-virtual-appliance) of the REMnux distro.
* [Install the REMnux distro from scratch](/install-distro/install-from-scratch) on a dedicated system.
* [Add the REMnux distro](/install-distro/add-to-existing-system) to an existing machine.
* [Run the REMnux distro as a Docker container.](/install-distro/remnux-as-a-container)

## Run Tools in Containers <a href="#run-in-containers" id="run-in-containers"></a>

The REMnux toolkit also offers [Docker images of popular malware analysis tools](/run-tools-in-containers/remnux-containers), making it possible to run them as containers without having to install the tools directly on the system.

## Get Involved with the Project

You can participate in the REMnux project by:

* [Asking and answering questions](/get-involved/ask-and-answer-questions) related to the distro and its tools.
* [Adding or updating tools](/get-involved/add-or-update-tools) that comprise the distribution.
* [Creating articles, blog posts, and videos](/get-involved/write-about-the-tools) about the tools on REMnux.

## Learn More About REMnux

You can learn about:

* [Using AI](/tips/using-ai) to run malware analysis tools with AI assistants
* [REMnux configuration tips](/tips/remnux-config-tips) for getting the most out of the distro
* [Tips for using the tools](/tips/remnux-tool-tips) on REMnux
* [People](/behind-the-scenes/people) and [technologies](/behind-the-scenes/technologies) that make REMnux possible

Many of the tools available in the REMnux toolkit are discussed in the SANS course [FOR610: Reverse Engineering Malware](https://sans.org/for610). Lenny Zeltser, the founder and primary maintainer of REMnux, is also the primary author of this course.


# Get the Virtual Appliance

The easiest way to get the REMnux distro is to download the prebuilt REMnux virtual appliance, import it into your hypervisor, then [run the update command](/install-distro/keep-the-distro-up-to-date) to make sure it's up-to-date.

{% hint style="info" %}
REMnux is currently based on an x86/amd64 version of Ubuntu, and won't run on ARM processors such as Apple's M-series chips.
{% endhint %}

## Step 1: Download the Virtual Appliance File <a href="#download-virtual-appliance" id="download-virtual-appliance"></a>

The REMnux virtual appliance is approximately 9 GB. It's based on Ubuntu 24.04 (Noble), and is available in several formats.

Decide which virtual appliance file to download. If in doubt, get the General OVA file. If you're using VirtualBox or Proxmox, download the appropriate file instead.

{% tabs %}
{% tab title="General OVA" %}
This general OVA file works with most hypervisors. If you're using VirtualBox or Proxmox, go to another corresponding tab.

[Download the general OVA file.](https://download.remnux.org/202602/remnux-noble-amd64.ova)
{% endtab %}

{% tab title="VirtualBox OVA" %}
This VirtualBox OVA file is specifically for VirtualBox. If you're using another hypervisor, go to another corresponding tab.

[Download the VirtualBox OVA file.](https://download.remnux.org/202602/remnux-noble-amd64-virtualbox.ova)
{% endtab %}

{% tab title="Proxmox QCOW2" %}
This QCOW2 file is specifically for Proxmox. If you're using another hypervisor, go to another corresponding tab.

[Download the Proxmox QCOW2 file.](https://download.remnux.org/202601/remnux-noble-amd64-proxmox.qcow2)
{% endtab %}
{% endtabs %}

## Step 2: Confirm the Hash of the Downloaded File <a href="#confirm-hash" id="confirm-hash"></a>

Validate the SHA-256 hash of the downloaded file using a tool such as `sha256sum` or `shasum` to make sure it matches this expected value:

{% tabs %}
{% tab title="General OVA Hash" %}
The general OVA file:

```
1b10f522671d42b5fac60238d660871001ecdd94474aace55e0ef2b88e2bdecb
```

{% endtab %}

{% tab title="VirtualBox OVA Hash" %}
The VirtualBox OVA file:

```
1ba3196ad82f3536954404546aa510ff09cf0c6c0567847272a9389e2e160a7b
```

{% endtab %}

{% tab title="Proxmox QCOW2 Hash" %}
The Proxmox QCOW2 file:

```
95adcfd293b29aee77c0c95b2d0a9a7f8f2f7829c49f20b3def16b5b28638e93
```

{% endtab %}
{% endtabs %}

## Step 3: Import the Virtual Appliance <a href="#import-ova-file" id="import-ova-file"></a>

When importing the REMnux virtual appliance, allocate resources such as RAM and disk space based on what you have available. REMnux is a relatively lightweight distro, but the more you allocate to it, the faster it will run. As a point of reference, most people find 4 GB RAM and 100 GB disk sufficient.

## Step 4: Start the REMnux Virtual Machine <a href="#start-remnux-vm" id="start-remnux-vm"></a>

Once you start your REMnux virtual machine, it will automatically log you into the REMnux environment.

There is no logon screen for accessing the REMnux environment, because analysts generally use REMnux on a system to which physical access is already restricted. When you need to elevate your privileges or access the REMnux virtual appliance remotely, note the following default credentials:

{% hint style="success" %}
Username: `remnux`\
Password: `malware`
{% endhint %}

If necessary, [change the keyboard layout](/tips/remnux-config-tips#keyboard-layout-change) of your system to match your locale and setup.

## Step 5: Consider Special Hypervisor Requirements <a href="#hypervisor-requirements" id="hypervisor-requirements"></a>

Depending on which hypervisor or environment you're using, you might need to take the following steps:

### VirtualBox

If your REMnux window is too small when you boot the system in VirtualBox, activate the Scaling Mode for the VM via the VirtualBox menu View > Scaling Mode.

If your REMnux virtual machine is unable to communicate over the network, check whether it has a network interface other than the loopback ("lo") by running the `ifconfig` command. If a non-loopback interface is missing, perform the following steps to add it:

1. Run the `networkctl` command to determine the name of the adapter ("link") of type "ether". It might be named something like "enp0s17".
2. Set up the network interface by replacing *YOUR\_NIC* in the following command with the name you've identified in the previous step (e.g., "enp0s17"): `sudo ip link set up YOUR_NIC`
3. Edit the /etc/netplan/01-netcfg.yaml file (e.g., use the `code` command). Under "ethernets:" replace the name there (e.g, "ens33") with the name of your network card (e.g., "enp0s17").
4. Reboot your REMnux virtual machine.

If you're building your own VirtualBox VM (not using the pre-built VirtualBox OVA), install VirtualBox Guest Additions from the ISO for full functionality:

1. Devices → Insert Guest Additions CD image
2. Navigate to the mounted CD under `/media/remnux/` and run `sudo ./VBoxLinuxAdditions.run`
3. Reboot

Note: The Ubuntu `virtualbox-guest-*` packages do not provide auto-resize and clipboard support. Use the ISO-based Guest Additions instead.

### VMware

If you experience an unresponsive keyboard, mouse, or broken clipboard/copy-paste when running REMnux in VMware, the issue is likely caused by VMware configuring the desktop to use Wayland instead of Xorg. To fix this:

1. Edit the GDM configuration file: `sudo nano /etc/gdm3/custom.conf`
2. Find the line `#WaylandEnable=false` and uncomment it by removing the `#`, so it reads `WaylandEnable=false`.
3. Reboot your REMnux virtual machine.

### Hyper-V

It's possible to import the pre-built REMnux virtual appliance into Hyper-V, but you'll need to take a few conversion steps. You'll need to extract the contents of the REMnux OVA file to obtain the enclosed VMDK file that captures the virtual disk of the distro, then convert it to the VHD format supported by Hyper-V:

1. Download the General OVA of the REMnux distro, as [outlined above](#download-virtual-appliance).
2. Extract the downloaded OVA file using a tool such as "tar". One of the extracted files will have the .vmdk.gz name, such as remnux-noble-disk1.vmdk.gz.
3. Decompress the extracted .vmdk.gz file using a tool such as "gunzip" to generate a file with the .vmdk extension.
4. Use [qemu-img](https://qemu.readthedocs.io/en/latest/tools/qemu-img.html) (`qemu-img convert -O vhdx -o subformat=dynamic`) or [StarWind V2V Converter](https://www.starwindsoftware.com/starwind-v2v-converter) to convert the .vmdk file to the VHD format supported by Hyper-V.
5. Import the generated VHD file into Hyper-V.

For an overview of this process, see the video [How To Install REMnux on Windows 10 Hyper-V](https://www.youtube.com/watch?v=d8uyVi0nH-U) by Cyrus.

### Remote Cloud, Such as AWS

The REMnux virtual appliance ships in "dedicated" installation mode, which automatically turns off the SSH daemon. This configuration is generally desirable when running REMnux in a local lab. If you're deploying the virtual appliance in a cloud environment, you might need to keep SSH enabled to remotely access your REMnux system. In that case:

1. Edit the /etc/remnux-config and change the mode from `dedicated` to `cloud`.
2. Enable the SSH daemon by running: `sudo systemctl enable ssh`.
3. Change the default user's password and otherwise strengthen the SSH authentication method according to your requirements and risk tolerance.
4. Reboot your REMnux system.

### KVM/QEMU

If you converted the REMnux virtual appliance to KVM/QEMU, use Standard VGA display for the first boot. After booting, run `remnux install` to automatically install spice-vdagent (display resize, copy/paste) and other KVM guest tools. You can then switch to SPICE for better graphics.

### Proxmox

REMnux provides a prebuilt QCOW2 virtual appliance optimized for Proxmox Virtual Environment. Download it from the [Proxmox QCOW2 link above](#download-virtual-appliance).

To import the QCOW2 file:

1. Upload the QCOW2 file to your Proxmox storage (e.g., via SCP to `/var/lib/vz/images/`).
2. Create a new VM with your preferred settings (recommended: 4 GB RAM, VirtIO SCSI, SPICE display).
3. Import the disk: `qm importdisk <vmid> /path/to/remnux-noble-amd64-proxmox.qcow2 local-lvm`
4. Attach the imported disk: VM > Hardware > double-click "Unused Disk" > Add.
5. Set boot order: VM > Options > Boot Order > enable the disk.

The QCOW2 image is pre-configured with:

* SPICE display support
* qemu-guest-agent
* spice-vdagent (clipboard, display resize)

If REMnux is stuck at a low resolution (such as 640x480) in Proxmox, run `remnux install` and reboot.

Alternative: You can also [import the general OVA](https://syncbricks.com/how-to-import-ova-to-proxmox/) using CPU type `qemu64`. For the first boot, set the display to Standard VGA (not SPICE). After booting, run `remnux install` to install guest tools and apply display fixes. You can then switch to SPICE for better graphics.

## Step 6: Upgrade the REMnux Virtual Machine <a href="#upgrade-remnux" id="upgrade-remnux"></a>

After installing the REMnux virtual machine, run the following command inside the VM as a regular, non-root user to upgrade it to the latest version of the distro:

```
remnux install
```

For more details about keeping your REMnux environment current, so you benefit from the latest enhancements, see the [Keeping REMnux Up to Date](/install-distro/keep-the-distro-up-to-date) section.

## Step 7: Take a Snapshot of the Virtual Machine <a href="#take-snapshot" id="take-snapshot"></a>

Consider taking a snapshot of your REMnux virtual machine, so you can return it to a known good state if the need arises.


# Install from Scratch

If [starting with a pre-built virtual appliance](/install-distro/get-virtual-appliance) is impractical or you prefer to customize all aspects of the system, you can build a dedicated REMnux environment from scratch by taking the following steps. This allows you to install the REMnux distro on a physical host or a virtual machine.

{% hint style="info" %}
REMnux is currently based on an x86/amd64 version of Ubuntu, and won't run on ARM processors such as Apple's M-series chips.
{% endhint %}

## Step 1: Install Ubuntu 24.04 <a href="#install-ubuntu" id="install-ubuntu"></a>

If you're looking to recreate the lightweight environment provided by the REMnux pre-built virtual appliance, start with the 64-bit Ubuntu 24.04 Server ISO installation file.

Download the latest Ubuntu 24.04 Server ISO image [from this Ubuntu page](https://releases.ubuntu.com/noble/).

* Be sure to select "64-bit PC (AMD64) server install image" as the file you'll download.
* As of this writing, [you can use this](https://releases.ubuntu.com/noble/ubuntu-24.04.3-live-server-amd64.iso) link, but if the link doesn't work, get it from the Ubuntu page.
* You can verify its integrity using the checksums provided on that Ubuntu download page.

If you're installing Ubuntu in a virtual machine, allocate resources based on what you have available. REMnux is a relatively lightweight distro, but the more you allocate to it, the faster it will run. For your reference, the [prebuilt REMnux virtual appliance](/install-distro/get-virtual-appliance) ships with 4 GB RAM and 100 GB disk.

Install Ubuntu 24.04 using the downloaded ISO installer:

1. Boot from the ISO and select "Try or Install Ubuntu Server".
2. Select your language and keyboard layout.
3. When prompted for the installation type, **select "Ubuntu Server (minimized)"**.
4. Configure the network. DHCP is typically fine; adjust if needed.
5. Skip the proxy configuration unless your environment requires it.
6. Accept the default Ubuntu archive mirror.
7. When configuring storage, **uncheck "Set up this disk as an LVM group"** to use a simpler partition layout.
8. When prompted for the profile setup, use the following to stay consistent with the default REMnux configuration:
   * Your name: `REMnux User`
   * Server's name: `remnux`
   * Username: `remnux`
   * Password: `malware`
9. Skip the Ubuntu Pro setup.
10. Don't install OpenSSH server unless you need remote access.
11. Don't select any additional snaps to install.
12. Wait for the installation to complete and reboot.

Boot into your new Ubuntu system. You should find yourself at the command prompt. Login using the credentials you specified during the Ubuntu installation.

{% hint style="info" %}
You don't need to separately update the OS or its packages. The REMnux installer handles that automatically.
{% endhint %}

## Step 2: Get the REMnux Installer <a href="#get-remnux-installer" id="get-remnux-installer"></a>

Download the REMnux installer from the REMnux website by running this command on your new Ubuntu system:

```
curl -O https://REMnux.org/remnux
```

Validate the SHA-256 hash of the downloaded file to make sure it matches this expected value:

```
c1e2dbc7191c4c3382deea2c5ecc40d729c271b7d6b8897caa5cbeb7e3e7d203
```

To generate the hash of your file, run:

```
sha256sum remnux
```

Set up the REMnux installer by running these commands:

```
chmod +x remnux
sudo mv remnux /usr/local/bin
```

## Step 3: Run the REMnux Installer <a href="#run-remnux-installer" id="run-remnux-installer"></a>

You're now ready to install the REMnux distro.

If you're planning to run REMnux in a local lab, kick off the installation by running this command:

```
sudo remnux install
```

If you're deploying REMnux in a remote cloud environment and will need to keep the SSH daemon enabled for remotely accessing the system, use the following command instead to avoid disabling the SSH daemon. Remember to harden the system after it installs to avoid unauthorized logins:

```
sudo remnux install --mode=cloud
```

The installation will take about an hour, depending on your resources and internet connection.

{% hint style="info" %}
If the REMnux installer produces an error, diagnose the issue by running:

```
remnux results
```

This command shows installation results and highlights any failures.

If you need further help, you can open an issue in [the REMnux salt-states repo on Github](https://github.com/REMnux/salt-states/issues) and share the output of `remnux results` as well as your results.yaml and saltstack.log files.
{% endhint %}

## Step 4: Reboot the REMnux System <a href="#reboot-remnux" id="reboot-remnux"></a>

Once the REMnux installation finishes, reboot your new REMnux system by typing:

```
sudo reboot
```

After the reboot, REMnux will automatically log you in. There is no logon screen for accessing the REMnux environment, because analysts generally use REMnux on a system to which physical access is already restricted.

If necessary, [change the keyboard layout](/tips/remnux-config-tips#keyboard-layout-change) of your system to match your locale and setup.

{% hint style="success" %}
To keep your REMnux environment up-to-date run the REMnux installer periodically as described in the [Keep the Distro Up to Date](/install-distro/keep-the-distro-up-to-date) section.
{% endhint %}

## Step 5: Review Configuration Tweaks Specific to Your Hypervisor <a href="#hypervisor-tweaks" id="hypervisor-tweaks"></a>

Depending on the hypervisor you're using, you might need to implement a few configuration tweaks to address or preempt issues with your REMnux virtual machine. Please review the [Special Hypervisor Requirements](/install-distro/get-virtual-appliance#hypervisor-requirements) before considering your installation finalized.

## Step 6: Take a Snapshot of the Virtual Machine <a href="#take-snapshot" id="take-snapshot"></a>

If you installed REMnux inside a virtual machine, consider taking a snapshot of the VM, so you can return it to a known good state if the need arises.


# Add to an Existing System

You can add REMnux to an existing system based on Ubuntu 24.04 by following instructions below. This configuration doesn't modify your system's look and feel, so you won't have the experience of the full REMnux environment. For the full experience, consider using the [REMnux virtual appliance](/install-distro/get-virtual-appliance).

{% hint style="info" %}
REMnux is currently based on an x86/amd64 version of Ubuntu, and won't run on ARM processors such as Apple's M-series chips.
{% endhint %}

## Step 1: Get the REMnux Installer <a href="#get-remnux-installer" id="get-remnux-installer"></a>

After logging into your existing system based on Ubuntu 24.04, download the REMnux installer:

```
curl -O https://REMnux.org/remnux
```

Validate the SHA-256 hash of the downloaded file to make sure it matches this expected value:

```
c1e2dbc7191c4c3382deea2c5ecc40d729c271b7d6b8897caa5cbeb7e3e7d203
```

To generate the hash of your file, run:

```
sha256sum remnux
```

Set up the REMnux installer by running these commands:

```
chmod +x remnux
sudo mv remnux /usr/local/bin
```

Before proceeding, make sure your system doesn't have an active Ubuntu unattended upgrade in progress. One way to do this is check whether the "unattended-upgrade" process is active (`ps aux | grep unattended-upgrade`.) If the upgrade is active, let it finish or [disable it](https://askubuntu.com/questions/1098757/ubuntu-18-10-unattended-upgrades-shutdown-wait-for-signal#1099258), then reboot the system before installing REMnux.

## Step 2: Run the REMnux Installer <a href="#run-remnux-installer" id="run-remnux-installer"></a>

You're now ready to install the REMnux distro. To kick off the installation, run:

```
sudo remnux install --mode=addon
```

The `addon` mode will avoid modifications that can modify the look and feel of your existing system. As a result, you won't get the experience of the standard REMnux environment.

The installation will take about an hour, depending on your resources and internet connection.

{% hint style="info" %}
If the REMnux installer produces an error, diagnose the issue by running:

```
remnux results
```

This command shows installation results and highlights any failures.

If you need further help, you can open an issue in [the REMnux salt-states repo on Github](https://github.com/REMnux/salt-states/issues) and share the output of `remnux results` as well as your results.yaml and saltstack.log files.
{% endhint %}

## Step 3: Reboot the REMnux System <a href="#reboot-remnux" id="reboot-remnux"></a>

Once the REMnux installation finishes, reboot your new REMnux system by typing:

```
sudo reboot
```

Login to your system to start benefiting from the tools that the REMnux distro includes.

{% hint style="success" %}
To keep your REMnux environment up-to-date run the REMnux installer periodically as described in the [Keep the Distro Up to Date](/install-distro/keep-the-distro-up-to-date) section.
{% endhint %}

## Step 4: Take a Snapshot of the Virtual Machine <a href="#take-snapshot" id="take-snapshot"></a>

If you installed REMnux inside a virtual machine, consider taking a snapshot of the VM, so you can return it to a known good state if the need arises.


# Run REMnux as a Container

You can run the REMnux distro as a [Docker](https://www.docker.com) container by using a prebuilt image, hosted in [the REMnux repository on Docker Hub](https://hub.docker.com/repository/docker/remnux/remnux-distro).

## Local Interactive Shell

If you have Docker installed, you can start the REMnux distro container in interactive mode, as explained below. The following command will automatically download the distro image (approximately 11 GB) if your system doesn't already have it.

To run the REMnux version built on top of Ubuntu 24.04 (Noble):

```
docker run --rm -it -u remnux remnux/remnux-distro:noble bash
```

To map a local directory into the container's /home/remnux/files directory, you could use a command like this, supplying the appropriate directory name:

```
docker run --rm -it -u remnux -v <local_directory>:/home/remnux/files remnux/remnux-distro:noble bash
```

The `--rm` parameter above directs Docker to create a transient container, which will stop running after you exit the shell. To keep the container active in the background even after you exit, don't supply `--rm`.

## SSH and Graphical Interface Access

To access the REMnux distro container using SSH, you can invoke it by mapping your system's TCP port 22 to the container's internal TCP port 22. One way to do this is to use the following command, which will open the SSH listener and run the container in the background.

To run the REMnux version built on top of Ubuntu 24.04 (Noble):

```
docker run -d -p 22:22 remnux/remnux-distro:noble
```

Once you've connected to your REMnux container using SSH, you can access the REMnux graphical interface by [tunneling the GUI through SSH](/tips/remnux-config-tips#gui-cloud-remnux).

## Tools Excluded from the Container

To minimize the container image size, the following tools are not included:

* **VS Code**: Access the container using VS Code's [Remote-SSH](https://code.visualstudio.com/docs/remote/ssh) extension from your host instead.
* **Wine and Wine-dependent tools**: scdbg, ssview, shellcode2exe-bat, and runsc.

To install these tools, run `remnux install --user remnux` in the container to upgrade to a full installation. Alternatively, selectively install packages using `apt update` followed by `apt install code`, `apt install scdbg`, etc.

For more details about Docker images available as part of the REMnux toolkit, see [Docker Images of Malware Analysis Tools](/run-tools-in-containers/remnux-containers).


# Keep the Distro Up to Date

## Upgrading and Updating the REMnux Distro <a href="#upgrading-updating-remnux" id="upgrading-updating-remnux"></a>

Unless you've installed REMnux in the `addon` mode, the distro disables automated Ubuntu update mechanisms for the OS. This allows you to control how and when your REMnux system attempts to initiate network connections, and avoids issues when running REMnux on an isolated network.

Keep your REMnux system up to date by running the following command once in a while as a regular, non-root user, so you benefit from the latest enhancements. Be sure to first connect the system to the internet. You don't need to separately update the OS or its packages. The REMnux installer handles that automatically.

```
remnux install
```

{% hint style="success" %}
If you're running the REMnux distro in a virtual machine, consider taking a snapshot before upgrading or updating your VM, so you can revert to a good state if something goes wrong.
{% endhint %}

## Issues Updating the REMnux Distro <a href="#issues-upgrading-updating-remnux" id="issues-upgrading-updating-remnux"></a>

If you receive an error upgrading or updating the REMnux distro, diagnose the problem by running:

```
remnux results
```

Also, consider rebooting your system and trying the operation again.

If the issue persists, you can open an issue in [the REMnux salt-states repo on GitHub](https://github.com/REMnux/salt-states/issues) and share the output of `remnux results` as well as your results.yaml and saltstack.log files.


# Examine Static Properties

Discover the Tools


# General

Examine Static Properties

## TrID

Identify file type using signatures.

**Website**: <https://mark0.net/soft-trid-e.html>\
**Author**: Marco Pontello\
**License**: Free, unknown license\
**Notes**: trid, tridupdate\
**State File**: [remnux.tools.trid](https://github.com/REMnux/salt-states/blob/master/remnux/tools/trid.sls)

## Magika

Identify file type using signatures.

**Website**: <https://google.github.io/magika>\
**Author**: Google\
**License**: Apache License 2.0: <https://github.com/google/magika/blob/main/LICENSE>\
**State File**: [remnux.python3-packages.magika](https://github.com/REMnux/salt-states/blob/master/remnux/python3-packages/magika.sls)

## Yara Rules

Scan a file with YARA rules to identify capabilities and behaviors (packer detection, anti-debug, networking).

**Website**: <https://github.com/Yara-Rules/rules>\
**Author**: A group of IT security researchers: <https://x.com/yararules>\
**License**: GNU General Public License (GPL) v2: <https://github.com/Yara-Rules/rules/blob/master/LICENSE>\
**Notes**: To scan a file using these rules, you can use the wrapper around Yara: `yara-rules FILE`, where `FILE` is the path to the file you wish to scan. For malware family identification, also try `yara-forge FILE`.\
**State File**: [remnux.tools.yara-rules](https://github.com/REMnux/salt-states/blob/master/remnux/tools/yara-rules.sls)

## Detect-It-Easy

Determine types of files and examine file properties.

**Website**: <https://github.com/horsicq/Detect-It-Easy>\
**Author**: hors: <https://x.com/horsicq>\
**License**: MIT License: <https://github.com/horsicq/Detect-It-Easy/blob/master/LICENSE>\
**Notes**: GUI tool: `die`, command-line tool: `diec`.\
**State File**: [remnux.tools.detect-it-easy](https://github.com/REMnux/salt-states/blob/master/remnux/tools/detect-it-easy.sls)

## ExifTool

Tool to read from, write to, and edit EXIF metadata of various file types.

**Website**: <https://exiftool.org/>\
**Author**: Phil Harvey\
**License**: "This is free software; you can redistribute it and/or modify it under the same terms as Perl itself": <https://exiftool.org/#license>\
**Notes**: exiftool\
**State File**: [remnux.perl-packages.exiftool](https://github.com/REMnux/salt-states/blob/master/remnux/perl-packages/exiftool.sls)

## DroidLysis

Perform static analysis of Android applications.

**Website**: <https://github.com/cryptax/droidlysis>\
**Author**: cryptax\
**License**: MIT License: <https://github.com/cryptax/droidlysis/blob/master/LICENSE>\
**Notes**: droidlysis\
**State File**: [remnux.python3-packages.droidlysis](https://github.com/REMnux/salt-states/blob/master/remnux/python3-packages/droidlysis.sls)

## msitools <a href="#msitools" id="msitools"></a>

Create, inspect and extract Windows Installer (.msi) files.

**Website**: <https://wiki.gnome.org/msitools>\
**Author**: Paolo Bonzini, Marc-Andre Lureau: <https://gitlab.gnome.org/GNOME/msitools/-/blob/master/AUTHORS>\
**License**: GNU Lesser General Public License (LGPL) v2.1 or later: <https://gitlab.gnome.org/GNOME/msitools/-/blob/master/copyright>\
**State File**: [remnux.packages.msitools](https://github.com/REMnux/salt-states/blob/master/remnux/packages/msitools.sls)

## numbers-to-string.py <a href="#numbers-to-string" id="numbers-to-string"></a>

Convert decimal numbers to strings.

**Website**: <https://blog.didierstevens.com/2020/12/12/update-numbers-to-string-py-version-0-0-11/>\
**Author**: Didier Stevens: <https://x.com/DidierStevens>\
**License**: Public Domain\
**State File**: [remnux.scripts.numbers-to-string](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/numbers-to-string.sls)

## re-search.py

Search the file for built-in regular expressions of common suspicious artifacts.

**Website**: <https://blog.didierstevens.com/2021/05/23/update-re-search-py-version-0-0-17/>\
**Author**: Didier Stevens: <https://x.com/DidierStevens>\
**License**: Public Domain\
**State File**: [remnux.scripts.re-search](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/re-search.sls)

## disitool

Manipulate embedded digital signatures.

**Website**: <https://blog.didierstevens.com/programs/disitool/>\
**Author**: Didier Stevens\
**License**: Public Domain\
**Notes**: disitool.py\
**State File**: [remnux.scripts.disitool](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/disitool.sls)

## Name-That-Hash

Identify dfferent types of hashes.

**Website**: <https://github.com/HashPals/Name-That-Hash>\
**Author**: Brandon / Bee: <https://x.com/bee_sec_san>\
**License**: GNU General Public License (GPL) v3.0: <https://github.com/HashPals/Name-That-Hash/blob/main/LICENSE>\
**Notes**: nth\
**State File**: [remnux.python3-packages.name-that-hash](https://github.com/REMnux/salt-states/blob/master/remnux/python3-packages/name-that-hash.sls)

## Hash ID

Identify different types of hashes.

**Website**: <https://github.com/blackploit/hash-identifier>\
**Author**: Zion3R\
**License**: GNU General Public License (GPL) v3\
**Notes**: hash-id.py\
**State File**: [remnux.scripts.hash-identifier](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/hash-identifier.sls)

## signsrch

Find patterns of common encryption, compression, or encoding algorithms.

**Website**: <http://aluigi.altervista.org/mytoolz.htm>\
**Author**: Luigi Auriemma\
**License**: Free, unknown license\
**State File**: [remnux.packages.signsrch](https://github.com/REMnux/salt-states/blob/master/remnux/packages/signsrch.sls)

## ssdeep

Compute Context Triggered Piecewise Hashes (CTPH), also known as fuzzy hashes.

**Website**: <https://ssdeep-project.github.io/ssdeep/index.html>\
**Author**: Jesse Kornblum, Helmut Grohne, Tsukasa OI\
**License**: GNU General Public License (GPL) v2: <https://github.com/ssdeep-project/ssdeep/blob/master/COPYING>\
**State File**: [remnux.packages.ssdeep](https://github.com/REMnux/salt-states/blob/master/remnux/packages/ssdeep.sls)

## 7-Zip

Compress and decompress files using a variety of algorithms.

**Website**: <https://www.7-zip.org>\
**Author**: Igor Pavlov\
**License**: GNU Lesser General Public License (LGPL)\
**Notes**: 7-Zip standard: 7z, 7za, 7zr. For latest alpha version, use 7zz instead of 7z.\
**State File**: [remnux.packages.7zip](https://github.com/REMnux/salt-states/blob/master/remnux/packages/7zip.sls)

## wxHexEditor

Hex editor.

**Website**: <https://sourceforge.net/projects/wxhexeditor/>\
**Author**: Unknown\
**License**: GNU General Public License (GPL) v2: <https://sourceforge.net/p/wxhexeditor/code/HEAD/tree/trunk/docs/GPL.txt>\
**State File**: [remnux.packages.wxhexeditor](https://github.com/REMnux/salt-states/blob/master/remnux/packages/wxhexeditor.sls)

## ClamAV

Scan files for malware signatures.

**Website**: <https://www.clamav.net>\
**Author**: <https://www.clamav.net/about>\
**License**: GNU General Public License (GPL): <https://www.clamav.net/about>\
**Notes**: clamscan, freshclam\
**State File**: [remnux.packages.clamav-daemon](https://github.com/REMnux/salt-states/blob/master/remnux/packages/clamav-daemon.sls)

## Hachoir

View, edit, and carve contents of various binary file types.

**Website**: <https://github.com/vstinner/hachoir>\
**Author**: <https://hachoir.readthedocs.io/en/latest/authors.html>\
**License**: GNU General Public License (GPL) v2: <https://github.com/vstinner/hachoir/blob/master/COPYING>\
**Notes**: hachoir-grep, hachoir-metadata, hachoir-strip, hachoir-wx\
**State File**: [remnux.python3-packages.hachoir](https://github.com/REMnux/salt-states/blob/master/remnux/python3-packages/hachoir.sls)

## Sleuth Kit

Analyze disk images and recover files from them.

**Website**: <https://www.sleuthkit.org/sleuthkit>\
**Author**: Brian Carrier, and others\
**License**: IBM Public License, Common Public License, GNU General Public License (GPL) v2: <https://www.sleuthkit.org/sleuthkit/licenses.php>\
**Notes**: For a listing of commands, see <https://wiki.sleuthkit.org/index.php?title=TSK\\_Tool\\_Overview\\>
**State File**: [remnux.packages.sleuthkit](https://github.com/REMnux/salt-states/blob/master/remnux/packages/sleuthkit.sls)

## binwalk

Extract and analyze firmware images.

**Website**: <https://github.com/ReFirmLabs/binwalk>\
**Author**: Craig Heffner, ReFirmLabs\
**License**: MIT License: <https://github.com/ReFirmLabs/binwalk/blob/master/LICENSE>\
**State File**: [remnux.packages.binwalk](https://github.com/REMnux/salt-states/blob/master/remnux/packages/binwalk.sls)

## file

Identify file type using "magic" numbers.

**Website**: <https://github.com/file/file>\
**Author**: Ian F. Darwin, Christos Zoulas\
**License**: BSD 2-Clause Simplified License: <https://github.com/file/file/blob/master/COPYING>\
**State File**: [remnux.packages.file](https://github.com/REMnux/salt-states/blob/master/remnux/packages/file.sls)

## bulk\_extractor

Extract interesting strings from binary files.

**Website**: <https://github.com/simsong/bulk_extractor/>\
**Author**: <https://github.com/simsong/bulk_extractor/blob/master/AUTHORS>\
**License**: Portions Public Domain, portions MIT License: <https://github.com/simsong/bulk_extractor/blob/master/LICENSE.md>\
**State File**: [remnux.packages.bulk-extractor](https://github.com/REMnux/salt-states/blob/master/remnux/packages/bulk-extractor.sls)

## thefuzz

Fuzzy String Matching in Python.

**Website**: <https://github.com/seatgeek/thefuzz>\
**Author**: SeatGeek\
**License**: MIT License: <https://github.com/seatgeek/thefuzz/blob/master/LICENSE.txt>\
**Notes**: Updated implementation of fuzzywuzzy\
**State File**: [remnux.python3-packages.thefuzz](https://github.com/REMnux/salt-states/blob/master/remnux/python3-packages/thefuzz.sls)

## strings.py

Extract ASCII and Unicode strings from binary files with length sorting and filtering.

**Website**: <https://blog.didierstevens.com/2020/12/19/update-strings-py-version-0-0-6/>\
**Author**: Didier Stevens: <https://x.com/DidierStevens>\
**License**: Public Domain\
**State File**: [remnux.scripts.didier-stevens-scripts](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/didier-stevens-scripts.sls)

## file-magic.py

Identify file types using the Python magic module.

**Website**: <https://blog.didierstevens.com/2018/07/11/new-tool-file-magic-py/>\
**Author**: Didier Stevens: <https://x.com/DidierStevens>\
**License**: Public Domain\
**State File**: [remnux.scripts.didier-stevens-scripts](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/didier-stevens-scripts.sls)

## YARA-Forge Rules

Scan files with curated YARA rules from 45+ sources for malware family identification.

**Website**: <https://yarahq.github.io/>\
**Author**: Florian Roth: <https://x.com/cyb3rops>\
**License**: Various (see individual rules); Elastic rules excluded\
**Notes**: Run `yara-forge FILE` to identify malware families.\
**State File**: [remnux.tools.yara-forge](https://github.com/REMnux/salt-states/blob/master/remnux/tools/yara-forge.sls)

## LIEF

Parse and analyze PE, ELF, MachO, DEX, OAT, VDEX, ART, and DWARF executable formats.

**Website**: <https://lief.re>\
**Author**: Romain Thomas: <https://github.com/romainthomas>\
**License**: Apache License 2.0: <https://github.com/lief-project/LIEF/blob/main/LICENSE>\
**Notes**: To use, run `/opt/lief/bin/python3` then `import lief`. Use `lief.parse("sample")` to auto-detect format and extract imports, exports, sections, and signatures.\
**State File**: [remnux.python3-packages.lief](https://github.com/REMnux/salt-states/blob/master/remnux/python3-packages/lief.sls)

## Malcat Lite

Analyze binary files using a hex editor, disassembler, and file dissector.

**Website**: <https://malcat.fr>\
**Author**: Malcat EI: <https://x.com/malcat4ever>\
**License**: Proprietary (Lite edition free): <https://malcat.fr/index.html>\
**Notes**: The Lite version of the tool may not be used in a professional environment per its license.\
**State File**: [remnux.tools.malcat](https://github.com/REMnux/salt-states/blob/master/remnux/tools/malcat.sls)


# PE Files

Examine Static Properties

## Manalyze

Perform static analysis of suspicious PE files.

**Website**: <https://github.com/JusticeRage/Manalyze>\
**Author**: Ivan Kwiatkowski: <https://x.com/JusticeRage>\
**License**: GNU General Public License (GPL) v3: <https://github.com/JusticeRage/Manalyze/blob/master/LICENSE.txt>\
**Notes**: Run "manalyze" to invoke the tool. To update the tool's Yara rules to include ClamAV, run "sudo python3 /usr/share/manalyze/yara\_rules/update\_clamav\_signatures.py". To query VirusTotal, add your API key to /etc/manalyze/manalyze.conf.\
**State File**: [remnux.packages.manalyze](https://github.com/REMnux/salt-states/blob/master/remnux/packages/manalyze.sls)

## PEframe

Statically analyze PE and Microsoft Office files.

**Website**: <https://github.com/digitalsleuth/peframe>\
**Author**: Gianni Amato: <https://x.com/guelfoweb>\
**License**: Free, unknown license\
**Notes**: peframe\
**State File**: [remnux.python3-packages.peframe](https://github.com/REMnux/salt-states/blob/master/remnux/python3-packages/peframe.sls)

## dllcharacteristics.py

Read and set DLL characteristics of a PE file.

**Website**: <https://github.com/accidentalrebel/dllcharacteristics.py>\
**Author**: Karlo Licudine: <https://x.com/accidentalrebel>\
**License**: GNU General Public License (GPL) v3.0: <https://github.com/accidentalrebel/dllcharacteristics.py/blob/master/LICENSE>\
**State File**: [remnux.scripts.dllcharacteristics](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/dllcharacteristics.sls)

## pefile

Python library for analyzing static properties of PE files.

**Website**: <https://github.com/erocarrera/pefile>\
**Author**: Ero Carrera: <http://blog.dkbza.org>\
**License**: MIT License: <https://github.com/erocarrera/pefile/blob/master/LICENSE>\
**Notes**: <https://github.com/erocarrera/pefile/blob/wiki/UsageExamples.md#introduction>\
**State File**: [remnux.python3-packages.pefile](https://github.com/REMnux/salt-states/blob/master/remnux/python3-packages/pefile.sls)

## PE Tree

Examine contents and structure of PE files.

**Website**: <https://github.com/blackberry/pe_tree>\
**Author**: BlackBerry Limited: <https://x.com/BlackBerrySpark> and Tom Bonner: <https://x.com/thomas_bonner>\
**License**: Apache License 2.0: <https://github.com/blackberry/pe_tree/blob/master/LICENSE>\
**Notes**: pe-tree\
**State File**: [remnux.python3-packages.pe-tree](https://github.com/REMnux/salt-states/blob/master/remnux/python3-packages/pe-tree.sls)

## pedump

Statically analyze PE files and extract their components (e.g., resources).

**Website**: <https://github.com/zed-0xff/pedump>\
**Author**: Andrey "Zed" Zaikin\
**License**: MIT License: <https://github.com/zed-0xff/pedump/blob/master/LICENSE.txt>\
**State File**: [remnux.rubygems.pedump](https://github.com/REMnux/salt-states/blob/master/remnux/rubygems/pedump.sls)

## pev

Analyze PE files and extract strings from them.

**Website**: <https://github.com/mentebinaria/readpe>\
**Author**: Fernando Merces, Jardel Weyrich\
**License**: GNU General Public License (GPL) v2: <https://github.com/mentebinaria/readpe/blob/master/LICENSE>\
**Notes**: pestr, readpe, pedis, pehash, pescan, peldd, peres\
**State File**: [remnux.packages.pev](https://github.com/REMnux/salt-states/blob/master/remnux/packages/pev.sls)

## PortEx

Statically analyze PE files.

**Website**: <https://github.com/katjahahn/PortEx>\
**Author**: Karsten Hahn: <https://x.com/struppigel>\
**License**: Apache License 2.0: <https://github.com/katjahahn/PortEx/blob/master/LICENSE>\
**Notes**: portex\
**State File**: [remnux.packages.portex](https://github.com/REMnux/salt-states/blob/master/remnux/packages/portex.sls)

## bearparser

Parse PE file contents.

**Website**: <https://github.com/hasherezade/bearparser/wiki>\
**Author**: hasherezade: <https://x.com/hasherezade>\
**License**: BSD 2-Clause "Simplified" License: <https://github.com/hasherezade/bearparser/blob/master/LICENSE>\
**Notes**: bearcommander\
**State File**: [remnux.packages.bearparser](https://github.com/REMnux/salt-states/blob/master/remnux/packages/bearparser.sls)

## debloat

Remove junk contents from bloated Windows executables.

**Website**: <https://github.com/Squiblydoo/debloat>\
**Author**: Squiblydoo: <https://x.com/SquiblydooBlog>\
**License**: BSD 3-Clause License: <https://github.com/Squiblydoo/debloat/blob/main/LICENSE>\
**Notes**: Run the command-line version as `debloat` or the GUI version as `debloat-gui`\
**State File**: [remnux.python3-packages.debloat](https://github.com/REMnux/salt-states/blob/master/remnux/python3-packages/debloat.sls)

## readpe (formerly pev)

Analyze PE files and extract strings from them.

**Website**: <https://github.com/mentebinaria/readpe>\
**Author**: Fernando Merces, Jardel Weyrich\
**License**: GNU General Public License (GPL) v2: <https://github.com/mentebinaria/readpe/blob/master/LICENSE>\
**Notes**: readpe, pestr, pedis, pehash, pescan, pesec, peldd, pepack, peres, ofs2rva, rva2ofs\
**State File**: [remnux.packages.pev](https://github.com/REMnux/salt-states/blob/master/remnux/packages/pev.sls)

## pecheck.py

Analyze static properties of PE files.

**Website**: <https://blog.didierstevens.com/2020/03/15/pecheck-py-version-0-7-10/>\
**Author**: Didier Stevens: <https://x.com/DidierStevens>\
**License**: Public Domain\
**State File**: [remnux.scripts.didier-stevens-scripts](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/didier-stevens-scripts.sls)

## disitool.py

Extract, delete, copy, and inject digital signatures in PE files.

**Website**: <https://blog.didierstevens.com/programs/disitool/>\
**Author**: Didier Stevens: <https://x.com/DidierStevens>\
**License**: Public Domain\
**State File**: [remnux.scripts.didier-stevens-scripts](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/didier-stevens-scripts.sls)


# ELF Files

Examine Static Properties

## pyelftools

Python library for parsing and analyzing ELF files and DWARF debugging information.

**Website**: <https://github.com/eliben/pyelftools>\
**Author**: Eli Bendersky\
**License**: Public Domain: <https://github.com/eliben/pyelftools/blob/master/LICENSE>\
**Notes**: readelf.py\
**State File**: [remnux.python3-packages.pyelftools](https://github.com/REMnux/salt-states/blob/master/remnux/python3-packages/pyelftools.sls)


# .NET

Examine Static Properties

## dnfile

Analyze static properties of .NET files.

**Website**: <https://github.com/malwarefrank/dnfile>\
**Author**: MalwareFrank\
**License**: MIT License: <https://github.com/malwarefrank/dnfile/blob/master/LICENSE>\
**Notes**: To use this library, create a Python program that imports it and loads the .NET file, as described in <https://github.com/malwarefrank/dnfile/blob/master/README.rst>.\
**State File**: [remnux.python3-packages.dnfile](https://github.com/REMnux/salt-states/blob/master/remnux/python3-packages/dnfile.sls)

## dotnetfile

Analyze static properties of .NET files.

**Website**: <https://github.com/pan-unit42/dotnetfile>\
**Author**: Palo Alto Networks Unit 42\
**License**: MIT License: <https://github.com/pan-unit42/dotnetfile/blob/main/LICENSE>\
**Notes**: You can use the command-line tool `dotnetfile_dump.py`. Alternatively, to use this library, create a Python program that imports it and loads the .NET file, as described in <https://github.com/pan-unit42/dotnetfile/blob/main/readme.md>.\
**State File**: [remnux.python3-packages.dotnetfile](https://github.com/REMnux/salt-states/blob/master/remnux/python3-packages/dotnetfile.sls)

## monodis

Disassemble and extract resources from .NET assemblies.

**Website**: <https://www.mono-project.com/docs/tools+libraries/tools/monodis/>\
**Author**: Mono Project: <https://www.mono-project.com>\
**License**: MIT License: <https://github.com/mono/mono/blob/main/LICENSE>\
**Notes**: Use `monodis --mresources assembly.dll` to extract .NET manifest resources. Use `monodis --presources assembly.dll` to list resources without extracting.\
**State File**: [remnux.packages.mono-utils](https://github.com/REMnux/salt-states/blob/master/remnux/packages/mono-utils.sls)


# Go

Examine Static Properties

## GoReSym

Extract metadata and symbols from Go binaries, including stripped ones.

**Website**: <https://github.com/mandiant/GoReSym>\
**Author**: Mandiant: <https://github.com/mandiant>\
**License**: MIT License: <https://github.com/mandiant/GoReSym/blob/master/LICENSE>\
**Notes**: GoReSym\
**State File**: [remnux.tools.goresym](https://github.com/REMnux/salt-states/blob/master/remnux/tools/goresym.sls)

## Redress

Analyze stripped Go binaries to recover symbols, types, source structure, and integrate with Radare2.

**Website**: <https://github.com/goretk/redress>\
**Author**: Joakim Kennedy: <https://github.com/goretk>\
**License**: GNU Affero General Public License v3.0: <https://github.com/goretk/redress/blob/develop/LICENSE>\
**Notes**: redress\
**State File**: [remnux.tools.redress](https://github.com/REMnux/salt-states/blob/master/remnux/tools/redress.sls)


# Deobfuscation

Examine Static Properties

## CyberChef

Decode and otherwise analyze data using this browser app.

**Website**: <https://github.com/gchq/CyberChef/>\
**Author**: GCHQ\
**License**: Apache License 2.0: <https://github.com/gchq/CyberChef/blob/master/LICENSE>\
**Notes**: cyberchef\
**State File**: [remnux.tools.cyberchef](https://github.com/REMnux/salt-states/blob/master/remnux/tools/cyberchef.sls)

## Malchive

Perform static analysis of various aspects of malicious code.

**Website**: <https://github.com/MITRECND/malchive>\
**Author**: The MITRE Corporation, <https://github.com/MITRECND/malchive/graphs/contributors>\
**License**: Apache License 2.0: <https://github.com/MITRECND/malchive/blob/main/LICENSE>\
**Notes**: Malchive command-line tools start with the prefix `malutil-`. See [utilities documentation](https://github.com/MITRECND/malchive/wiki/Utilities) for details.\
**State File**: [remnux.python3-packages.malchive](https://github.com/REMnux/salt-states/blob/master/remnux/python3-packages/malchive.sls)

## Cobalt Strike Configuration Extractor (CSCE) and Parser <a href="#csce" id="csce"></a>

Analyze Cobalt Strike beacons.

**Website**: <https://github.com/strozfriedberg/cobaltstrike-config-extractor>\
**Author**: Aon / Stroz Friedberg\
**License**: Apache License 2.0: <https://github.com/strozfriedberg/cobaltstrike-config-extractor/blob/master/LICENSE>\
**Notes**: csce, list-cs-settings\
**State File**: [remnux.python3-packages.csce](https://github.com/REMnux/salt-states/blob/master/remnux/python3-packages/csce.sls)

## xortool

Analyze XOR-encoded data.

**Website**: <https://github.com/hellman/xortool>\
**Author**: Aleksei Hellman\
**License**: MIT License: <https://github.com/hellman/xortool/blob/master/LICENSE>\
**State File**: [remnux.python3-packages.xortool](https://github.com/REMnux/salt-states/blob/master/remnux/python3-packages/xortool.sls)

## DC3-MWCP

Parsing configuration information from malware.

**Website**: <https://github.com/Defense-Cyber-Crime-Center/DC3-mwcp>\
**Author**: Defense Cyber Crime Center - United States Government\
**License**: Some parts Public Domain, some MIT License: <https://github.com/Defense-Cyber-Crime-Center/DC3-mwcp/blob/master/LICENSE.txt>\
**Notes**: mwcp\
**State File**: [remnux.python3-packages.dc3-mwcp](https://github.com/REMnux/salt-states/blob/master/remnux/python3-packages/dc3-mwcp.sls)

## unicode

Display Unicode character properties.

**Website**: <https://github.com/garabik/unicode>\
**Author**: Radovan Garabik\
**License**: GNU General Public License (GPL) v3: <https://github.com/garabik/unicode/blob/master/COPYING>\
**State File**: [remnux.python3-packages.unicode](https://github.com/REMnux/salt-states/blob/master/remnux/python3-packages/unicode.sls)

## Chepy

Decode and otherwise analyze data using this command-line tool and Python library.

**Website**: <https://github.com/securisec/chepy>\
**Author**: securisec: <https://x.com/securisec>\
**License**: GNU General Public License (GPL) v3: <https://github.com/securisec/chepy/blob/master/LICENSE>\
**Notes**: chepy\
**State File**: [remnux.python3-packages.chepy](https://github.com/REMnux/salt-states/blob/master/remnux/python3-packages/chepy.sls)

## Balbuzard

Extract and deobfuscate patterns from suspicious files.

**Website**: <https://github.com/digitalsleuth/balbuzard>\
**Author**: Philippe Lagadec / Corey Forman (digitalsleuth)\
**License**: Free, custom license: <https://github.com/digitalsleuth/balbuzard>\
**Notes**: balbuzard, bbcrack, bbharvest, bbtrans\
**State File**: [remnux.python3-packages.balbuzard](https://github.com/REMnux/salt-states/blob/master/remnux/python3-packages/balbuzard.sls)

## NoMoreXOR.py

Help guess a file's 256-byte XOR by using frequency analysis.

**Website**: <https://github.com/digitalsleuth/NoMoreXOR>\
**Author**: Glenn P. Edwards Jr.\
**License**: Free, unknown license\
**State File**: [remnux.scripts.nomorexor](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/nomorexor.sls)

## unXOR

Deobfuscate XOR'ed files.

**Website**: <https://github.com/tomchop/unxor/>\
**Author**: Thomas Chopitea\
**License**: Apache License 2.0: <https://github.com/tomchop/unxor/blob/master/LICENSE>\
**State File**: [remnux.scripts.unxor](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/unxor.sls)

## brxor.py

Bruteforce XOR'ed strings to find those that are English words.

**Website**: <https://github.com/REMnux/distro/blob/master/files/brxor.py>\
**Author**: Alexander Hanel, Trenton Tait\
**License**: Free, unknown license\
**State File**: [remnux.scripts.brxor](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/brxor.sls)

## xorBruteForcer.py

Bruteforce an XOR-encoded file.

**Website**: <https://eternal-todo.com/category/bruteforcer>\
**Author**: Jose Miguel Esparza\
**License**: Free, unknown license\
**State File**: [remnux.scripts.xorbruteforcer](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/xorbruteforcer.sls)

## strdeob.pl

Locate and decode stack strings in executable files.

**Website**: <https://github.com/REMnux/distro/blob/master/files/strdeob.pl>\
**Author**: TotalHash\
**License**: Free, unknown license\
**State File**: [remnux.scripts.strdeob](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/strdeob.sls)

## XORStrings

Search for XOR encoded strings in a file.

**Website**: <https://blog.didierstevens.com/2013/04/15/new-tool-xorstrings/>\
**Author**: Didier Stevens\
**License**: Free, unknown license\
**State File**: [remnux.packages.xorstrings](https://github.com/REMnux/salt-states/blob/master/remnux/packages/xorstrings.sls)

## XORSearch

Locate and decode strings obfuscated using common techniques.

**Website**: <https://blog.didierstevens.com/programs/xorsearch/>\
**Author**: Didier Stevens: <https://x.com/DidierStevens>\
**License**: Public Domain\
**Notes**: xorsearch\
**State File**: [remnux.packages.xorsearch](https://github.com/REMnux/salt-states/blob/master/remnux/packages/xorsearch.sls)

## FLOSS

Extract and deobfuscate strings from PE executables.

**Website**: <https://github.com/mandiant/flare-floss>\
**Author**: Mandiant, Willi Ballenthin: <https://x.com/williballenthin>, Moritz Raabe\
**License**: Apache License 2.0: <https://github.com/mandiant/flare-floss/blob/master/LICENSE.txt>\
**Notes**: floss\
**State File**: [remnux.packages.flare-floss](https://github.com/REMnux/salt-states/blob/master/remnux/packages/flare-floss.sls)

## ex\_pe\_xor.py

Search an XOR'ed file for indications of executable binaries.

**Website**: <https://hooked-on-mnemonics.blogspot.com/2014/04/expexorpy.html>\
**Author**: Alexander Hanel\
**License**: Free, unknown license\
**State File**: [remnux.scripts.ex-pe-xor](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/ex-pe-xor.sls)

## cs-decrypt-metadata.py

Decrypt Cobalt Strike metadata.

**Website**: <https://blog.didierstevens.com/2021/11/12/update-cs-decrypt-metadata-py-version-0-0-2/>\
**Author**: Didier Stevens: <https://x.com/DidierStevens>\
**License**: Public Domain\
**State File**: [remnux.scripts.didier-stevens-scripts](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/didier-stevens-scripts.sls)

## base64dump.py

Locate and decode strings encoded in Base64 and other common encodings.

**Website**: <https://blog.didierstevens.com/2020/07/03/update-base64dump-py-version-0-0-12/>\
**Author**: Didier Stevens: <https://x.com/DidierStevens>\
**License**: Public Domain\
**State File**: [remnux.scripts.didier-stevens-scripts](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/didier-stevens-scripts.sls)

## xor-kpa.py

Implement a XOR known plaintext attack.

**Website**: <https://blog.didierstevens.com/2017/06/06/update-xor-kpa-py-version-0-0-5/>\
**Author**: Didier Stevens: <https://x.com/DidierStevens>\
**License**: Public Domain\
**State File**: [remnux.scripts.didier-stevens-scripts](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/didier-stevens-scripts.sls)

## cut-bytes.py

Cut out a part of a data stream.

**Website**: <https://blog.didierstevens.com/2015/10/14/cut-bytes-py/>\
**Author**: Didier Stevens: <https://x.com/DidierStevens>\
**License**: Public Domain\
**State File**: [remnux.scripts.didier-stevens-scripts](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/didier-stevens-scripts.sls)

## format-bytes.py

Decompose structured binary data with format strings.

**Website**: <https://blog.didierstevens.com/2020/02/17/update-format-bytes-py-version-0-0-13/>\
**Author**: Didier Stevens: <https://x.com/DidierStevens>\
**License**: Public Domain\
**State File**: [remnux.scripts.didier-stevens-scripts](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/didier-stevens-scripts.sls)

## translate.py

Translate bytes according to a Python expression.

**Website**: <https://blog.didierstevens.com/programs/translate/>\
**Author**: Didier Stevens: <https://x.com/DidierStevens>\
**License**: Public Domain\
**State File**: [remnux.scripts.didier-stevens-scripts](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/didier-stevens-scripts.sls)

## sets.py

Perform set operations on lines or bytes in text files.

**Website**: <https://blog.didierstevens.com/2017/03/05/new-tool-sets-py/>\
**Author**: Didier Stevens: <https://x.com/DidierStevens>\
**License**: Public Domain\
**State File**: [remnux.scripts.didier-stevens-scripts](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/didier-stevens-scripts.sls)

## 1768.py

Analyze Cobalt Strike beacons.

**Website**: <https://blog.didierstevens.com/2021/05/22/update-1768-py-version-0-0-6/>\
**Author**: Didier Stevens: <https://x.com/DidierStevens>\
**License**: Public Domain\
**State File**: [remnux.scripts.didier-stevens-scripts](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/didier-stevens-scripts.sls)

## xorsearch.py

Search for XOR, ROL, ROT, and SHIFT encoded strings with YARA and regex support.

**Website**: <https://blog.didierstevens.com/2020/08/23/new-tool-xorsearch-py/>\
**Author**: Didier Stevens: <https://x.com/DidierStevens>\
**License**: Public Domain\
**State File**: [remnux.scripts.didier-stevens-scripts](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/didier-stevens-scripts.sls)

## re-search.py

Search files using regular expressions from a built-in library or custom patterns.

**Website**: <https://blog.didierstevens.com/2023/04/03/update-re-search-py-version-0-0-22/>\
**Author**: Didier Stevens: <https://x.com/DidierStevens>\
**License**: Public Domain\
**State File**: [remnux.scripts.didier-stevens-scripts](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/didier-stevens-scripts.sls)

## hex-to-bin.py

Convert hexadecimal text dumps to binary data.

**Website**: <https://blog.didierstevens.com/2020/04/19/update-hex-to-bin-py-version-0-0-5/>\
**Author**: Didier Stevens: <https://x.com/DidierStevens>\
**License**: Public Domain\
**State File**: [remnux.scripts.didier-stevens-scripts](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/didier-stevens-scripts.sls)

## numbers-to-string.py

Translate number sequences into ASCII characters.

**Website**: <https://blog.didierstevens.com/2020/12/12/update-numbers-to-string-py-version-0-0-11/>\
**Author**: Didier Stevens: <https://x.com/DidierStevens>\
**License**: Public Domain\
**State File**: [remnux.scripts.didier-stevens-scripts](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/didier-stevens-scripts.sls)

## cs-analyze-processdump.py

Analyze Cobalt Strike beacon process dumps to detect sleep mask encoding.

**Website**: <https://blog.didierstevens.com/2021/11/25/new-tool-cs-analyze-processdump-py/>\
**Author**: Didier Stevens: <https://x.com/DidierStevens>\
**License**: Public Domain\
**State File**: [remnux.scripts.didier-stevens-scripts](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/didier-stevens-scripts.sls)

## cs-extract-key.py

Extract AES and HMAC keys from Cobalt Strike beacon process memory.

**Website**: <https://blog.didierstevens.com/2021/11/03/new-tool-cs-extract-key-py/>\
**Author**: Didier Stevens: <https://x.com/DidierStevens>\
**License**: Public Domain\
**State File**: [remnux.scripts.didier-stevens-scripts](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/didier-stevens-scripts.sls)


# Statically Analyze Code

Discover the Tools


# General

Statically Analyze Code

## Ghidra

Software reverse engineering tool suite.

**Website**: <https://ghidra-sre.org>\
**Author**: National Security Agency\
**License**: Apache License 2.0: <https://github.com/NationalSecurityAgency/ghidra/blob/master/LICENSE>\
**Notes**: Close CodeBrowser before exiting Ghidra to prevent Ghidra from freezing when you reopen the tool (it's a Ghidra bug).\
**State File**: [remnux.packages.ghidra](https://github.com/REMnux/salt-states/blob/master/remnux/packages/ghidra.sls)

## Cutter

Reverse engineering platform powered by Rizin.

**Website**: <https://cutter.re>\
**Author**: <https://github.com/rizinorg/cutter/graphs/contributors>\
**License**: GNU General Public License (GPL) v3.0: <https://github.com/rizinorg/cutter/blob/master/COPYING>\
**Notes**: If you're planning to use Cutter when running REMnux as a Docker container, you'll need to include the `--privileged` parameter when invoking the REMnux distro image in Docker.\
**State File**: [remnux.tools.cutter](https://github.com/REMnux/salt-states/blob/master/remnux/tools/cutter.sls)

## Detect-It-Easy <a href="#detect-it-easy" id="detect-it-easy"></a>

Determine types of files and examine file properties.

**Website**: <https://github.com/horsicq/Detect-It-Easy>\
**Author**: hors: <https://x.com/horsicq>\
**License**: MIT License: <https://github.com/horsicq/Detect-It-Easy/blob/master/LICENSE>\
**Notes**: GUI tool: `die`, command-line tool: `diec`.\
**State File**: [remnux.tools.detect-it-easy](https://github.com/REMnux/salt-states/blob/master/remnux/tools/detect-it-easy.sls)

## Qiling

Emulate code execution of PE files, shellcode, etc. for a variety of OS and hardware platforms.

**Website**: <https://www.qiling.io>\
**Author**: <https://github.com/qilingframework/qiling/blob/master/AUTHORS.TXT>\
**License**: GNU General Public License (GPL) v2.0: <https://github.com/qilingframework/qiling/blob/master/COPYING>\
**Notes**: Use `qltool` to analyze artifacts. Before analyzing Windows artifacts, gather Windows DLLs and other components using the [dllscollector.bat](https://github.com/qilingframework/qiling/blob/master/examples/scripts/dllscollector.bat) script. Read the tool's [documentation](https://docs.qiling.io) to get started.\
**State File**: [remnux.python3-packages.qiling](https://github.com/REMnux/salt-states/blob/master/remnux/python3-packages/qiling.sls)

## Vivisect

Statically examine and emulate binary files.

**Website**: <https://github.com/vivisect/vivisect>\
**Author**: invisigoth: <invisigoth@kenshoto.com>, installable vivisect module by Willi Ballenthin: <https://x.com/williballenthin>\
**License**: Apache License 2.0: <https://github.com/vivisect/vivisect/blob/master/LICENSE.txt>\
**Notes**: vivbin, vdbbin\
**State File**: [remnux.python3-packages.vivisect](https://github.com/REMnux/salt-states/blob/master/remnux/python3-packages/vivisect.sls)

## objdump

Disassemble binary files.

**Website**: <https://en.wikipedia.org/wiki/Objdump>\
**Author**: Unknown\
**License**: GNU General Public License (GPL)\
**State File**: [remnux.packages.binutils](https://github.com/REMnux/salt-states/blob/master/remnux/packages/binutils.sls)

## radare2

Examine binary files, including disassembling and debugging. Includes r2ai and decai plugins for LLM-powered analysis (API key or local Ollama required), plus the r2ghidra plugin for Ghidra decompilation via the pdg command.

**Website**: <https://www.radare.org/n/radare2.html>\
**Author**: <https://github.com/radareorg/radare2/blob/master/AUTHORS.md>\
**License**: GNU Lesser General Public License (LGPL) v3: <https://github.com/radareorg/radare2/blob/master/COPYING>\
**Notes**: r2, rasm2, rabin2, rahash2, rafind2, r2ai, decai, pdg\
**State File**: [remnux.packages.radare2](https://github.com/REMnux/salt-states/blob/master/remnux/packages/radare2.sls)


# Unpacking

Statically Analyze Code

## TrID

Identify file type using signatures.

**Website**: <https://mark0.net/soft-trid-e.html>\
**Author**: Marco Pontello\
**License**: Free, unknown license\
**Notes**: trid, tridupdate\
**State File**: [remnux.tools.trid](https://github.com/REMnux/salt-states/blob/master/remnux/tools/trid.sls)

## Bytehist

Generate byte-usage-histograms for all types of files with a focus on PE files.

**Website**: <https://www.cert.at/downloads/software/bytehist_en.html>\
**Author**: Christian Wojner: <https://x.com/Didelphodon>\
**License**: ISC License: <https://en.wikipedia.org/wiki/ISC_license>\
**Notes**: bytehist\
**State File**: [remnux.tools.bytehist](https://github.com/REMnux/salt-states/blob/master/remnux/tools/bytehist.sls)

## ClamAV

Scan files for malware signatures.

**Website**: <https://www.clamav.net>\
**Author**: <https://www.clamav.net/about>\
**License**: GNU General Public License (GPL): <https://www.clamav.net/about>\
**Notes**: clamscan, freshclam\
**State File**: [remnux.packages.clamav-daemon](https://github.com/REMnux/salt-states/blob/master/remnux/packages/clamav-daemon.sls)

## binwalk

Extract and analyze firmware images.

**Website**: <https://github.com/ReFirmLabs/binwalk>\
**Author**: Craig Heffner, ReFirmLabs\
**License**: MIT License: <https://github.com/ReFirmLabs/binwalk/blob/master/LICENSE>\
**State File**: [remnux.packages.binwalk](https://github.com/REMnux/salt-states/blob/master/remnux/packages/binwalk.sls)

## UPX

Pack and unpack PE files.

**Website**: <https://upx.github.io>\
**Author**: Markus Oberhumer, Laszlo Molnar\
**License**: GNU General Public License (GPL): <https://github.com/upx/upx/blob/master/LICENSE>\
**Notes**: upx\
**State File**: [remnux.packages.upx-ucl](https://github.com/REMnux/salt-states/blob/master/remnux/packages/upx-ucl.sls)


# PE Files

Statically Analyze Code

## Malchive

Perform static analysis of various aspects of malicious code.

**Website**: <https://github.com/MITRECND/malchive>\
**Author**: The MITRE Corporation, <https://github.com/MITRECND/malchive/graphs/contributors>\
**License**: Apache License 2.0: <https://github.com/MITRECND/malchive/blob/main/LICENSE>\
**Notes**: Malchive command-line tools start with the prefix `malutil-`. See [utilities documentation](https://github.com/MITRECND/malchive/wiki/Utilities) for details.\
**State File**: [remnux.python3-packages.malchive](https://github.com/REMnux/salt-states/blob/master/remnux/python3-packages/malchive.sls)

## Speakeasy

Emulate code execution, including shellcode, Windows drivers, and Windows PE files.

**Website**: <https://github.com/mandiant/speakeasy>\
**Author**: Mandiant, Andrew Davis\
**License**: MIT License: <https://github.com/mandiant/speakeasy/blob/master/LICENSE.txt>\
**Notes**: To run the tool, use `speakeasy`, `emu_exe.py`, and `emu_dll.py` commands.\
**State File**: [remnux.python3-packages.speakeasy](https://github.com/REMnux/salt-states/blob/master/remnux/python3-packages/speakeasy.sls)

## binee (Binary Emulation Environment)

Analyze I/O operations of a suspicious PE file by emulating its execution.

**Website**: <https://github.com/carbonblack/binee>\
**Author**: Carbon Black, Kyle Gwinnup, John Holowczak\
**License**: GNU General Public License (GPL) v2: <https://github.com/carbonblack/binee/blob/master/LICENSE>\
**Notes**: Before using this tool, place the files your sample requires under /opt/binee-files/win10\_32. For example, the Windows DLLs it needs should go /opt/binee-files/win10\_32/windows/system32. If you have a Windows 10 64-bit system, you can get the 32-bit DLLs from C:\Windows\SysWOW64 To check which DLLs you might need by examining the import table using the "-i" parameter.\
**State File**: [remnux.packages.binee](https://github.com/REMnux/salt-states/blob/master/remnux/packages/binee.sls)

## mbcscan

Scan a PE file to list the associated Malware Behavior Catalog (MBC) details.

**Website**: <https://github.com/accidentalrebel/mbcscan>\
**Author**: Karlo Licudine: <https://x.com/accidentalrebel>\
**License**: GNU General Public License (GPL) v3.0: <https://github.com/accidentalrebel/mbcscan/blob/master/LICENSE>\
**Notes**: mbcscan.py\
**State File**: [remnux.scripts.mbcscan](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/mbcscan.sls)

## capa

Detect suspicious capabilities in PE files.

**Website**: <https://github.com/mandiant/capa>\
**Author**: Mandiant, Willi Ballenthin: <https://x.com/williballenthin>, Moritz Raabe: <https://x.com/m_r_tz>\
**License**: Apache License 2.0: <https://github.com/mandiant/capa/blob/master/LICENSE.txt>\
**State File**: [remnux.tools.capa](https://github.com/REMnux/salt-states/blob/master/remnux/tools/capa.sls)


# Python

Statically Analyze Code

## PyInstaller Extractor

Extract contents of a PyInstaller-generated PE files.

**Website**: <https://github.com/extremecoders-re/pyinstxtractor>\
**Author**: extremecoders-re\
**License**: GNU General Public License (GPL) v3: <https://github.com/extremecoders-re/pyinstxtractor/blob/master/LICENSE>\
**Notes**: pyinstxtractor.py\
**State File**: [remnux.scripts.pyinstaller-extractor](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/pyinstaller-extractor.sls)

## Decompyle++

Python bytecode disassembler and decompiler.

**Website**: <https://github.com/zrax/pycdc>\
**Author**: Michael Hansen, Darryl Pogue\
**License**: GNU General Public License (GPL) v3: <https://github.com/zrax/pycdc/blob/master/LICENSE>\
**Notes**: pycdas, pycdc\
**State File**: [remnux.packages.pycdc](https://github.com/REMnux/salt-states/blob/master/remnux/packages/pycdc.sls)

## pyinstxtractor-ng

Extract contents of PyInstaller-generated executables without requiring a matching Python version.

**Website**: <https://github.com/pyinstxtractor/pyinstxtractor-ng>\
**Author**: extremecoders-re\
**License**: GNU General Public License v3.0: <https://github.com/pyinstxtractor/pyinstxtractor-ng/blob/main/LICENSE>\
**Notes**: pyinstxtractor-ng\
**State File**: [remnux.python3-packages.pyinstxtractor-ng](https://github.com/REMnux/salt-states/blob/master/remnux/python3-packages/pyinstxtractor-ng.sls)

## uncompyle6

Python cross-version bytecode decompiler for Python 1.0 through 3.8.

**Website**: <https://github.com/rocky/python-uncompyle6>\
**Author**: Rocky Bernstein: <https://github.com/rocky>\
**License**: GNU General Public License v3.0: <https://github.com/rocky/python-uncompyle6/blob/master/COPYING>\
**Notes**: uncompyle6\
**State File**: [remnux.python3-packages.uncompyle6](https://github.com/REMnux/salt-states/blob/master/remnux/python3-packages/uncompyle6.sls)


# Scripts

## JS Beautifier

Reformat JavaScript scripts for easier analysis.

**Website**: <https://beautifier.io/>\
**Author**: Einar Lielmanis, Liam Newman, and contributors\
**License**: MIT License: <https://github.com/beautify-web/js-beautify/blob/master/LICENSE>\
**Notes**: js-beautify\
**State File**: [remnux.python3-packages.jsbeautifier](https://github.com/REMnux/salt-states/blob/master/remnux/python3-packages/jsbeautifier.sls)

## decode-vbe.py

Decode encoded VBS scripts (VBE).

**Website**: <https://blog.didierstevens.com/2016/03/29/decoding-vbe/>\
**Author**: Didier Stevens: <https://x.com/DidierStevens>\
**License**: Public Domain\
**State File**: [remnux.scripts.didier-stevens-scripts](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/didier-stevens-scripts.sls)

## AutoIt-Ripper

Extract AutoIt scripts embedded in PE binaries.

**Website**: <https://github.com/nazywam/AutoIt-Ripper>\
**Author**: Michał Praszmo: <https://x.com/nazywam>\
**License**: MIT License: <https://github.com/nazywam/AutoIt-Ripper/blob/master/LICENSE>\
**Notes**: autoit-ripper\
**State File**: [remnux.python3-packages.autoit-ripper](https://github.com/REMnux/salt-states/blob/master/remnux/python3-packages/autoit-ripper.sls)

## GootLoaderAutoJsDecode.py

Statically deobfuscate GootLoader (GOOTLOADER) malicious JScript to recover the payload and extract C2 domains.

**Website**: <https://github.com/mandiant/gootloader>\
**Author**: Mandiant: <https://github.com/mandiant>\
**License**: Apache License 2.0: <https://github.com/mandiant/gootloader/blob/main/LICENSE.txt>\
**Notes**: gootloader-decode. Run `gootloader-decode malicious.js`; it writes DecodedJsPayload.js\_ and FileAndTaskData.txt to the working directory and prints extracted domains. Only the safe static decoder is packaged; the repo's dynamic and manual scripts execute malware code and are intentionally excluded.\
**State File**: [remnux.scripts.gootloader](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/gootloader.sls)


# Java

Statically Analyze Code

## cfr

Java decompiler.

**Website**: <https://www.benf.org/other/cfr/>\
**Author**: Lee Benfield\
**License**: MIT License: <https://github.com/leibnitz27/cfr/blob/master/LICENSE>\
**State File**: [remnux.tools.cfr](https://github.com/REMnux/salt-states/blob/master/remnux/tools/cfr.sls)

## JD-GUI Java Decompiler

Java decompiler with GUI.

**Website**: <https://java-decompiler.github.io/>\
**Author**: Emmanuel Dupuy\
**License**: GNU General Public License (GPL) v3: <https://github.com/java-decompiler/jd-gui/blob/master/LICENSE>\
**Notes**: jd-gui\
**State File**: [remnux.tools.jd-gui](https://github.com/REMnux/salt-states/blob/master/remnux/tools/jd-gui.sls)

## Java IDX Parser

Analyze Java IDX files.

**Website**: <https://github.com/digitalsleuth/Java_IDX_Parser>\
**Author**: Brian Baskin: <https://x.com/bbaskin>, Updated for Python 3 by Corey Forman\
**License**: Apache License 2.0: <https://github.com/digitalsleuth/Java_IDX_Parser/blob/master/LICENSE>\
**Notes**: idx\_parser.py\
**State File**: [remnux.scripts.java-idx-parser](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/java-idx-parser.sls)

## Javassist

Java bytecode engineering toolkit/library.

**Website**: <https://www.javassist.org/>\
**Author**: Shigeru Chiba\
**License**: Mozilla Public License, GNU Lesser General Public License (LGPL) v2.1 or later, Apache License 2.0: <https://github.com/jboss-javassist/javassist/blob/master/License.html>\
**Notes**: Library installed in /usr/share/java/\
**State File**: [remnux.packages.libjavassist-java](https://github.com/REMnux/salt-states/blob/master/remnux/packages/libjavassist-java.sls)

## Procyon

Java decompiler.

**Website**: <https://github.com/mstrobel/procyon>\
**Author**: Mike Strobel\
**License**: Apache License 2.0: <https://github.com/mstrobel/procyon/blob/develop/License.txt>\
**Notes**: procyon\
**State File**: [remnux.packages.procyon-decompiler](https://github.com/REMnux/salt-states/blob/master/remnux/packages/procyon-decompiler.sls)


# .NET

Statically Analyze Code

## de4dot

Deobfuscate and unpack .NET programs.

**Website**: <https://github.com/0xd4d/de4dot>\
**Author**: 0xd4d\
**License**: GNU General Public License (GPL) v3.0: <https://github.com/0xd4d/de4dot/blob/master/COPYING>\
**State File**: [remnux.tools.de4dot](https://github.com/REMnux/salt-states/blob/master/remnux/tools/de4dot.sls)

## ILSpy

Examine and decompile .NET programs.

**Website**: <https://github.com/icsharpcode/ILSpy>\
**Author**: AlphaSierraPapa and <https://github.com/icsharpcode/ILSpy/graphs/contributors>\
**License**: MIT License: <https://github.com/icsharpcode/ILSpy/blob/master/doc/ILSpyAboutPage.txt>\
**Notes**: This is the command-line version of ILSpy, which you can run using the `ilspycmd` command.\
**State File**: [remnux.packages.ilspy](https://github.com/REMnux/salt-states/blob/master/remnux/packages/ilspy.sls)


# Android

Statically Analyze Code

## JADX

Generate Java source code from Dalvik Executable (dex) and Android APK files.

**Website**: <https://github.com/skylot/jadx>\
**Author**: Skylot\
**License**: Apache License 2.0: <https://github.com/skylot/jadx/blob/master/LICENSE>, also see <https://github.com/skylot/jadx/blob/master/NOTICE>\
**Notes**: jadx, jadx-gui\
**State File**: [remnux.tools.jadx](https://github.com/REMnux/salt-states/blob/master/remnux/tools/jadx.sls)

## apktool

Reverse-engineer Android APK files.

**Website**: <https://ibotpeaches.github.io/Apktool/>\
**Author**: Connor Tumbleson, Ryszard Wisniewski\
**License**: Apache License 2.0: <https://github.com/iBotPeaches/Apktool/blob/master/LICENSE>\
**State File**: [remnux.tools.apktool](https://github.com/REMnux/salt-states/blob/master/remnux/tools/apktool.sls)

## DroidLysis

Perform static analysis of Android applications.

**Website**: <https://github.com/cryptax/droidlysis>\
**Author**: cryptax\
**License**: MIT License: <https://github.com/cryptax/droidlysis/blob/master/LICENSE>\
**Notes**: droidlysis\
**State File**: [remnux.python3-packages.droidlysis](https://github.com/REMnux/salt-states/blob/master/remnux/python3-packages/droidlysis.sls)

## androguard

Examine Android files.

**Website**: <https://github.com/androguard/androguard>\
**Author**: Anthony Desnos, Geoffroy GueGuen\
**License**: Apache License 2.0: <https://github.com/androguard/androguard/blob/master/LICENCE-2.0>\
**Notes**: androarsc.py, androauto.py, androaxml.py, androcg.py, androdd.py, androdis.py, androguard, androgui.py, androlyze.py, androsign.py\
**State File**: [remnux.python3-packages.androguard](https://github.com/REMnux/salt-states/blob/master/remnux/python3-packages/androguard.sls)

## AndroidProjectCreator

Convert an Android APK application file into an Android Studio project for easier analysis.

**Website**: <https://maxkersten.nl/projects/androidprojectcreator>\
**Author**: Max Kersten: <https://x.com/Libranalysis>\
**License**: GNU General Public License (GPL) v3: <https://github.com/ThisIsLibra/AndroidProjectCreator/blob/master/LICENSE>\
**Notes**: Use AndroidProjectCreator to run the tool. Before running it for the first time, execute `AndroidProjectCreator -compactInstall` to download the latest dependencies. Use Android Studio to examine the output of the tool.\
**State File**: [remnux.packages.android-project-creator](https://github.com/REMnux/salt-states/blob/master/remnux/packages/android-project-creator.sls)

## baksmali

Disassembler for the dex format used by Dalvik, Android's Java VM implementation.

**Website**: <https://bitbucket.org/JesusFreke/smali>\
**Author**: Ben Gruver\
**License**: Free, unknown license\
**State File**: [remnux.packages.baksmali](https://github.com/REMnux/salt-states/blob/master/remnux/packages/baksmali.sls)

## dex2jar

Examine Dalvik Executable (dex) files.

**Website**: <https://github.com/pxb1988/dex2jar>\
**Author**: Panxiaobo\
**License**: Apache License 2.0: <https://github.com/pxb1988/dex2jar/blob/2.x/LICENSE.txt>\
**Notes**: dex-tools, d2j-dex2jar, d2j-\*\
**State File**: [remnux.packages.dex2jar](https://github.com/REMnux/salt-states/blob/master/remnux/packages/dex2jar.sls)

## APKiD

Identify compilers, packers, and obfuscators used to protect Android APK and DEX files.

**Website**: <https://github.com/rednaga/APKiD>\
**Author**: Caleb Fenton, Tim Strazzere: <https://github.com/rednaga>\
**License**: GNU General Public License v3.0: <https://github.com/rednaga/APKiD/blob/master/LICENSE.GPL>\
**Notes**: apkid\
**State File**: [remnux.python3-packages.apkid](https://github.com/REMnux/salt-states/blob/master/remnux/python3-packages/apkid.sls)


# Dynamically Reverse-Engineer Code

Discover the Tools


# General

Dynamically Reverse-Engineer Code

## Frida

Trace the execution of a process to analyze its behavior.

**Website**: <https://frida.re>\
**Author**: Ole Andre Vadla Ravnas\
**License**: wxWindows Library License 3.1: <https://github.com/frida/frida/blob/main/COPYING>\
**Notes**: frida, frida-ps, frida-trace, frida-discover, frida-ls-devices, frida-kill\
**State File**: [remnux.python3-packages.frida](https://github.com/REMnux/salt-states/blob/master/remnux/python3-packages/frida.sls)

## Wine

Run Windows applications.

**Website**: <https://www.winehq.org>\
**Author**: <https://wiki.winehq.org/Acknowledgements>\
**License**: GNU Lesser General Public License (LGPL) v2.1 or later: <https://wiki.winehq.org/Licensing>\
**Notes**: wine\
**State File**: [remnux.packages.wine](https://github.com/REMnux/salt-states/blob/master/remnux/packages/wine.sls)

## radare2

Examine binary files, including disassembling and debugging. Includes r2ai and decai plugins for LLM-powered analysis (API key or local Ollama required), plus the r2ghidra plugin for Ghidra decompilation via the pdg command.

**Website**: <https://www.radare.org/n/radare2.html>\
**Author**: <https://github.com/radareorg/radare2/blob/master/AUTHORS.md>\
**License**: GNU Lesser General Public License (LGPL) v3: <https://github.com/radareorg/radare2/blob/master/COPYING>\
**Notes**: r2, rasm2, rabin2, rahash2, rafind2, r2ai, decai, pdg\
**State File**: [remnux.packages.radare2](https://github.com/REMnux/salt-states/blob/master/remnux/packages/radare2.sls)

## r2pipe

Examine binary files, including disassembling and debugging.

**Website**: <https://rada.re/n/r2pipe.html>\
**Author**: radareorg\
**License**: MIT\
**State File**: [remnux.python3-packages.r2pipe](https://github.com/REMnux/salt-states/blob/master/remnux/python3-packages/r2pipe.sls)

## x64dbg Automate MCP (OpenCode skills)

Drive x64dbg on a remote Windows VM from OpenCode on REMnux, with eight AI commands for tracing, unpacking, state snapshots, decompiling, YARA scanning, and vulnerability hunting.

**Website**: <https://github.com/REMnux/x64dbg-skills-opencode>\
**Author**: Darius Houle: <https://x.com/dariushoule>\
**License**: MIT License: <https://github.com/REMnux/x64dbg-skills-opencode/blob/main/LICENSE>\
**Notes**: Ships disabled by default in OpenCode. It only works once x64dbg runs with the x64dbg-automate plugin in Remote mode on a separate Windows VM and you connect to it from OpenCode. The skills add OpenCode commands that begin with /x64dbg. Forked from dariushoule/x64dbg-skills (a Claude Code plugin) and adapted for OpenCode on REMnux.\
**State File**: [remnux.tools.x64dbg-automate-mcp](https://github.com/REMnux/salt-states/blob/master/remnux/tools/x64dbg-automate-mcp.sls)


# Shellcode

Dynamically Reverse-Engineer Code

## shcode2exe

Convert 32 and 64-bit shellcode to a Windows executable file.

**Website**: <https://github.com/accidentalrebel/shcode2exe>\
**Author**: Karlo Licudine: <https://x.com/accidentalrebel>\
**License**: GNU General Public License (GPL) v3.0: <https://github.com/accidentalrebel/shcode2exe/blob/master/LICENSE>\
**State File**: [remnux.scripts.shcode2exe](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/shcode2exe.sls)

## shellcode2exe.bat

Convert 32 and 64-bit shellcode to a Windows executable file.

**Website**: <https://github.com/repnz/shellcode2exe>\
**Author**: Ori Damari: <https://x.com/0xrepnz>\
**License**: Free, unknown license\
**Notes**: Use full path name to specify the input file; look for the output file in /usr/local/shellcode2exe-bat\
**State File**: [remnux.tools.shellcode2exe-bat](https://github.com/REMnux/salt-states/blob/master/remnux/tools/shellcode2exe-bat.sls)

## scdbg

Analyze shellcode by emulating its execution.

**Website**: <http://sandsprite.com/blogs/index.php?uid=7&pid=152>\
**Author**: David Zimmer\
**License**: Free, unknown license\
**Notes**: scdbg (GUI), scdbgc (console). Due to a compatibility issue, this tool is not available on an Ubuntu 20.04 SIFT Workstation system to which REMnux was added.\
**State File**: [remnux.packages.scdbg](https://github.com/REMnux/salt-states/blob/master/remnux/packages/scdbg.sls)

## runsc

Run shellcode to trace and analyze its execution.

**Website**: <https://github.com/edygert/runsc>\
**Author**: Evan Dygert: <https://x.com/edygert>\
**License**: MIT License: <https://github.com/edygert/runsc/blob/main/LICENSE>\
**Notes**: Use the `tracesc` command to execute runsc within Wine in a way that traces the execution of shellcode. WARNING! This wrapper will actually execute the shellcode on the system, which might lead to your system becoming infected. Only use this wrapper in a properly configured, isolated laboratory environment, which you can return to a pristine state at the end of your analysis.\
**State File**: [remnux.packages.runsc](https://github.com/REMnux/salt-states/blob/master/remnux/packages/runsc.sls)

## Speakeasy

Emulate code execution, including shellcode, Windows drivers, and Windows PE files.

**Website**: <https://github.com/mandiant/speakeasy>\
**Author**: Mandiant, Andrew Davis\
**License**: MIT License: <https://github.com/mandiant/speakeasy/blob/master/LICENSE.txt>\
**Notes**: To run the tool, use `speakeasy`, `emu_exe.py`, and `emu_dll.py` commands.\
**State File**: [remnux.python3-packages.speakeasy](https://github.com/REMnux/salt-states/blob/master/remnux/python3-packages/speakeasy.sls)

## Qiling

Emulate code execution of PE files, shellcode, etc. for a variety of OS and hardware platforms.

**Website**: <https://www.qiling.io>\
**Author**: <https://github.com/qilingframework/qiling/blob/master/AUTHORS.TXT>\
**License**: GNU General Public License (GPL) v2.0: <https://github.com/qilingframework/qiling/blob/master/COPYING>\
**Notes**: Use `qltool` to analyze artifacts. Before analyzing Windows artifacts, gather Windows DLLs and other components using the [dllscollector.bat](https://github.com/qilingframework/qiling/blob/master/examples/scripts/dllscollector.bat) script. Read the tool's [documentation](https://docs.qiling.io) to get started.\
**State File**: [remnux.python3-packages.qiling](https://github.com/REMnux/salt-states/blob/master/remnux/python3-packages/qiling.sls)

## libemu

A library for x86 code emulation and shellcode detection.

**Website**: <https://github.com/buffer/libemu>\
**Author**: <https://github.com/buffer/libemu/blob/master/AUTHORS>\
**License**: Free, unknown license\
**State File**: [remnux.packages.libemu](https://github.com/REMnux/salt-states/blob/master/remnux/packages/libemu.sls)

## XORSearch

Locate and decode strings obfuscated using common techniques.

**Website**: <https://blog.didierstevens.com/programs/xorsearch/>\
**Author**: Didier Stevens: <https://x.com/DidierStevens>\
**License**: Public Domain\
**Notes**: xorsearch\
**State File**: [remnux.packages.xorsearch](https://github.com/REMnux/salt-states/blob/master/remnux/packages/xorsearch.sls)


# Scripts

Dynamically Reverse-Engineer Code

## objects.js

Emulate common browser and PDF viewer objects, methods, and properties when deobfuscating JavaScript.

**Website**: <https://github.com/REMnux/salt-states/blob/master/remnux/config/objects/objects.js>\
**Author**: Lenny Zeltser\
**License**: Public Domain\
**Notes**: The file is in /usr/local/share/remnux\
**State File**: [remnux.config.objects.init](https://github.com/REMnux/salt-states/blob/master/remnux/config/objects/init.sls)

## STPyV8

Python3 and JavaScript interop engine, fork of the original PyV8 project.

**Website**: <https://github.com/cloudflare/stpyv8>\
**Author**: Area1 Security\
**License**: Apache License 2.0: <https://github.com/cloudflare/stpyv8/blob/master/LICENSE.txt>\
**State File**: [remnux.python3-packages.stpyv8](https://github.com/REMnux/salt-states/blob/master/remnux/python3-packages/stpyv8.sls)

## JStillery

Deobfuscate JavaScript scripts using AST and Partial Evaluation techniques.

**Website**: <https://github.com/mindedsecurity/jstillery>\
**Author**: Stefano Di Paola, Minded Security: <https://mindedsecurity.com>\
**License**: GNU General Public License (GPL) v3: <https://github.com/mindedsecurity/JStillery/blob/master/LICENSE>\
**Notes**: jstillery\
**State File**: [remnux.node-packages.jstillery](https://github.com/REMnux/salt-states/blob/master/remnux/node-packages/jstillery.sls)

## box-js

Analyze suspicious JavaScript scripts.

**Website**: <https://github.com/CapacitorSet/box-js>\
**Author**: CapacitorSet\
**License**: MIT License: <https://github.com/CapacitorSet/box-js/blob/master/LICENSE>\
**Notes**: box-js, box-export\
**State File**: [remnux.node-packages.box-js](https://github.com/REMnux/salt-states/blob/master/remnux/node-packages/box-js.sls)

## SpiderMonkey

Execute and deobfuscate JavaScript using Mozilla's standalone JavaScript engine.

**Website**: <https://developer.mozilla.org/en-US/docs/Mozilla/Projects/SpiderMonkey>\
**Author**: Mozilla Foundation\
**License**: Mozilla Public License 2.0: <https://www.mozilla.org/en-US/MPL/2.0/>\
**Notes**: js\
**State File**: [remnux.packages.spidermonkey](https://github.com/REMnux/salt-states/blob/master/remnux/packages/spidermonkey.sls)

## Rhino Debugger

GUI JavaScript debugger.

**Website**: <https://developer.mozilla.org/en-US/docs/Mozilla/Projects/Rhino/Debugger>\
**Author**: Mozilla Project\
**License**: Mozilla Public License v2.0: <https://developer.mozilla.org/en-US/docs/Mozilla/Projects/Rhino/License>\
**Notes**: rhino-debugger\
**State File**: [remnux.packages.rhino](https://github.com/REMnux/salt-states/blob/master/remnux/packages/rhino.sls)

## PowerShell Core

Run PowerShell scripts and commands.

**Website**: <https://github.com/powershell/powershell>\
**Author**: Microsoft Corporation\
**License**: MIT License: <https://github.com/PowerShell/PowerShell/blob/master/LICENSE.txt>\
**Notes**: pwsh\
**State File**: [remnux.packages.powershell](https://github.com/REMnux/salt-states/blob/master/remnux/packages/powershell.sls)

## SpiderMonkey (Patched)

Execute and deobfuscate JavaScript using a patched version of Mozilla's standalone JavaScript engine.

**Website**: <https://blog.didierstevens.com/2018/04/19/update-patched-spidermonkey/>\
**Author**: SpiderMonkey by Mozilla Foundation, patched by Didier Stevens: <https://x.com/DidierStevens>\
**License**: Mozilla Public License 2.0: <https://www.mozilla.org/en-US/MPL/2.0/>\
**Notes**: js-ascii, js-file\
**State File**: [remnux.tools.js-patched](https://github.com/REMnux/salt-states/blob/master/remnux/tools/js-patched.sls)

## JavaScript Deobfuscator

Deobfuscate JavaScript by removing common obfuscation techniques such as string arrays and proxy functions.

**Website**: <https://github.com/ben-sb/javascript-deobfuscator>\
**Author**: ben-sb: <https://github.com/ben-sb>\
**License**: Apache License 2.0: <https://github.com/ben-sb/javascript-deobfuscator/blob/master/LICENSE>\
**Notes**: js-deobfuscator -i input.js -o output.js\
**State File**: [remnux.node-packages.js-deobfuscator](https://github.com/REMnux/salt-states/blob/master/remnux/node-packages/js-deobfuscator.sls)

## Webcrack

Deobfuscate, unminify, and unpack bundled JavaScript, including scripts protected with obfuscator.io.

**Website**: <https://github.com/j4k0xb/webcrack>\
**Author**: j4k0xb: <https://github.com/j4k0xb>\
**License**: MIT License: <https://github.com/j4k0xb/webcrack/blob/master/LICENSE>\
**Notes**: webcrack input.js -o output-dir\
**State File**: [remnux.node-packages.webcrack](https://github.com/REMnux/salt-states/blob/master/remnux/node-packages/webcrack.sls)


# ELF Files

Dynamically Reverse-Engineer Code

## GNU Project Debugger

Multi-language debugger.

**Website**: <https://www.sourceware.org/gdb/>\
**Author**: <https://www.gnu.org/software/gdb/committee/>\
**License**: GNU General Public License (GPL): <https://www.sourceware.org/gdb/download/onlinedocs/gdb.html#Summary>\
**State File**: [remnux.packages.gdb](https://github.com/REMnux/salt-states/blob/master/remnux/packages/gdb.sls)

## edb

An AArch32/x86/x86-64 debugger, well suited for debugging ELF files.

**Website**: <https://github.com/eteran/edb-debugger>\
**Author**: Evan Teran: <https://github.com/eteran>\
**License**: GNU General Public License (GPL) v2: <https://github.com/eteran/edb-debugger/blob/master/COPYING>\
**State File**: [remnux.packages.edb-debugger](https://github.com/REMnux/salt-states/blob/master/remnux/packages/edb-debugger.sls)

## ltrace

Trace library calls and signals.

**Website**: <https://ltrace.org>\
**Author**: Juan Cespedes\
**License**: GNU General Public License (GPL) v2: <https://gitlab.com/cespedes/ltrace/-/blob/master/COPYING>\
**State File**: [remnux.packages.ltrace](https://github.com/REMnux/salt-states/blob/master/remnux/packages/ltrace.sls)

## strace

Trace process' system calls and signals.

**Website**: <https://strace.io>\
**Author**: Paul Kranenburg, Branko Lankester, Rick Sladkey, etc.\
**License**: GNU General Public License v2.1+: <https://gitlab.com/strace/strace/blob/master/COPYING>\
**State File**: [remnux.packages.strace](https://github.com/REMnux/salt-states/blob/master/remnux/packages/strace.sls)


# Perform Memory Forensics

Discover the Tools

## Volatility Framework

Memory forensics tool and framework.

**Website**: <https://github.com/volatilityfoundation/volatility3>\
**Author**: The Volatility Foundation\
**License**: Volatility Software License: <https://github.com/volatilityfoundation/volatility3/blob/master/LICENSE.txt>\
**Notes**: Invoke using: vol3, volshell3. Before using, download symbols by following the links from <https://github.com/volatilityfoundation/volatility3#symbol-tables> and place them in `/opt/volatility3/lib/python3.*/site-packages/volatility3/symbols`\
**State File**: [remnux.python3-packages.volatility3](https://github.com/REMnux/salt-states/blob/master/remnux/python3-packages/volatility3.sls)

## AESKeyFinder

Find 128-bit and 256-bit AES keys in a memory image.

**Website**: <https://citp.princeton.edu/our-work/memory/>\
**Author**: Nadia Heninger, Alex Halderman\
**License**: Free, unknown license\
**Notes**: aeskeyfind\
**State File**: [remnux.packages.aeskeyfind](https://github.com/REMnux/salt-states/blob/master/remnux/packages/aeskeyfind.sls)

## RSAKeyFinder

Find BER-encoded RSA private keys in a memory image.

**Website**: <https://citp.princeton.edu/our-work/memory/>\
**Author**: Nadia Heninger, Alex Halderman\
**License**: Free, unknown license\
**Notes**: rsakeyfind\
**State File**: [remnux.packages.rsakeyfind](https://github.com/REMnux/salt-states/blob/master/remnux/packages/rsakeyfind.sls)

## bulk\_extractor

Extract interesting strings from binary files.

**Website**: <https://github.com/simsong/bulk_extractor/>\
**Author**: <https://github.com/simsong/bulk_extractor/blob/master/AUTHORS>\
**License**: Portions Public Domain, portions MIT License: <https://github.com/simsong/bulk_extractor/blob/master/LICENSE.md>\
**State File**: [remnux.packages.bulk-extractor](https://github.com/REMnux/salt-states/blob/master/remnux/packages/bulk-extractor.sls)


# Explore Network Interactions

Discover the Tools


# Monitoring

Explore Network Interactions

## Burp Suite Community Edition

Investigate website interactions using this web proxy.

**Website**: <https://portswigger.net>\
**Author**: PortSwigger\
**License**: Free, custom license: <https://portswigger.net/burp/tc-community>\
**Notes**: burpsuite\
**State File**: [remnux.packages.burpsuite-community](https://github.com/REMnux/salt-states/blob/master/remnux/packages/burpsuite-community.sls)

## Network Miner Free Edition

Examine network traffic and carve PCAP capture files.

**Website**: [https://www.netresec.com/](https://www.netresec.com)\
**Author**: NETRESEC AB\
**License**: GNU General Public License (GPL) v2: <https://www.netresec.com/?page=NetworkMinerSourceCode>\
**Notes**: networkminer\
**State File**: [remnux.tools.networkminer](https://github.com/REMnux/salt-states/blob/master/remnux/tools/networkminer.sls)

## PolarProxy

Intercept and decrypt TLS traffic.

**Website**: [https://www.netresec.com/](https://www.netresec.com)\
**Author**: NETRESEC AB\
**License**: Creative Commons Attribution-NoDerivatives 4.0 International (CC BY-ND 4.0) License: <https://www.netresec.com/?page=PolarProxy>\
**Notes**: polarproxy\
**State File**: [remnux.tools.polarproxy](https://github.com/REMnux/salt-states/blob/master/remnux/tools/polarproxy.sls)

## mitmproxy

Investigate website interactions using this web proxy.

**Website**: [https://mitmproxy.org/](https://mitmproxy.org)\
**Author**: <https://github.com/orgs/mitmproxy/people>\
**License**: MIT License: <https://github.com/mitmproxy/mitmproxy/blob/master/LICENSE>\
**Notes**: mitmproxy, mitmdump, mitmweb\
**State File**: [remnux.python3-packages.mitmproxy](https://github.com/REMnux/salt-states/blob/master/remnux/python3-packages/mitmproxy.sls)

## tshark

Capture and analyze network traffic with this console-based sniffer.

**Website**: <https://www.wireshark.org>\
**Author**: Gerald Combs and contributors: <https://www.wireshark.org/about.html#authors>\
**License**: GNU General Public License (GPL) v2: <https://www.wireshark.org/about.html#legal>\
**State File**: [remnux.packages.tshark](https://github.com/REMnux/salt-states/blob/master/remnux/packages/tshark.sls)

## wireshark

Capture and analyze network traffic with this sniffer.

**Website**: <https://www.wireshark.org>\
**Author**: Gerald Combs and contributors: <https://www.wireshark.org/about.html#authors>\
**License**: GNU General Public License (GPL) v2: <https://www.wireshark.org/about.html#legal>\
**State File**: [remnux.packages.wireshark](https://github.com/REMnux/salt-states/blob/master/remnux/packages/wireshark.sls)

## tcpdump

Capture and analyze network traffic with this command-line sniffer.

**Website**: [https://www.tcpdump.org/](https://www.tcpdump.org)\
**Author**: <https://github.com/the-tcpdump-group/tcpdump/blob/master/CREDITS>\
**License**: 3-Clause BSD license: <https://www.tcpdump.org/license.html>\
**State File**: [remnux.packages.tcpdump](https://github.com/REMnux/salt-states/blob/master/remnux/packages/tcpdump.sls)

## ngrep

Look for patterns in network traffic.

**Website**: <https://github.com/jpr5/ngrep/>\
**Author**: Jordan Ritter\
**License**: Free, custom license: <https://github.com/jpr5/ngrep/blob/master/LICENSE>\
**State File**: [remnux.packages.ngrep](https://github.com/REMnux/salt-states/blob/master/remnux/packages/ngrep.sls)

## tcpxtract

Extract files from network traffic.

**Website**: [http://tcpxtract.sourceforge.net/](http://tcpxtract.sourceforge.net)\
**Author**: Nick Harbour\
**License**: GNU General Public License (GPL) v2\
**State File**: [remnux.packages.tcpxtract](https://github.com/REMnux/salt-states/blob/master/remnux/packages/tcpxtract.sls)

## tcpflow

Analyze the flow of network traffic.

**Website**: <https://downloads.digitalcorpora.org/downloads/tcpflow/>\
**Author**: Simson L. Garfinkel\
**License**: GNU General Public License (GPL) v3: <https://github.com/simsong/tcpflow/blob/master/COPYING>\
**State File**: [remnux.packages.tcpflow](https://github.com/REMnux/salt-states/blob/master/remnux/packages/tcpflow.sls)

## tcpick

Capture and analyze network traffic with this command-line sniffer.

**Website**: <http://tcpick.sourceforge.net>\
**Author**: <http://tcpick.sourceforge.net/?t=1&amp;p=AUTHORS>\
**License**: GNU General Public License (GPL)\
**State File**: [remnux.packages.tcpick](https://github.com/REMnux/salt-states/blob/master/remnux/packages/tcpick.sls)

## cs-parse-traffic.py

Decrypt and parse Cobalt Strike beacon network traffic.

**Website**: <https://blog.didierstevens.com/2021/11/29/new-tool-cs-parse-traffic-py/>\
**Author**: Didier Stevens: <https://x.com/DidierStevens>\
**License**: Public Domain\
**State File**: [remnux.scripts.didier-stevens-scripts](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/didier-stevens-scripts.sls)

## monitor-network

Monitor traffic on the first active network interface using tshark, printing a live summary to the screen or saving it to a pcapng file.

**Website**: <https://github.com/REMnux/distro/blob/master/files/monitor-network>\
**Author**: Lenny Zeltser\
**License**: Public Domain\
**Notes**: monitor-network \[filename]\
**State File**: [remnux.scripts.monitor-network](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/monitor-network.sls)


# Connecting

Explore Network Interactions

## Unfurl

Deconstruct and decode data from a URL.

**Website**: <https://github.com/obsidianforensics/unfurl>\
**Author**: Ryan Benson: <https://x.com/_RyanBenson>\
**License**: Apache License 2.0: <https://github.com/obsidianforensics/unfurl/blob/master/LICENSE>\
**Notes**: For the command-line version of the tool, run `unfurl_cli.py`. For the local browser-based version, run `unfurl_app.py`.\
**State File**: [remnux.python3-packages.unfurl](https://github.com/REMnux/salt-states/blob/master/remnux/python3-packages/unfurl.sls)

## thug

Examine suspicious website using this low-interaction honeyclient.

**Website**: <https://github.com/buffer/thug>\
**Author**: Angelo Dell'Aera\
**License**: GNU General Public License (GPL) v2: <https://github.com/buffer/thug/blob/master/LICENSE.txt>\
**Notes**: thug -F\
**State File**: [remnux.python3-packages.thug](https://github.com/REMnux/salt-states/blob/master/remnux/python3-packages/thug.sls)

## netcat

Read and write data across network connections.

**Website**: <https://nc110.sourceforge.io/>\
**Author**: Hobbit, Mike Frysinger, a3alex, Anatoly Techtonik\
**License**: Public Domain\
**Notes**: nc\
**State File**: [remnux.packages.netcat](https://github.com/REMnux/salt-states/blob/master/remnux/packages/netcat.sls)

## tor

Obfuscate your origins by routing traffic through a network of anonymizing nodes.

**Website**: <https://www.torproject.org>\
**Author**: Roger Dingledine, Nick Mathewson, Tor Project Inc.\
**License**: 3-Clause BSD license: <https://github.com/torproject/tor/blob/master/LICENSE>\
**State File**: [remnux.packages.tor](https://github.com/REMnux/salt-states/blob/master/remnux/packages/tor.sls)

## Anomy

A wrapper around wget, ssh, sftp, ftp, and telnet to route these connections through Tor to anonymize your traffic.

**Website**: <https://github.com/izm1chael/Anomy>\
**Author**: Mike Johnson: <https://cyber-bytes.co.uk>\
**License**: Free, unknown license\
**Notes**: anomy\
**State File**: [remnux.scripts.anomy](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/anomy.sls)

## EPIC IRC Client

Examine IRC activities with this IRC client.

**Website**: <https://www.epicsol.org/>\
**Author**: Michael Sandroff, Troy Rollo, Matthew Green, Jake Khuon, EPIC Software Labs\
**License**: Free, custom license: <https://www.epicsol.org/copyright>\
**Notes**: epic5\
**State File**: [remnux.packages.epic5](https://github.com/REMnux/salt-states/blob/master/remnux/packages/epic5.sls)

## GNU Wget

Interact with servers via HTTP, HTTPS, FTP, and FTPS using this command-line tool.

**Website**: <https://www.gnu.org/software/wget/>\
**Author**: Hrvoje Niksic, Tim Ruhsen, Darshit Shah, Giuseppe Scrivano\
**License**: GNU General Public License (GPL) v3: <https://www.gnu.org/licenses/gpl-3.0.html>\
**Notes**: wget\
**State File**: [remnux.packages.wget](https://github.com/REMnux/salt-states/blob/master/remnux/packages/wget.sls)

## cURL

Interact with servers via supported protocols, including HTTP, HTTPS, FTP, IMAP, etc. using this command-line tool.

**Website**: <https://curl.se>\
**Author**: Daniel Stenberg and contributors: <https://curl.se/docs/thanks.html>\
**License**: Free, custom license: <https://curl.se/docs/copyright.html>\
**Notes**: curl\
**State File**: [remnux.packages.curl](https://github.com/REMnux/salt-states/blob/master/remnux/packages/curl.sls)

## zbarimg

Decode QR codes and barcodes from image files.

**Website**: <https://github.com/mchehab/zbar>\
**Author**: <https://www.linkedin.com/in/mchehab/>\
**License**: GNU Lesser General Public License (LGPL) v2.1: <https://github.com/mchehab/zbar/blob/master/LICENSE.md>\
**Notes**: zbarimg\
**State File**: [remnux.packages.zbar-tools](https://github.com/REMnux/salt-states/blob/master/remnux/packages/zbar-tools.sls)


# Services

Explore Network Interactions

## fakedns

Respond to DNS queries with the specified IP address.

**Website**: <https://github.com/SocialExploits/fakedns/blob/main/fakedns.py>\
**Author**: Mike Murr: <mike@socialexploits.com>, <https://socialexploits.com>\
**License**: Apache License 2.0\
**Notes**: Use the `-h` parameter to display usage and help details.\
**State File**: [remnux.tools.fakedns](https://github.com/REMnux/salt-states/blob/master/remnux/tools/fakedns.sls)

## dnsresolver.py

DNS resolver tool for dynamic analysis with wildcard and tracking support.

**Website**: <https://blog.didierstevens.com/2021/07/15/new-tool-dnsresolver-py/>\
**Author**: Didier Stevens: <https://x.com/DidierStevens>\
**License**: Public Domain\
**State File**: [remnux.scripts.didier-stevens-scripts](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/didier-stevens-scripts.sls)

## fakemail

Intercept and examine SMTP email activity with this fake SMTP server.

**Website**: <https://hg.sr.ht/~olly/fakemail>\
**Author**: Oliver Cope\
**License**: Apache License 2.0: <https://hg.sr.ht/~olly/fakemail/browse/LICENSE.txt?rev=default>\
**State File**: [remnux.python3-packages.fakemail](https://github.com/REMnux/salt-states/blob/master/remnux/python3-packages/fakemail.sls)

## accept-all-ips

Accept connections to all IPv4 and IPv6 addresses and redirect it to the corresponding local port.

**Website**: <https://github.com/REMnux/distro/blob/master/files/accept-all-ips>\
**Author**: Lenny Zeltser, with input from the community\
**License**: GNU General Public License (GPL) v3+\
**Notes**: accept-all-ips \<start|stop>\
**State File**: [remnux.scripts.accept-all-ips](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/accept-all-ips.sls)

## netcat

Read and write data across network connections.

**Website**: <https://nc110.sourceforge.io/>\
**Author**: Hobbit, Mike Frysinger, a3alex, Anatoly Techtonik\
**License**: Public Domain\
**Notes**: nc\
**State File**: [remnux.packages.netcat](https://github.com/REMnux/salt-states/blob/master/remnux/packages/netcat.sls)

## Nginx

Web server.

**Website**: <https://nginx.org>\
**Author**: Igor Sysoev, Nginx Inc.\
**License**: Free, custom license: <https://nginx.org/LICENSE>\
**Notes**: The webroot directory is /var/www/html. Control the daemon using: httpd \<start|stop|status|restart>.\
**State File**: [remnux.packages.nginx](https://github.com/REMnux/salt-states/blob/master/remnux/packages/nginx.sls)

## inspircd 3

Examine IRC activity with this IRC server.

**Website**: <https://www.inspircd.org/>\
**Author**: InspIRCd Development Team\
**License**: GNU General Public License (GPL) v2: <https://docs.inspircd.org/license/>\
**State File**: [remnux.packages.inspircd](https://github.com/REMnux/salt-states/blob/master/remnux/packages/inspircd.sls)

## INetSim

Emulate common network services and interact with malware.

**Website**: <https://www.inetsim.org/>\
**Author**: Thomas Hungenberg, Matthias Eckert\
**License**: GNU General Public License (GPL) v3\
**Notes**: inetsim\
**State File**: [remnux.packages.inetsim](https://github.com/REMnux/salt-states/blob/master/remnux/packages/inetsim.sls)

## FakeNet-NG

Emulate common network services and interact with malware.

**Website**: <https://github.com/mandiant/flare-fakenet-ng>\
**Author**: Mandiant, Peter Kacherginsky, Michael Bailey: <https://github.com/mandiant/flare-fakenet-ng/blob/master/AUTHORS>\
**License**: Apache License 2.0: <https://github.com/mandiant/flare-fakenet-ng/blob/master/LICENSE.txt>\
**Notes**: Run the tool using `sudo fakenet`. First, edit `/opt/fakenet-ng/lib/python3.x/site-packages/fakenet/configs/default.ini`, changing the `LinuxRestrictInterface` parameter to your Ethernet network interface name, such as `ens33`.\
**State File**: [remnux.python3-packages.fakenet-ng](https://github.com/REMnux/salt-states/blob/master/remnux/python3-packages/fakenet-ng.sls)


# Investigate System Interactions

Discover the Tools

## ProcDOT

Visualize and examine the output of Process Monitor.

**Website**: <https://www.procdot.com>\
**Author**: Christian Wojner: <https://x.com/Didelphodon>\
**License**: Free, custom license: <https://cert.at/media/files/downloads/software/procdot/files/license.txt>\
**Notes**: procdot\
**State File**: [remnux.packages.procdot](https://github.com/REMnux/salt-states/blob/master/remnux/packages/procdot.sls)

## sandfly-processdecloak

Find hidden processes on the local Linux system.

**Website**: <https://github.com/sandflysecurity/sandfly-processdecloak>\
**Author**: Sandfly Security: <https://x.com/SandflySecurity>\
**License**: MIT License: <https://github.com/sandflysecurity/sandfly-processdecloak/blob/master/LICENSE>\
**State File**: [remnux.packages.sandfly-processdecloak](https://github.com/REMnux/salt-states/blob/master/remnux/packages/sandfly-processdecloak.sls)

## Unhide

Find hidden processes or connections on the local Linux system.

**Website**: <http://www.unhide-forensics.info>\
**Author**: Yago Jesus: <https://x.com/YJesus>\
**License**: GNU General Public License (GPL) v3: <https://www.gnu.org/licenses/gpl-3.0.html>\
**State File**: [remnux.packages.unhide](https://github.com/REMnux/salt-states/blob/master/remnux/packages/unhide.sls)

## ProcmonMCP

MCP server that lets AI assistants analyze Process Monitor (Procmon) XML captures.

**Website**: <https://github.com/JameZUK/ProcmonMCP>\
**Author**: James (JameZUK): <https://x.com/JameZUK>\
**License**: MIT License: <https://github.com/JameZUK/ProcmonMCP/blob/procmon_parser/LICENSE>\
**Notes**: Pre-configured for OpenCode as the "procmon" MCP server. On Windows, export the Procmon capture to XML (the native .PML format is not supported), copy the XML to REMnux, then ask the assistant to load it. Large captures with millions of events can take several minutes to load.\
**State File**: [remnux.tools.procmon-mcp](https://github.com/REMnux/salt-states/blob/master/remnux/tools/procmon-mcp.sls)


# Analyze Documents

Discover the Tools


# General

Analyze Documents

## Tesseract OCR

Examine images to identify and extract text using optical character recognition (OCR).

**Website**: <https://github.com/tesseract-ocr/tesseract>\
**Author**: <https://github.com/tesseract-ocr/tesseract/blob/master/AUTHORS>\
**License**: Apache License 2.0: <https://github.com/tesseract-ocr/tesseract/blob/master/LICENSE>\
**Notes**: tesseract\
**State File**: [remnux.packages.tesseract-ocr](https://github.com/REMnux/salt-states/blob/master/remnux/packages/tesseract-ocr.sls)

## base64dump.py

Locate and decode strings encoded in Base64 and other common encodings.

**Website**: <https://blog.didierstevens.com/2020/07/03/update-base64dump-py-version-0-0-12/>\
**Author**: Didier Stevens: <https://x.com/DidierStevens>\
**License**: Public Domain\
**State File**: [remnux.scripts.didier-stevens-scripts](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/didier-stevens-scripts.sls)


# PDF

Analyze Documents

## pdftk-java

Edit, create, and examine PDF files.

**Website**: <https://gitlab.com/pdftk-java/pdftk>\
**Author**: Marc Vinyals\
**License**: GNU General Public License (GPL) v2: <https://gitlab.com/pdftk-java/pdftk/-/blob/master/LICENSE>\
**Notes**: pdftk\
**State File**: [remnux.packages.pdftk-java](https://github.com/REMnux/salt-states/blob/master/remnux/packages/pdftk-java.sls)

## pdfresurrect

Extract previous versions of content from PDF files.

**Website**: <https://github.com/enferex/pdfresurrect>\
**Author**: Matt Davis\
**License**: GNU General Public License (GPL) v3: <https://github.com/enferex/pdfresurrect/blob/master/LICENSE>\
**State File**: [remnux.packages.pdfresurrect](https://github.com/REMnux/salt-states/blob/master/remnux/packages/pdfresurrect.sls)

## qpdf

Manipulate (merge, convert, transform) PDF files.

**Website**: <http://qpdf.sourceforge.net/>\
**Author**: Jay Berkenbilt\
**License**: Apache License 2.0: <https://github.com/qpdf/qpdf/blob/master/LICENSE.txt>\
**State File**: [remnux.packages.qpdf](https://github.com/REMnux/salt-states/blob/master/remnux/packages/qpdf.sls)

## peepdf-3

Examine elements of the PDF file.

**Website**: <https://github.com/digitalsleuth/peepdf-3>\
**Author**: Jose Miguel Esparza and Corey Forman\
**License**: GNU General Public License (GPL) v3: <https://github.com/digitalsleuth/peepdf-3/blob/main/COPYING>\
**Notes**: To run the tool, use the command "peepdf".\
**State File**: [remnux.python3-packages.peepdf-3](https://github.com/REMnux/salt-states/blob/master/remnux/python3-packages/peepdf-3.sls)

## pdftool.py

Analyze PDF files to identify incremental updates to the document.

**Website**: <https://blog.didierstevens.com/2021/01/31/new-tool-pdftool-py/>\
**Author**: Didier Stevens: <https://x.com/DidierStevens>\
**License**: Public Domain\
**State File**: [remnux.scripts.didier-stevens-scripts](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/didier-stevens-scripts.sls)

## pdfid.py

Identify suspicious elements of the PDF file.

**Website**: <https://blog.didierstevens.com/programs/pdf-tools/>\
**Author**: Didier Stevens: <https://x.com/DidierStevens>\
**License**: Public Domain\
**State File**: [remnux.scripts.didier-stevens-scripts](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/didier-stevens-scripts.sls)

## pdf-parser.py

Examine elements of the PDF file.

**Website**: <https://blog.didierstevens.com/programs/pdf-tools/>\
**Author**: Didier Stevens: <https://x.com/DidierStevens>\
**License**: Public Domain\
**State File**: [remnux.scripts.didier-stevens-scripts](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/didier-stevens-scripts.sls)

## Origamindee

Parse, modify, generate PDF files.

**Website**: <https://github.com/mindee/origamindee>\
**Author**: Guillaume Delugre (original), Mindee (fork maintainer)\
**License**: GNU Lesser General Public License (LGPL) v3\
**Notes**: pdfcop, pdfdecompress, pdfdecrypt, pdfextract, etc.\
**State File**: [remnux.rubygems.origamindee](https://github.com/REMnux/salt-states/blob/master/remnux/rubygems/origamindee.sls)


# Microsoft Office

Analyze Documents

## SSView

Analyze OLE2 Structured Storage files.

**Website**: <https://www.mitec.cz/ssv.html>\
**Author**: Michal Mutl\
**License**: Free to use for private, educational and non-commercial purposes.\
**Notes**: ssview\
**State File**: [remnux.tools.ssview](https://github.com/REMnux/salt-states/blob/master/remnux/tools/ssview.sls)

## msoffcrypto-tool

Decrypt a Microsoft Office file with password, intermediate key, or private key which generated its escrow key.

**Website**: <https://github.com/nolze/msoffcrypto-tool>\
**Author**: nolze\
**License**: MIT License: <https://github.com/nolze/msoffcrypto-tool/blob/master/LICENSE.txt>\
**State File**: [remnux.python3-packages.msoffcrypto-tool](https://github.com/REMnux/salt-states/blob/master/remnux/python3-packages/msoffcrypto-tool.sls)

## pcodedmp

Disassemble VBA p-code.

**Website**: <https://github.com/bontchev/pcodedmp>\
**Author**: Vesselin Bontchev: <https://x.com/bontchev>\
**License**: GNU General Public License (GPL) v3: <https://github.com/bontchev/pcodedmp/blob/master/LICENSE>\
**State File**: [remnux.python3-packages.pcodedmp](https://github.com/REMnux/salt-states/blob/master/remnux/python3-packages/pcodedmp.sls)

## pcode2code

Decompile VBA macro p-code from Microsoft Office documents.

**Website**: <https://github.com/Big5-sec/pcode2code>\
**Author**: Nicolas Zilio: <https://x.com/Big5_sec>\
**License**: GNU General Public License (GPL) v3: <https://github.com/Big5-sec/pcode2code/blob/master/LICENSE>\
**State File**: [remnux.python3-packages.pcode2code](https://github.com/REMnux/salt-states/blob/master/remnux/python3-packages/pcode2code.sls)

## oletools

Microsoft Office OLE2 compound documents.

**Website**: <https://www.decalage.info/python/oletools>\
**Author**: Philippe Lagadec: <https://x.com/decalage2>\
**License**: Free, custom license: <https://github.com/decalage2/oletools/blob/master/LICENSE.md>\
**Notes**: mraptor, msodde, olebrowse, oledir, oleid, olemap, olemeta, oleobj, oletimes, olevba, pyxswf, rtfobj, ezhexviewer\
**State File**: [remnux.python3-packages.oletools](https://github.com/REMnux/salt-states/blob/master/remnux/python3-packages/oletools.sls)

## EvilClippy

Modify aspects of Microsoft Office documents.

**Website**: <https://github.com/outflanknl/EvilClippy>\
**Author**: Stan Hegt: <https://x.com/StanHacked>, with contributions from Carrie Roberts: <https://x.com/OrOneEqualsOne>\
**License**: GNU General Public License (GPL) v3.0: <https://github.com/outflanknl/EvilClippy/blob/master/LICENSE.md>\
**Notes**: To remove VBA project password protection from the file, use the `evilclippy -uu` command.\
**State File**: [remnux.packages.evilclippy](https://github.com/REMnux/salt-states/blob/master/remnux/packages/evilclippy.sls)

## XLMMacroDeobfuscator

Deobfuscate XLM macros (also known as Excel 4.0 macros) from Microsoft Office files.

**Website**: <https://github.com/DissectMalware/XLMMacroDeobfuscator>\
**Author**: <https://x.com/DissectMalware>\
**License**: Apache License 2.0: <https://github.com/DissectMalware/XLMMacroDeobfuscator/blob/master/LICENSE>\
**Notes**: xlmdeobfuscator, runxlrd2.py\
**State File**: [remnux.python3-packages.xlmmacrodeobfuscator](https://github.com/REMnux/salt-states/blob/master/remnux/python3-packages/xlmmacrodeobfuscator.sls)

## libolecf

Microsoft Office OLE2 compound documents.

**Website**: <https://github.com/libyal/libolecf>\
**Author**: Joachim Metz\
**License**: GNU Lesser General Public License (LGPL) v3+: <https://github.com/libyal/libolecf/blob/master/COPYING>\
**Notes**: olecfexport, olecfinfo, olecfmount, etc.\
**State File**: [remnux.packages.libolecf](https://github.com/REMnux/salt-states/blob/master/remnux/packages/libolecf.sls)

## msoffice-crypt

Encrypt and decrypt OOXML Microsoft Office documents.

**Website**: <https://github.com/herumi/msoffice>\
**Author**: Cybozu Labs Inc., Mitsunari Shigeo: <https://x.com/herumi>\
**License**: Free, custom license: <https://github.com/herumi/msoffice/blob/master/COPYRIGHT>\
**State File**: [remnux.packages.msoffice-crypt](https://github.com/REMnux/salt-states/blob/master/remnux/packages/msoffice-crypt.sls)

## Hachoir

View, edit, and carve contents of various binary file types.

**Website**: <https://github.com/vstinner/hachoir>\
**Author**: <https://hachoir.readthedocs.io/en/latest/authors.html>\
**License**: GNU General Public License (GPL) v2: <https://github.com/vstinner/hachoir/blob/master/COPYING>\
**Notes**: hachoir-grep, hachoir-metadata, hachoir-strip, hachoir-wx\
**State File**: [remnux.python3-packages.hachoir](https://github.com/REMnux/salt-states/blob/master/remnux/python3-packages/hachoir.sls)

## olefile

Python package to parse, read and write MS OLE2 files.

**Website**: <https://github.com/decalage2/olefile>\
**Author**: Philippe Lagadec\
**License**: All Rights Reserved: <https://github.com/decalage2/olefile/blob/master/LICENSE.txt>\
**State File**: [remnux.python3-packages.olefile](https://github.com/REMnux/salt-states/blob/master/remnux/python3-packages/olefile.sls)

## msoffcrypto-crack.py

Recover the password of an encrypted Microsoft Office document.

**Website**: <https://blog.didierstevens.com/2018/12/31/new-tool-msoffcrypto-crack-py/>\
**Author**: Didier Stevens: <https://x.com/DidierStevens>\
**License**: Public Domain\
**State File**: [remnux.scripts.didier-stevens-scripts](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/didier-stevens-scripts.sls)

## oledump.py

Analyze OLE2 Structured Storage files.

**Website**: <https://blog.didierstevens.com/programs/oledump-py/>\
**Author**: Didier Stevens: <https://x.com/DidierStevens>\
**License**: Public Domain\
**State File**: [remnux.scripts.didier-stevens-scripts](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/didier-stevens-scripts.sls)

## rtfdump.py

Analyze a suspicious RTF file.

**Website**: <https://blog.didierstevens.com/2018/12/10/update-rtfdump-py-version-0-0-9/>\
**Author**: Didier Stevens: <https://x.com/DidierStevens>\
**License**: Public Domain\
**State File**: [remnux.scripts.didier-stevens-scripts](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/didier-stevens-scripts.sls)

## zipdump.py

Analyze zip-compressed files.

**Website**: <https://blog.didierstevens.com/2020/07/27/update-zipdump-py-version-0-0-20/>\
**Author**: Didier Stevens: <https://x.com/DidierStevens>\
**License**: Public Domain\
**State File**: [remnux.scripts.didier-stevens-scripts](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/didier-stevens-scripts.sls)

## xmldump.py

Extract contents of XML files, in particular OOXML-formatted Microsoft Office documents.

**Website**: <https://blog.didierstevens.com/2017/12/18/new-tool-xmldump-py/>\
**Author**: Didier Stevens: <https://x.com/DidierStevens>\
**License**: Public Domain\
**State File**: [remnux.scripts.didier-stevens-scripts](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/didier-stevens-scripts.sls)

## onedump.py

Extract and analyze embedded files from OneNote documents.

**Website**: <https://blog.didierstevens.com/2023/01/22/new-tool-onedump-py/>\
**Author**: Didier Stevens: <https://x.com/DidierStevens>\
**License**: Public Domain\
**State File**: [remnux.scripts.didier-stevens-scripts](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/didier-stevens-scripts.sls)


# Email Messages

Analyze Documents

## msg-extractor

Extract emails and attachments from MSG files.

**Website**: <https://github.com/TeamMsgExtractor/msg-extractor>\
**Author**: <https://github.com/TeamMsgExtractor/msg-extractor#credits>\
**License**: GNU General Public License v3.0: <https://github.com/TeamMsgExtractor/msg-extractor/blob/master/LICENSE.txt>\
**Notes**: extract\_msg\
**State File**: [remnux.python3-packages.msg-extractor](https://github.com/REMnux/salt-states/blob/master/remnux/python3-packages/msg-extractor.sls)

## msgconvert

Convert MSG files to MBOX files.

**Website**: <https://www.matijs.net/software/msgconv/>\
**Author**: Matijs van Zuijlen\
**License**: "Free software; you can redistribute it and/or modify it under the same terms as Perl itself": <https://github.com/mvz/email-outlook-message-perl/blob/master/README>\
**State File**: [remnux.packages.libemail-outlook-message-perl](https://github.com/REMnux/salt-states/blob/master/remnux/packages/libemail-outlook-message-perl.sls)

## mail-parser

Parse raw SMTP and .MSG email messages and generate a parsed object from them.

**Website**: <https://github.com/SpamScope/mail-parser>\
**Author**: Fedele Mantuano: <https://x.com/fedelemantuano>\
**License**: Apache License 2.0: <https://github.com/SpamScope/mail-parser/blob/develop/LICENSE.txt>\
**Notes**: Run the tool using command `mailparser`\
**State File**: [remnux.python3-packages.mail-parser](https://github.com/REMnux/salt-states/blob/master/remnux/python3-packages/mail-parser.sls)

## emldump.py

Parse and analyze EML files.

**Website**: <https://blog.didierstevens.com/2020/11/29/update-emldump-py-version-0-0-11/>\
**Author**: Didier Stevens: <https://x.com/DidierStevens>\
**License**: Public Domain\
**State File**: [remnux.scripts.didier-stevens-scripts](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/didier-stevens-scripts.sls)


# Use Artificial Intelligence

Discover the Tools

## OpenCode

Open-source AI coding agent for the terminal.

**Website**: <https://opencode.ai>\
**Author**: Anomaly: <https://github.com/anomalyco>\
**License**: Apache License 2.0: <https://github.com/anomalyco/opencode/blob/main/LICENSE>\
**Notes**: OpenCode might come with a default model that's free, but that might use the data you supply for training. Consider changing the model to your own to ensure confidentiality.\
**State File**: [remnux.node-packages.opencode](https://github.com/REMnux/salt-states/blob/master/remnux/node-packages/opencode.sls)

## REMnux MCP Server

MCP server for using the REMnux malware analysis toolkit via AI assistants.

**Website**: <https://github.com/REMnux/remnux-mcp-server>\
**Author**: Lenny Zeltser\
**License**: GPL-3.0: <https://github.com/REMnux/remnux-mcp-server/blob/main/LICENSE>\
**Notes**: remnux-mcp-server\
**State File**: [remnux.node-packages.remnux-mcp-server](https://github.com/REMnux/salt-states/blob/master/remnux/node-packages/remnux-mcp-server.sls)

## GhidrAssistMCP

MCP server for AI-assisted reverse engineering in Ghidra.

**Website**: <https://github.com/jtang613/GhidrAssistMCP>\
**Author**: Jason Tang: <https://www.linkedin.com/in/jason-tang-174652157/>\
**License**: MIT: <https://github.com/jtang613/GhidrAssistMCP/blob/master/LICENSE>\
**Notes**: After installation, enable the plugin in Ghidra: File → Configure → Miscellaneous → GhidrAssistMCPPlugin. Then start the MCP server: Window → GhidrAssistMCP. The server listens on port 8080. OpenCode is pre-configured to connect at <http://localhost:8080/mcp.\\>
**State File**: [remnux.tools.ghidrassist-mcp](https://github.com/REMnux/salt-states/blob/master/remnux/tools/ghidrassist-mcp.sls)

## radare2

Examine binary files, including disassembling and debugging. Includes r2ai and decai plugins for LLM-powered analysis (API key or local Ollama required), plus the r2ghidra plugin for Ghidra decompilation via the pdg command.

**Website**: <https://www.radare.org/n/radare2.html>\
**Author**: <https://github.com/radareorg/radare2/blob/master/AUTHORS.md>\
**License**: GNU Lesser General Public License (LGPL) v3: <https://github.com/radareorg/radare2/blob/master/COPYING>\
**Notes**: r2, rasm2, rabin2, rahash2, rafind2, r2ai, decai, pdg\
**State File**: [remnux.packages.radare2](https://github.com/REMnux/salt-states/blob/master/remnux/packages/radare2.sls)

## ProcmonMCP

MCP server that lets AI assistants analyze Process Monitor (Procmon) XML captures.

**Website**: <https://github.com/JameZUK/ProcmonMCP>\
**Author**: James (JameZUK): <https://x.com/JameZUK>\
**License**: MIT License: <https://github.com/JameZUK/ProcmonMCP/blob/procmon_parser/LICENSE>\
**Notes**: Pre-configured for OpenCode as the "procmon" MCP server. On Windows, export the Procmon capture to XML (the native .PML format is not supported), copy the XML to REMnux, then ask the assistant to load it. Large captures with millions of events can take several minutes to load.\
**State File**: [remnux.tools.procmon-mcp](https://github.com/REMnux/salt-states/blob/master/remnux/tools/procmon-mcp.sls)

## x64dbg Automate MCP (OpenCode skills)

Drive x64dbg on a remote Windows VM from OpenCode on REMnux, with eight AI commands for tracing, unpacking, state snapshots, decompiling, YARA scanning, and vulnerability hunting.

**Website**: <https://github.com/REMnux/x64dbg-skills-opencode>\
**Author**: Darius Houle: <https://x.com/dariushoule>\
**License**: MIT License: <https://github.com/REMnux/x64dbg-skills-opencode/blob/main/LICENSE>\
**Notes**: Ships disabled by default in OpenCode. It only works once x64dbg runs with the x64dbg-automate plugin in Remote mode on a separate Windows VM and you connect to it from OpenCode. The skills add OpenCode commands that begin with /x64dbg. Forked from dariushoule/x64dbg-skills (a Claude Code plugin) and adapted for OpenCode on REMnux.\
**State File**: [remnux.tools.x64dbg-automate-mcp](https://github.com/REMnux/salt-states/blob/master/remnux/tools/x64dbg-automate-mcp.sls)


# Gather and Analyze Data

Discover the Tools

## dissect

Perform a variety of forensics and incident response tasks using this DFIR framework and toolset.

**Website**: <https://github.com/fox-it/dissect>\
**Author**: Dissect Team: <dissect@fox-it.com>\
**License**: GNU Affero General Public License v3: <https://github.com/fox-it/dissect/blob/main/LICENSE>\
**Notes**: acquire, target-fs, rdump, rgeoip, target-query, target-shell, target-dump, target-info, target-reg, target-dd, target-mount\
**State File**: [remnux.python3-packages.dissect](https://github.com/REMnux/salt-states/blob/master/remnux/python3-packages/dissect.sls)

## time-decode

Decode and encode date and timestamps.

**Website**: <https://github.com/digitalsleuth/time_decode>\
**Author**: Corey Forman\
**License**: MIT License: <https://github.com/digitalsleuth/time_decode/blob/master/LICENSE>\
**State File**: [remnux.python3-packages.time-decode](https://github.com/REMnux/salt-states/blob/master/remnux/python3-packages/time-decode.sls)

## malwoverview

Query public repositories of malware data (e.g., VirusTotal, HybridAnalysis).

**Website**: <https://github.com/alexandreborges/malwoverview>\
**Author**: Alexandre Borges\
**License**: GNU General Public License v3: <https://github.com/alexandreborges/malwoverview/blob/master/LICENSE>\
**Notes**: malwoverview, add API keys to \~/.malwapi.conf\
**State File**: [remnux.python3-packages.malwoverview](https://github.com/REMnux/salt-states/blob/master/remnux/python3-packages/malwoverview.sls)

## ipwhois

Retrieve and parse whois data for IP addresses.

**Website**: <https://github.com/secynic/ipwhois>\
**Author**: Philip Hane\
**License**: BSD 2-Clause "Simplified" License: <https://github.com/secynic/ipwhois/blob/master/LICENSE.txt>\
**Notes**: ipwhois\_cli.py, ipwhois\_utils\_cli.py\
**State File**: [remnux.python3-packages.ipwhois](https://github.com/REMnux/salt-states/blob/master/remnux/python3-packages/ipwhois.sls)

## pdnstool

Query passive DNS databases for DNS data.

**Website**: <https://github.com/chrislee35/passivedns-client>\
**Author**: Chris Lee\
**License**: MIT License: <https://github.com/chrislee35/passivedns-client/blob/master/LICENSE.txt>\
**State File**: [remnux.rubygems.pdnstool](https://github.com/REMnux/salt-states/blob/master/remnux/rubygems/pdnstool.sls)

## DeXRAY

Extract and decode data from antivirus quarantine files.

**Website**: <https://www.hexacorn.com/blog/category/software-releases/dexray/>\
**Author**: Hexacorn\
**License**: Free; copyright by Hexacorn.com: <https://hexacorn.com/d/DeXRAY.pl>\
**Notes**: dexray\
**State File**: [remnux.scripts.dexray](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/dexray.sls)

## virustotal-submit

Submit files to VirusTotal.

**Website**: <https://blog.didierstevens.com/programs/virustotal-tools/>\
**Author**: Didier Stevens: <https://x.com/DidierStevens>\
**License**: Public Domain\
**Notes**: virustotal-submit.py\
**State File**: [remnux.scripts.virustotal-submit](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/virustotal-submit.sls)

## virustotal-search

Search VirusTotal for file hashes.

**Website**: <https://blog.didierstevens.com/programs/virustotal-tools/>\
**Author**: Didier Stevens: <https://x.com/DidierStevens>\
**License**: Public Domain\
**Notes**: virustotal-search.py\
**State File**: [remnux.scripts.virustotal-search](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/virustotal-search.sls)

## Scalpel

Carve contents out of binary files, such as partitions.

**Website**: <https://github.com/sleuthkit/scalpel>\
**Author**: Golden G. Richard III, Vassil Roussev\
**License**: Apache License 2.0: <https://github.com/sleuthkit/scalpel/blob/master/LICENSE-2.0.txt>\
**State File**: [remnux.packages.scalpel](https://github.com/REMnux/salt-states/blob/master/remnux/packages/scalpel.sls)

## nsrllookup

Look up MD5 file hashes in the NIST National Software Reference Library (NSRL).

**Website**: <https://github.com/rjhansen/nsrllookup>\
**Author**: Robert J. Hansen: <https://x.com/robertjhansen>\
**License**: ISC License: <https://github.com/rjhansen/nsrllookup/blob/master/LICENSE>\
**State File**: [remnux.packages.nsrllookup](https://github.com/REMnux/salt-states/blob/master/remnux/packages/nsrllookup.sls)

## Yara

Identify and classify malware samples using Yara rules.

**Website**: <https://virustotal.github.io/yara/>\
**Author**: <https://github.com/VirusTotal/yara/blob/master/AUTHORS>\
**License**: BSD 3-Clause "New" or "Revised" License: <https://github.com/VirusTotal/yara/blob/master/COPYING>\
**Notes**: yara\
**State File**: [remnux.packages.yara](https://github.com/REMnux/salt-states/blob/master/remnux/packages/yara.sls)

## ioc\_parser

Extract IOCs from security report PDFs.

**Website**: <https://github.com/buffer/ioc_parser>\
**Author**: Armin Buescher\
**License**: MIT License: <https://github.com/buffer/ioc_parser/blob/master/LICENSE.txt>\
**State File**: [remnux.python3-packages.ioc-parser](https://github.com/REMnux/salt-states/blob/master/remnux/python3-packages/ioc-parser.sls)

## dnslib

Python library to encode/decode DNS wire-format packets.

**Website**: <https://github.com/paulc/dnslib>\
**Author**: Paul Chakravarti\
**License**: BSD 2-Clause "Simplified" License: <https://github.com/paulc/dnslib/blob/master/LICENSE>\
**Notes**: Library - /opt/dnslib/bin/python3 - import dnslib\
**State File**: [remnux.python3-packages.dnslib](https://github.com/REMnux/salt-states/blob/master/remnux/python3-packages/dnslib.sls)

## YARA-X

Scan files using YARA rules, the next generation of YARA written in Rust.

**Website**: <https://github.com/VirusTotal/yara-x>\
**Author**: Victor M. Alvarez, VirusTotal: <https://github.com/VirusTotal>\
**License**: BSD-3-Clause License: <https://github.com/VirusTotal/yara-x/blob/main/LICENSE>\
**Notes**: yr scan, yr compile. Coexists with classic YARA; uses `yr` command.\
**State File**: [remnux.tools.yara-x](https://github.com/REMnux/salt-states/blob/master/remnux/tools/yara-x.sls)


# View or Edit Files

Discover the Tools

## feh

View images.

**Website**: <https://feh.finalrewind.org>\
**Author**: Tom Gilbert, Daniel Friesel\
**License**: Free, custom license: <https://git.finalrewind.org/feh/plain/COPYING>\
**State File**: [remnux.packages.feh](https://github.com/REMnux/salt-states/blob/master/remnux/packages/feh.sls)

## Evince

View documents in a variety of formats, including PDF.

**Website**: <https://wiki.gnome.org/Apps/Evince>\
**Author**: Jonathan Blandford, Nickolay V. Shmyrev, Carlos Garcia Campos\
**License**: GNU General Public License (GPL) v2: <https://gitlab.gnome.org/GNOME/evince/-/blob/master/COPYING>\
**Notes**: evince\
**State File**: [remnux.packages.evince](https://github.com/REMnux/salt-states/blob/master/remnux/packages/evince.sls)

## dos2unix

Convert text files with Windows or macOS line breaks to Unix line breaks and vice versa.

**Website**: <https://waterlan.home.xs4all.nl/dos2unix.html>\
**Author**: Benjamin Lin, Bernd Johannes Wuebben, Erwin Waterlander\
**License**: FreeBSD style license: <https://waterlan.home.xs4all.nl/dos2unix/COPYING.txt>\
**Notes**: dos2unix, mac2unix, unix2dos, unix2mac\
**State File**: [remnux.packages.dos2unix](https://github.com/REMnux/salt-states/blob/master/remnux/packages/dos2unix.sls)

## VBinDiff

Compare binary files.

**Website**: <https://www.cjmweb.net/vbindiff/>\
**Author**: Christopher J. Madsen\
**License**: GNU General Public License (GPL) v2 or greater\
**Notes**: vbindiff\
**State File**: [remnux.packages.vbindiff](https://github.com/REMnux/salt-states/blob/master/remnux/packages/vbindiff.sls)

## wxHexEditor

Hex editor.

**Website**: <https://sourceforge.net/projects/wxhexeditor/>\
**Author**: Unknown\
**License**: GNU General Public License (GPL) v2: <https://sourceforge.net/p/wxhexeditor/code/HEAD/tree/trunk/docs/GPL.txt>\
**State File**: [remnux.packages.wxhexeditor](https://github.com/REMnux/salt-states/blob/master/remnux/packages/wxhexeditor.sls)

## SciTE

Edit text files.

**Website**: <https://www.scintilla.org/SciTE.html>\
**Author**: <https://sourceforge.net/p/scintilla/_members/>\
**License**: Free, unknown license\
**State File**: [remnux.packages.scite](https://github.com/REMnux/salt-states/blob/master/remnux/packages/scite.sls)

## ImageMagick

View and manipulate image and related files.

**Website**: <https://imagemagick.org/>\
**Author**: ImageMagick Studio LLC, <https://github.com/ImageMagick/ImageMagick/blob/master/AUTHORS.txt>\
**License**: Free, custom license: <https://github.com/ImageMagick/ImageMagick/blob/master/LICENSE>\
**Notes**: display, convert, mogrify, etc.\
**State File**: [remnux.packages.imagemagick](https://github.com/REMnux/salt-states/blob/master/remnux/packages/imagemagick.sls)

## Visual Studio Code

Powerful source code editor.

**Website**: <https://code.visualstudio.com/>\
**Author**: Microsoft Corporation\
**License**: Custom license: <https://code.visualstudio.com/License/>\
**Notes**: code\
**State File**: [remnux.packages.vscode](https://github.com/REMnux/salt-states/blob/master/remnux/packages/vscode.sls)


# General Utilities

Discover the Tools

## REMnux Installer

Install and update the REMnux distro.

**Website**: <https://github.com/REMnux/distro/blob/master/files/remnux-installer.sh>\
**Author**: Lenny Zeltser\
**License**: Public Domain\
**Notes**: This is a wrapper around the Cast installer that the script uses behind the scenes. To run the tool on REMnux, type `remnux`\
**State File**: [remnux.tools.remnux-installer](https://github.com/REMnux/salt-states/blob/master/remnux/tools/remnux-installer.sls)

## myip

Determine the IP address of the default network interface.

**Website**: <https://github.com/REMnux/distro/blob/master/files/myip>\
**Author**: Lenny Zeltser, with input from the community\
**License**: Public Domain\
**State File**: [remnux.scripts.myip](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/myip.sls)

## texteditor.py

Edit text files from the command line using search-and-replace commands.

**Website**: <https://blog.didierstevens.com/2021/07/05/new-tool-texteditor-py/>\
**Author**: Didier Stevens: <https://x.com/DidierStevens>\
**License**: Public Domain\
**State File**: [remnux.scripts.texteditor](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/texteditor.sls)

## sortcanon.py

Sort text files using canonicalization functions built into this tool.

**Website**: <https://blog.didierstevens.com/2022/06/18/new-tool-sortcanon-py/>\
**Author**: Didier Stevens: <https://x.com/DidierStevens>\
**License**: Public Domain\
**State File**: [remnux.scripts.sortcanon](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/sortcanon.sls)

## OpenSSH

Initiate and receive SSH and SFTP connections.

**Website**: <https://www.openssh.com>\
**Author**: <https://github.com/openssh/openssh-portable/blob/master/CREDITS>\
**License**: BSD licence: <https://github.com/openssh/openssh-portable/blob/master/LICENCE>\
**Notes**: sftp, ssh, sshd \<start|stop|status>, etc.\
**State File**: [remnux.packages.openssh](https://github.com/REMnux/salt-states/blob/master/remnux/packages/openssh.sls)

## 7-Zip

Compress and decompress files using a variety of algorithms.

**Website**: <https://www.7-zip.org>\
**Author**: Igor Pavlov\
**License**: GNU Lesser General Public License (LGPL)\
**Notes**: 7-Zip standard: 7z, 7za, 7zr. For latest alpha version, use 7zz instead of 7z.\
**State File**: [remnux.packages.7zip](https://github.com/REMnux/salt-states/blob/master/remnux/packages/7zip.sls)

## Firefox

Web browser.

**Website**: <https://www.mozilla.org/firefox/>\
**Author**: Mozilla Corporation\
**License**: Mozilla Public License (MPL): <https://www.mozilla.org/en-US/MPL/#source-code>\
**Notes**: firefox\
**State File**: [remnux.packages.firefox](https://github.com/REMnux/salt-states/blob/master/remnux/packages/firefox.sls)

## Info-ZIP

Compress and decompress files using the zip algorithm.

**Website**: <http://infozip.sourceforge.net>\
**Author**: Ed Gordon, Mark Adler, Jean-loup Gailly, David Kirschbaum, Rich Wales, etc.\
**License**: Free, custom license\
**Notes**: zip, unzip\
**State File**: [remnux.packages.unzip](https://github.com/REMnux/salt-states/blob/master/remnux/packages/unzip.sls)

## cabextract

Extract Microsoft cabinet (cab) files.

**Website**: <https://www.cabextract.org.uk>\
**Author**: <https://www.cabextract.org.uk/#credits>\
**License**: GNU General Public License (GPL)\
**State File**: [remnux.packages.cabextract](https://github.com/REMnux/salt-states/blob/master/remnux/packages/cabextract.sls)

## nasm

An x86-64 assembler.

**Website**: <https://www.nasm.us>\
**Author**: H. Peter Anvin, Cyrill Gorcunov, Chang Seok Bae, Jim Kukunas, Frank B. Kotler, etc.: <https://github.com/netwide-assembler/nasm/blob/master/AUTHORS>\
**License**: BSD 2-Clause "Simplified" License: <https://github.com/netwide-assembler/nasm/blob/master/LICENSE>\
**State File**: [remnux.packages.nasm](https://github.com/REMnux/salt-states/blob/master/remnux/packages/nasm.sls)

## SQLite

Manage and interact with SQL database files.

**Website**: <http://www.sqlite.org>\
**Author**: D. Richard Hipp, Dan Kennedy, Joe Mistachkin: <https://www.sqlite.org/crew.html>\
**License**: Public Domain: <https://www.sqlite.org/copyright.html>\
**Notes**: sqlite3\
**State File**: [remnux.packages.sqlite](https://github.com/REMnux/salt-states/blob/master/remnux/packages/sqlite.sls)

## unrar-free

Decompress files using a variety of algorithms.

**Website**: <https://www.rarlab.com>\
**Author**: Ben Asselstine, Eugene Roshal, Christian Scheurer, Johannes Winkelmann\
**License**: GNU General Public License (GPL) v2+\
**Notes**: unrar\
**State File**: [remnux.packages.unrar](https://github.com/REMnux/salt-states/blob/master/remnux/packages/unrar.sls)

## RAR

Compress and decompress files using a variety of algorithms.

**Website**: <https://www.rarlab.com>\
**Author**: Alexander Roshal\
**License**: Shareware: "Anyone may use this software during a test period of 40 days. Following this test period of 40 days or less, if you wish to continue to use RAR, you must purchase a license." For details, see <https://www.rarlab.com/license.htm>.\
**Notes**: rar\
**State File**: [remnux.packages.rar](https://github.com/REMnux/salt-states/blob/master/remnux/packages/rar.sls)

## Docker

Run and manage containers.

**Website**: <https://www.docker.com>\
**Author**: Docker Inc.\
**License**: Apache License 2.0: <https://github.com/moby/moby/blob/master/LICENSE>\
**State File**: [remnux.packages.docker](https://github.com/REMnux/salt-states/blob/master/remnux/packages/docker.sls)

## Nautilus

Graphical file manager.

**Website**: <https://gitlab.gnome.org/GNOME/nautilus>\
**Author**: <https://gitlab.gnome.org/Teams>\
**License**: GNU General Public License (GPL) v3: <https://gitlab.gnome.org/GNOME/nautilus/-/blob/master/LICENSE>\
**State File**: [remnux.packages.nautilus](https://github.com/REMnux/salt-states/blob/master/remnux/packages/nautilus.sls)

## Wine

Run Windows applications.

**Website**: <https://www.winehq.org>\
**Author**: <https://wiki.winehq.org/Acknowledgements>\
**License**: GNU Lesser General Public License (LGPL) v2.1 or later: <https://wiki.winehq.org/Licensing>\
**Notes**: wine\
**State File**: [remnux.packages.wine](https://github.com/REMnux/salt-states/blob/master/remnux/packages/wine.sls)

## cURL

Interact with servers via supported protocols, including HTTP, HTTPS, FTP, IMAP, etc. using this command-line tool.

**Website**: <https://curl.se>\
**Author**: Daniel Stenberg and contributors: <https://curl.se/docs/thanks.html>\
**License**: Free, custom license: <https://curl.se/docs/copyright.html>\
**Notes**: curl\
**State File**: [remnux.packages.curl](https://github.com/REMnux/salt-states/blob/master/remnux/packages/curl.sls)

## IBus

Adjust input methods for the GUI.

**Website**: <https://github.com/ibus/ibus>\
**Author**: Peng Huang, Takao Fujiwara\
**License**: GNU Lesser General Public License (LGPL) v2.1: <https://github.com/ibus/ibus/blob/master/COPYING>\
**Notes**: ibus-setup\
**State File**: [remnux.packages.ibus](https://github.com/REMnux/salt-states/blob/master/remnux/packages/ibus.sls)

## GNOME Calculator

Calculator.

**Website**: <https://wiki.gnome.org/Apps/Calculator>\
**Author**: <https://github.com/GNOME/gnome-calculator/graphs/contributors>\
**License**: GNU General Public License (GPL) v3: <https://github.com/GNOME/gnome-calculator/blob/mainline/COPYING>\
**Notes**: galculator\
**State File**: [remnux.packages.galculator](https://github.com/REMnux/salt-states/blob/master/remnux/packages/galculator.sls)

## myjson-filter.py

Filter data formatted using the JSON format used by Didier Stevens' tools.

**Website**: <https://blog.didierstevens.com/2022/04/09/new-tool-myjson-filter-py/>\
**Author**: Didier Stevens: <https://x.com/DidierStevens>\
**License**: Public Domain\
**State File**: [remnux.scripts.myjson-filter](https://github.com/REMnux/salt-states/blob/master/remnux/scripts/myjson-filter.sls)

## PowerShell Core

Run PowerShell scripts and commands.

**Website**: <https://github.com/powershell/powershell>\
**Author**: Microsoft Corporation\
**License**: MIT License: <https://github.com/PowerShell/PowerShell/blob/master/LICENSE.txt>\
**Notes**: pwsh\
**State File**: [remnux.packages.powershell](https://github.com/REMnux/salt-states/blob/master/remnux/packages/powershell.sls)

## sshpass

Supply a password to SSH non-interactively for automated logins.

**Website**: <https://sourceforge.net/projects/sshpass/>\
**Author**: Shachar Shemesh\
**License**: GPLv2: <https://www.gnu.org/licenses/old-licenses/gpl-2.0.en.html>\
**Notes**: sshpass\
**State File**: [remnux.packages.sshpass](https://github.com/REMnux/salt-states/blob/master/remnux/packages/sshpass.sls)


# Docker Images of Malware Analysis Tools

The REMnux toolkit provides [Docker](https://www.docker.com) images of popular malware analysis tools that you can run on any compatible system even without installing the REMnux distro. These images reside in the [REMnux repository on Docker Hub](https://hub.docker.com/u/remnux), and are based on the files maintained in the [REMnux Github repository](https://github.com/REMnux/docker).

{% hint style="success" %}
In addition to the Docker images of individual tools, described below, you can run the [REMnux distro inside a pre-built Docker container](/install-distro/remnux-as-a-container).
{% endhint %}

Docker is installed as part of the REMnux distro. If you're planning to run REMnux Docker images on another system, you may need to [install Docker](https://docs.docker.com/get-docker/). The first time you run an [image](https://jfrog.com/knowledge-base/a-beginners-guide-to-understanding-and-building-docker-images/) (e.g., using the `docker run` command), Docker will automatically download the image from Docker Hub, run it locally as an active [container](https://www.docker.com/resources/what-container). Your system will need to be connected to the internet to retrieve the image; afterwards, Docker will use a locally cached copy. You can use the `docker pull` command to update the cached version of the image.

The following Docker images of malware analysis tools are available as part of REMnux. If you have the expertise, consider adding to this collection by [contributing a Dockerfile](/get-involved/add-or-update-tools/contribute-dockerfile) to the REMnux toolkit.

## Thug Low-Interaction Honeyclient <a href="#thug" id="thug"></a>

[Thug](https://github.com/buffer/thug) is a low-interaction honeyclient for examining suspicious websites. This tool was created by Angelo Dell'Aera. It's licensed under [GNU General Public License (GPL) v2](https://github.com/buffer/thug/blob/master/LICENSE.txt). In addition to being available as a Docker image, [Thug is also installed](/discover-the-tools/explore+network+interactions/connecting#thug) as part of the REMnux distro.

One way to run Thug as a Docker image is to invoke it using the following command to open a shell in the container where you can run `thug` with the desired parameters, such as -F to enable file logging).

```
docker run --rm -it --entrypoint "/bin/bash" remnux/thug
```

The password for the container's user `thug` is `thug`. The remnux/thug image is hosted on [its Docker Hub page](https://hub.docker.com/repository/docker/remnux/thug).

## Binary Refinery <a href="#binaryrefinery" id="binaryrefinery"></a>

The [Binary Refinery](https://github.com/binref/refinery)™ is a collection of Python scripts that implement transformations of binary data such as compression and encryption. You can chain the tools as necessary to achieve your objective. This toolkit is authored by Jesko Hüttenhain and licensed under the [3-Clause BSD License](https://github.com/binref/refinery/blob/master/LICENSE).

To run Binary Refinery tools within the "remnux/binary-refinery" container, create a directory where you'll store your input files, e.g. \~/workdir. Then, use a command like this to launch the container and have your directory mapped as /home/nonroot/workdir inside the container:

```
docker run --rm -it -v ~/workdir:/home/nonroot/workdir remnux/binary-refinery
```

The binary-refinery Docker image is hosted in [the REMnux Docker Hub repository](https://hub.docker.com/repository/docker/remnux/binary-refinery).

For documentation about this toolkit, including the listing of its tools, see [https://binref.github.io](https://binref.github.io/) and <https://github.com/binref/refinery>.

## PyLingual Python Bytecode Decompiler <a href="#pylingual" id="pylingual"></a>

[PyLingual](https://github.com/syssec-utd/PyLingual) is an ML-based decompiler that translates Python 3.9+ bytecode back to source code using transformer models. It was created by UT Dallas Systems Security (syssec-utd) and is licensed under the [GNU General Public License (GPL) v3](https://github.com/syssec-utd/PyLingual/blob/main/LICENSE).

To run PyLingual, create a directory where you'll store the `.pyc` files you plan to decompile. Then, open a shell inside the container:

```
docker run --rm -it -v ~/workdir:/home/nonroot/workdir remnux/pylingual
```

PyLingual downloads ML models from Hugging Face on first use. To persist the model cache across container runs, mount a second volume:

```
docker run --rm -it -v ~/workdir:/home/nonroot/workdir -v ~/pylingual-models:/home/nonroot/.cache/huggingface remnux/pylingual
```

The remnux/pylingual image is hosted on [its Docker Hub page](https://hub.docker.com/repository/docker/remnux/pylingual).

## RetDec Retargetable Machine-Code Decompiler <a href="#retdec" id="retdec"></a>

[RetDec](https://github.com/avast/retdec) is a decompiler that supports a variety of file formats, including PE and ELF, and several 32 and 64-bit architectures. It was created by [Avast Software](https://www.avast.com), and is licensed under [MIT License](https://github.com/avast/retdec/blob/master/LICENSE) with [third-party components](https://github.com/avast/retdec/blob/master/LICENSE-THIRD-PARTY) that are distributed under their own licenses.

To run RetDec, create a directory where you'll store the files you plan to examine. Then, open a shell inside the container where you can run RetDec commands and have your local directory mapped as `/home/retdec/workdir` inside the container:

```
docker run --rm -it -v ~/workdir:/home/retdec/workdir remnux/retdec
```

The password for the container's user `retdec` is `retdec`. The remnux/retdec image is hosted on [its Docker Hub page](https://hub.docker.com/repository/docker/remnux/retdec).

{% hint style="info" %}
The commands provided by RetDec start with the `retdec-` prefix and include retdec-decompiler, retdec-unpacker, and retdec-fileinfo.
{% endhint %}

## Rizin Reverse-Engineering Framework <a href="#rizin" id="rizin"></a>

[Rizin](https://rizin.re) is a reverse-engineering framework that includes a disassembler and analysis capabilities for a variety of executable formats and architectures. It's licensed under [GNU Lesser General Public License (LGPL) v3](https://github.com/rizinorg/rizin/blob/master/COPYING). This is a [fork of the Radare2 project](https://rizin.re/posts/faq/#why-did-you-fork-radare2).

To run Rizin, create a directory where you'll store the files you plan to examine. Then, open a shell inside the container where you can run Rizin commands (`rizin` and others that start with `rz-`) and have your local directory mapped as `/home/nonroot/workdir` inside the container:

```
docker run --rm -it -v ~/workdir:/home/nonroot/workdir remnux/rizin
```

If you're planning to perform kernel-mode debugging, process tracing, or syscall tracing inside the container, then supply the parameters `--cap-drop=ALL --cap-add=SYS_PTRACE` when launching it.

The password for the container's user `nonroot` is `nonroot`. The remnux/rizin image is hosted on [its Docker Hub page](https://hub.docker.com/repository/docker/remnux/rizin).

## Radare2 Reverse-Engineering Framework <a href="#radare2" id="radare2"></a>

[Radare2](https://www.radare.org/) is a reverse-engineering framework that includes a disassembler and analysis capabilities for a variety of executable formats and architectures. It's licensed under [GNU Lesser General Public License (LGPL) v3](https://github.com/radareorg/radare2/blob/master/COPYING).

To run Radare2, create a directory where you'll store the files you plan to examine. Then, open a shell inside the container where you can run Radare2 commands and have your local directory mapped as `/home/nonroot/workdir` inside the container:

```
docker run --rm -it -v ~/workdir:/home/nonroot/workdir remnux/radare2
```

If you're planning to perform kernel-mode debugging, process tracing, or syscall tracing inside the container, then supply the parameters `--cap-drop=ALL --cap-add=SYS_PTRACE` when launching it.

The image includes [r2ai](https://github.com/radareorg/r2ai) and decai plugins for LLM-powered reverse engineering. These require an LLM backend such as a cloud API or a local model server like Ollama. To use a cloud API, pass the API key and configure the provider inside `r2`:

```
docker run --rm -it -e OPENAI_API_KEY=your-key -v ~/workdir:/home/nonroot/workdir remnux/radare2
```

The password for the container's user `nonroot` is `nonroot`. The remnux/radare2 image is hosted on [its Docker Hub page](https://hub.docker.com/repository/docker/remnux/radare2).


# Using AI with REMnux

REMnux includes tools that let AI assistants run malware analysis tools via the [Model Context Protocol](https://modelcontextprotocol.io) (MCP). MCP is an open protocol that lets AI assistants use external tools and data sources. Any MCP-compatible AI agent can use the REMnux MCP server to analyze samples. [OpenCode](/discover-the-tools/use+artificial+intelligence), a terminal-based AI assistant, is pre-installed and pre-configured as the quickest way to get started.

For details about the individual AI tools included in REMnux, see the [Use Artificial Intelligence](/discover-the-tools/use+artificial+intelligence) page. For a walkthrough of AI-assisted malware analysis in practice, read [Using AI Agents to Analyze Malware on REMnux](https://zeltser.com/ai-malware-analysis-remnux).

## Using AI Assistants on REMnux <a href="#ai-assistants" id="ai-assistants"></a>

Once an AI assistant is connected to the REMnux MCP server, you can tell it what you'd like to analyze. The AI uses the REMnux MCP server to run the appropriate REMnux tools automatically. The MCP server offers guidance regarding the tools that the AI should consider, but it's up to the AI agent to decide on the analysis workflow. And, of course, your interactions, requests, and observations can also direct the AI regarding the analysis steps.

Key capabilities available to AI assistants through the REMnux MCP server:

* Analyze files based on detected type (PE, PDF, Office docs, scripts, ELF, etc.)
* Get tool recommendations for a specific file without running them
* Run specific REMnux tools directly, including piped commands
* Extract indicators of compromise (IOCs) from text
* Get usage help for any installed REMnux tool

The AI assistant can upload your sample to REMnux. Or you can place samples in `/home/remnux/files/samples` or provide absolute file paths. Analysis output goes to `/home/remnux/files/output`.

### Example Prompts

Here are a few examples of how you might start a conversation with your AI assistant:

* `Analyze the file sample.exe and summarize its capabilities`
* `What tools should I use to examine this PDF?`
* `Download the file at https://example.com/suspicious.bin and analyze it`
* `Extract IOCs from this text: <paste the suspicious content here>`

The AI decides which REMnux tools to run based on your request. You can also ask it to run a specific tool if you prefer.

### Using OpenCode

[OpenCode](/discover-the-tools/use+artificial+intelligence) and the REMnux MCP server are pre-installed and pre-configured on REMnux. You can launch OpenCode with the `opencode` command in the terminal.

As of this writing, OpenCode comes with a default AI model that lets you experiment immediately.

{% hint style="warning" %}
The default model may be in trial mode and might use the data you supply for training. For real analysis, configure your own AI model provider's API key in OpenCode's settings, or use your preferred AI tool as described in the next section.
{% endhint %}

OpenCode on REMnux comes with three MCP servers pre-configured:

* **remnux** — connects to the local REMnux analysis toolkit
* **remnux-docs** — provides access to REMnux documentation for tool guidance
* **ghidra** — connects to [GhidrAssistMCP](/discover-the-tools/use+artificial+intelligence) for AI-assisted reverse engineering when the plugin is activated in Ghidra

## Connecting Other AI Tools to REMnux <a href="#other-ai-tools" id="other-ai-tools"></a>

You can also use AI tools running outside REMnux (such as Claude Code or Cursor) and connect them to the REMnux MCP server running in the VM or container. They get the same MCP capabilities described above. Two approaches:

* **MCP server on your workstation**: Install the server on your machine using `npx @remnux/mcp-server`. It connects to REMnux via Docker exec or SSH to run analysis tools.
* **MCP server inside REMnux over HTTP**: The MCP server is already installed in REMnux. Start it with HTTP transport so it listens on a network port. Your AI tool connects over the network using bearer token authentication.

See the [REMnux MCP server documentation](https://github.com/REMnux/remnux-mcp-server) for setup instructions and configuration examples for each scenario.

## Using r2ai Inside Radare2 <a href="#r2ai" id="r2ai"></a>

The MCP-based tools above work by having an AI assistant orchestrate REMnux tools from the outside. [Radare2](/discover-the-tools/dynamically+reverse-engineer+code/general) offers a complementary approach: its [r2ai](https://github.com/radareorg/r2ai) and [decai](https://github.com/radareorg/r2ai) plugins embed AI directly inside the reverse engineering environment. You interact with the LLM from the radare2 prompt while it has full access to your current analysis session — disassembly, strings, cross-references, and more.

To use r2ai, set your API key and model, then ask questions about the binary you have open:

```
$ r2 /path/to/sample
[0x00401000]> decai -e api=openai
[0x00401000]> decai -e model=gpt-4o
[0x00401000]> decai -e apikey=sk-...
[0x00401000]> decai -d
```

The `decai -d` command decompiles the current function using AI. You can also use `r2ai` for conversational queries about the binary. For local inference without sending data to an external API, point r2ai at a local [Ollama](https://ollama.com) instance.

## Security Considerations <a href="#security" id="security"></a>

As always, be careful in all your interactions with malware. Consider dedicating a system to your research tasks. Keep the following design principles and precautions in mind.

### AI Model Provider Data Handling

When using AI tools for analysis, details about your samples are sent to the AI model provider's API. Choose a provider whose data handling policies you trust. Avoid using default or free models that might train on your data for real analysis work.

### Disposable Environment

Always run REMnux in a disposable VM or container when analyzing malware, regardless of whether you use AI tools.

### MCP Connection Security

The security of the MCP connection depends on how you deploy it:

* **MCP server and AI agent on REMnux**: The MCP connection stays entirely local; however, unless you're using a local LLM, the REMnux VM or container will need internet access. If necessary, you can use network security measures to restrict outbound activity so the system can only communicate with the LLM provider.
* **MCP server and AI agent on your workstation**: MCP traffic stays on your machine via Docker exec, travels over encrypted SSH to the VM, or uses HTTP with a bearer token for authentication. In this case, the REMnux VM or container doesn't need internet access. If using HTTP, generate a strong token (e.g., `openssl rand -hex 32`) and consider HTTPS via a reverse proxy if the network path between your AI tool and REMnux is untrusted.

### Prompt Injection from Malware

Malware samples can contain strings designed to manipulate AI assistants. The MCP server includes mitigations, but container and VM isolation, as well as the isolation of your system and your judgment are the primary defenses.

When the MCP server runs on your workstation, there is a small chance that malicious tool output could inject into the prompt returned to your AI agent and influence its behavior. Review AI-generated analysis critically. AI assists your analysis but does not replace analyst judgment.


# REMnux Configuration Tips

## Changing the Keyboard Layout <a href="#keyboard-layout-change" id="keyboard-layout-change"></a>

To change the keyboard layout of your REMnux system, perhaps to another language, take the following steps:

1. Open the Settings window using the command `gnome-control-center`.
2. Go to the Region & Language area.
3. Press the + button in the Input Sources area.
4. Find the desired input source. You might need to press the `⋮` button, scroll down, and press Other to find the desired source.
5. Select the desired input source and click the Add button.
6. Close the Settings window.

Sometimes you might need to reboot for the setting to take effect.

You can switch between the keyboard layouts by clicking the language icon in the top right corner of your desktop. If you need additional guidance, please [see this article](https://geekrewind.com/configure-ubuntu-18-04-lts-beta-keyboard-layout-for-native-languages/).

## Adjusting Text Size and UI Scaling <a href="#text-size-scaling" id="text-size-scaling"></a>

If the fonts and other user interface elements are too small in your REMnux virtual machine, you can increase the UI scaling factor by running this command on REMnux:

```
set-scale
```

## Localhost Listener on TCP and UDP Ports 53 <a href="#port-53-listener" id="port-53-listener"></a>

Ubuntu uses a daemon named "systemd-resolved" for resolving DNS queries that you initiate from the system. This daemon listens on the localhost interface on TCP and UDP ports 53. If you're running a tool that attempts to listen on these ports on localhost, your tool might not function properly.

To get around this, reconfigure the tool so it listens on the Ethernet network interface of your REMnux system and not on the localhost network interface.

Alternatively, you can disable the systemd-resolved daemon until the next reboot like this:

```
sudo systemctl stop systemd-resolved
```

If you wish to disable systemd-resolved permanently issue the following command. However, note that if you disable this daemon, you will be unable to resolve DNS queries from your REMnux system unless you reconfigure the system's DNS resolver settings. Also, some software, such as OpenVPN and other VPN clients, might not function properly if systemd-resolved is disabled.

```
sudo systemctl disable systemd-resolved
```

## GUI Interactions When REMnux Is in the Cloud <a href="#gui-cloud-remnux" id="gui-cloud-remnux"></a>

If you set up a REMnux system in a cloud environment, such as AWS, you can not only interact with it using the text-based SSH interface, but also using the graphical Gnome interface that comes with REMnux.

You'll need to activate the SSH daemon on your REMnux system; one way to do this is to run the `sshd start` command. Before doing this, be sure to harden the configuration of your cloud-based REMnux system and set up SSH authentication according to your requirements and risk tolerance.

### X11 Forwarding

One way to remotely interact with REMnux using a graphical interface is to use X11 forwarding through SSH. If you [installed REMnux in "addon" mode](/install-distro/add-to-existing-system), you'll need to configure your SSH daemon to support X11 forwarding; in other cases, SSH on REMnux is already set up appropriately.

Next:

1. Configure the SSH client on your local system to enable X11 forwarding.
2. Connect to your remote REMnux system using SSH, assuming the SSH daemon on REMnux is configured and active.
3. Activate X server software on your local system, unless you're running Linux. If you're using Linux as your local system, it will natively support receiving X11 connections. If you're using Windows or macOS, you'll need to install X server software. [Xming](http://www.straightrunning.com/XmingNotes/) and [VcXsrv](https://sourceforge.net/projects/vcxsrv/) for Windows and [XQuartz](https://www.xquartz.org) for macOS are reasonable free options.

For an example of performing some of these steps, consider an AWS blog post on [setting up X11 forwarding](https://aws.amazon.com/de/blogs/compute/how-to-enable-x11-forwarding-from-red-hat-enterprise-linux-rhel-amazon-linux-suse-linux-ubuntu-server-to-support-gui-based-installations-from-amazon-ec2/).

### VNC Access

Another way to remotely interact with the REMnux graphical environment is to use a VNC tool such as [TigerVNC](https://tigervnc.org), which you can tunnel over SSH and set up like this:

1. Install TigerVNC viewer on the local system from which you're planning to access the remote REMnux system.
2. Connect to your remote REMnux system using SSH, assuming the SSH daemon on REMnux is active.
3. Install TigerVNC server on your remote REMnux system: `sudo apt install -y tigervnc-standalone-server`
4. Set up your VNC password using the [vncpasswd](https://tigervnc.org/doc/vncpasswd.html) command.
5. On your local system create an SSH tunnel from port 5901 to port 5901 using a command such as `ssh -L 5901:localhost:5901 user@your-remnux-ip`
6. Launch a TigerVNC server on your remote REMnux system: `vncserver :1`
7. Start a VNC client on your local system, directing it to connect to `localhost:1`

## Transferring Files In and Out of REMnux <a href="#transferring-files" id="transferring-files"></a>

There are several ways of transferring files, such as malware samples, in and out of REMnux.

### Virtual Machine Tools <a href="#vm-tools" id="vm-tools"></a>

If you're running REMnux as a local VM, one way to transfer files in and out of the VM is to use the copy-and-paste or file transfer capabilities of your hypervisor. If using copy-and-paste, you can place files in and out of the VM by copying them to or from [Nautilus](/discover-the-tools/general+utilities#nautilus), which is the GUI file browsing tool on REMnux.

If REMnux is running in VirtualBox, you can go to the Devices menu of VirtualBox for your REMnux VM and select `Shared Folders`, `Shared Clipboard` , and `Drag and Drop`. To enable this functionality, you need to have Guest Additions installed in the REMnux virtual machine, which is preinstalled as part of the VirtualBox version of the REMnux virtual appliance. The appliance ships with `Shared Clipboard` and `Drag and Drop` enabled.

In VMware, similar functionality is supported by the open-vm-tools package, which is preinstalled in the general version of the REMnux virtual appliance and if you installed the distro from scratch using the REMnux installer. You can modify settings of your REMnux virtual machine to disable `Drag and Drop` and `Copy and Paste`, if you wish; they're enabled by default. You can also enable `Shared Folders`, which are disabled by default.

REMnux automatically detects your hypervisor and installs appropriate guest tools when you run `remnux install`. On VMware, it installs open-vm-tools; on KVM/QEMU/Proxmox, it installs qemu-guest-agent and spice-vdagent. For VirtualBox, install Guest Additions from the ISO as described in [the virtual appliance guide](/install-distro/get-virtual-appliance#virtualbox).

{% hint style="danger" %}
Enabling hypervisor-based file and clipboard sharing capabilities somewhat increases the risk that if you run malicious code in your REMnux virtual machine, the malware will adversely affect your underlying host. Many analysts consider this an acceptable risk.
{% endhint %}

### SFTP

Another way to get files in and out of REMnux is to use the SFTP protocol, which is supported by [OpenSSH](/discover-the-tools/general+utilities#openssh). Unless you installed REMnux in `cloud` mode or are running [REMnux as a Docker container](/install-distro/remnux-as-a-container), OpenSSH is disabled by default. You can activate OpenSSH in your VM using the `sshd start` command. You can then use an SFTP client to connect to or from REMnux; the SFTP client built into REMnux is the command-line tool `sftp`.

### Removable Media

Yet another method to transfer files in and out of REMnux is to use removable media, such as a USB drive. If running REMnux as a VM, you'd need to use your hypervisor to map the USB drive into the virtual machine.

### Mapping Files into the Container <a href="#mapping-files" id="mapping-files"></a>

If you are running [REMnux as a Docker container](/install-distro/remnux-as-a-container), you can invoke the container by mapping a directory on your local system into the container to create a shared location for your files. You can use [Docker's `-v` or `--mount` parameters](https://docs.docker.com/storage/volumes/) when launching the container to achieve this.

## Switching REMnux Installation Mode After the Install <a href="#switch-mode" id="switch-mode"></a>

If you installed REMnux using one installation mode, for example `addon`, you can switch to another installation mode, for example `dedicated`, by taking the following steps:

1. Edit the /etc/remnux-config and change the mode from `addon` to `dedicated`.
2. Run the command `sudo remnux install`.
3. Reboot.

## Combining REMnux and SIFT Workstation <a href="#combine-remnux-sift" id="combine-remnux-sift"></a>

You can install REMnux and [SIFT Workstation](https://www.sans.org/tools/sift-workstation/) on the same system to create a powerful toolkit for malware analysis and other digital forensics tasks. Follow the following guidelines to do this:

* [Install REMnux and SIFT Workstation on a traditional Linux system.](https://www.sans.org/blog/how-to-install-sift-workstation-and-remnux-on-the-same-forensics-system/)
* [Install REMnux and SIFT Workstation on Windows Subsystem for Linux (WSL).](https://bakerstreetforensics.com/2021/05/26/adding-sift-and-remnux-to-your-windows-forensics-environment/)


# REMnux Tool Tips

If you create an article, blog post, or video, showcasing how you use a tool installed on REMnux for malware analysis, please [reach out to Lenny Zeltser,](https://zeltser.com/contact) so he can point to your content from here.

* [Using AI Agents to Analyze Malware on REMnux](https://zeltser.com/ai-malware-analysis-remnux) - Demonstrates AI-assisted analysis workflows using the REMnux MCP server, by Lenny Zeltser.
* One-page [cheat sheet for using REMnux](https://zeltser.com/remnux-malware-analysis-tips/), providing an overview of some of the most useful tools available as part of the distro.
* How you can [use memory forensics and other tools installed on REMnux](https://www.youtube.com/watch?v=AONAkmt0Vdg) for malware analysis - A video by [Aaron Sparling](https://x.com/OSINTlabworks).
* [Analyzing Windows Malware on Linux: Getting Started Tips and Examples](https://www.youtube.com/watch?v=J85991pPYoc) - A video that showcases REMnux, presented by Lenny Zeltser.
* How to configure INetSim on REMnux to assist with network activity analysis - A part of a larger [guide on building a malware analysis lab](https://www.sentinelone.com/labs/building-a-custom-malware-analysis-lab-environment/) by Marco Figueroa
* Get started [analyzing malicious documents to extract IOCs](https://www.youtube.com/watch?v=3rh82pG7MME\&feature=youtu.be) by [John Hubbard](https://www.sans.org/profiles/john-hubbard/)


# Malware Analysis Training

Many of the tools available in the REMnux toolkit are discussed in the SANS course [FOR610: Reverse Engineering Malware](https://sans.org/for610). Lenny Zeltser, the founder and primary maintainer of REMnux, is also the primary author of this course.

{% embed url="<https://www.youtube.com/watch?v=yZ6D4-Jz3Hc>" %}


# People

The following people are involved with the REMnux project in a significant capacity, in addition to members of the community who help test the distro, suggest tools, and help diagnose and correct issues.

## Lenny Zeltser

Lenny is the founder of REMnux, which he launched in 2010. He is the primary maintainer of REMnux and is the official point of contact for the project. He is a builder of security products and programs and a teacher of those who run them. Take a look at [Lenny's website and blog](https://zeltser.com/).

## Corey Forman

Corey is a major contributor to REMnux, having joined the project in 2020. He has been setting up, upgrading, and testing many of the REMnux tools. Corey has also been assisting with documentation, and offering invaluable advice. You can find him on [GitHub](https://github.com/digitalsleuth).

## Erik Kristensen

Erik designed the back-end architecture based on SaltStack for the REMnux distro and the Cast installer that REMnux uses behind the scenes. He's been advising the project since 2017. You can find Erik on [GitHub](https://github.com/ekristen).

## Tool Authors

REMnux wouldn't be possible without the authors of the tools that comprise the distro. They are the heart of the REMnux project. These individuals have been propelling the draft and craft of cybersecurity by sharing their skills and tools with the community. [The listing of REMnux tools](https://github.com/REMnux/docs/blob/master/discover-the-tools/README.md) includes the author's name and the tool's license whenever possible.

## Special Thanks

Special thanks to David Westcott, who contributed his time, energy, and expertise to the REMnux distro during his participation in the project from 2015 to 2017.


# Technologies

The major technologies that work together to make REMnux possible are:

* [SaltStack State Files](/behind-the-scenes/technologies/saltstack-management): Manage the installation and configuration of the building blocks of the distro.
* [REMnux Installer](/behind-the-scenes/technologies/remnux-installer): Start the installation and upgrade of the distro.
* [State Files Without the REMnux Installer](/behind-the-scenes/technologies/state-files-without-the-remnux-installer): Invoke SaltStack directly without the REMnux installer, if necessary.
* [Debian Packages](/behind-the-scenes/technologies/debian-packages): Bundle software components for a reliable installation and updates.
* [Website and Docs](/behind-the-scenes/technologies/website-and-docs): Generate and host the REMnux website and this documentation.

You can read about how REMnux uses these technologies to learn from the approach and, if you wish, to [contribute new tools](/get-involved/add-or-update-tools) to the project.


# SaltStack Management

The REMnux distro uses [SaltStack](https://saltproject.io) to automate the installation and configuration of the tools that comprise the distro. This is accomplished using [Salt state files](https://docs.saltproject.io/en/latest/topics/tutorials/starting_states.html), each one describing the steps necessary to set up the software component. These files are stored in [the REMnux/salt-states repository on Github](https://github.com/REMnux/salt-states), and are available for your review. Read on to learn how REMnux uses these State Files to manage the configuration of a REMnux system.

{% hint style="info" %}
REMnux uses SaltStack for locally managing the configuration of the system where the distro is installed. It doesn't use other SaltStack capabilities, such as remote command execution.
{% endhint %}

A state file can direct SaltStack to install a tool by supporting a variety of formats in which such tools might be packaged, including [Ubuntu packages](https://packages.ubuntu.com), [pip modules](https://pypi.org/project/pip/), Git repositories, [Ruby gems](https://rubygems.org), etc. Each state file represents one aspect of the state in which the system should be after SaltStack runs. The files follow the YAML markup language.

## Salt State File to Install an Ubuntu Package <a href="#state-file-ubuntu-package" id="state-file-ubuntu-package"></a>

For example, here's the Salt state file [edb-debugger.sls](https://github.com/REMnux/salt-states/blob/master/remnux/packages/edb-debugger.sls) for installing [edb](https://github.com/eteran/edb-debugger), a powerful debugger for examining ELF binaries:

```
include:
  - remnux.repos.remnux
  - remnux.packages.xterm
  
edb-debugger:
  pkg.installed:
    - pkgrepo: remnux
    - version: latest
    - upgrade: True
    - require:
      - sls: remnux.packages.xterm
```

The line `edb-debugger:` specifies the name of the Ubuntu package that SaltStack should install. The `pkgrepo: remnux` line specifies that SaltStack will find this package in the Ubuntu package repository named "remnux." The `require` statement explains that this package depends on "xterm." The distro also includes state files that explain SaltStack should install [the remnux repository](https://github.com/REMnux/salt-states/blob/master/remnux/repos/remnux.sls) and [the xterm package](https://github.com/REMnux/salt-states/blob/master/remnux/packages/xterm.sls).

## Salt State File to Install a pip Package <a href="#state-file-pip" id="state-file-pip"></a>

Here's an example of a Salt state file [oletools.sls](https://github.com/REMnux/salt-states/blob/master/remnux/python3-packages/oletools.sls) to install [oletools](https://www.decalage.info/python/oletools), a set of Python tools for analyzing Microsoft Office documents. REMnux installs Python packages in isolated virtual environments to avoid dependency conflicts:

```
include:
  - remnux.packages.python3-virtualenv
  - remnux.python3-packages.xlmmacrodeobfuscator

remnux-python3-packages-oletools-venv:
  virtualenv.managed:
    - name: /opt/oletools
    - venv_bin: /usr/bin/virtualenv
    - pip_pkgs:
      - pip>=24.1.3
      - setuptools>=70.0.0
    - require:
      - sls: remnux.packages.python3-virtualenv

remnux-python3-packages-oletools:
  pip.installed:
    - name: oletools
    - bin_env: /opt/oletools/bin/python3
    - upgrade: True
    - require:
      - virtualenv: remnux-python3-packages-oletools-venv
```

The state file first creates a virtual environment at `/opt/oletools` using `virtualenv.managed`, then installs the oletools package into that environment using `pip.installed`. This pattern isolates each tool's dependencies and avoids conflicts between packages.

## Salt State File to Configure a Tool

REMnux also uses Salt state files to configure the environment and the tools installed as part of the distro. For example, here's a short excerpt from [the Salt state file that configures Ghidra](https://github.com/REMnux/salt-states/blob/master/remnux/config/ghidra/init.sls), which is a reverse-engineering tool that includes a disassembler and debugger. (The installation of Ghidra is handled using a separate [ghidra.sls](https://github.com/REMnux/salt-states/blob/master/remnux/packages/ghidra.sls) file.)

```
remnux-config-ghidra-file-preferences:
  file.managed:
    - name: {{ home }}/.ghidra/.ghidra_10.1.1_PUBLIC/preferences 
    - source: salt://remnux/config/ghidra/preferences
    - replace: False
    - user: {{ user }}
    - group: {{ user }}
    - makedirs: True
    - require:
      - user: remnux-user-{{ user }}
    - watch:
      - archive: remnux-config-ghidra-gdt-archive
```

In the example above:

* [`file.managed`](https://docs.saltproject.io/en/latest/ref/states/all/salt.states.file.html#salt.states.file.managed) specifies the desired state of the Ghidra "preferences" file, located in the user's home directory.
* `source` of the file is [the version of "preferences" in the GitHub repository](https://github.com/REMnux/salt-states/blob/master/remnux/config/ghidra/preferences) where this state file resides; this directs SaltStack to copy this file to the location specified by `name`.
* `replace` directs SaltStack not to replace the file if it already exists.
* `user` and `group` specify that the file should be owned by the user and the user's group.
* `makedirs` direct SaltStack to create the directory structure so the file can be placed in the location specified by `name`.

The state file instructions above rely on the values `home` and `user`, which are set earlier in the file:

```
{%- set user = salt['pillar.get']('remnux_user', 'remnux') -%}
{%- if user == "root" -%}
  {%- set home = "/root" -%}
{%- else %}
  {%- set home = "/home/" + user -%}
{%- endif -%}
```

This excerpt from the Ghidra configuration state file uses the "[pillars](https://docs.saltproject.io/en/master/ref/modules/all/salt.modules.pillar.html#salt.modules.pillar.get)" feature of SaltStack, which gives SaltStack access to named values defined before the state file has a chance to run. In this case, the state file sets the `user` value by retrieving the pillar variable named `remnux_user`, which is normally set by [the REMnux installer](/behind-the-scenes/technologies/remnux-installer); if it's not available, SaltStack is directed to use the default value "remnux." Further, depending on the `user` value, the state file sets the `home` value to point to the user's home directory.


# REMnux Installer

The REMnux installer is a wrapper around [Cast](https://github.com/ekristen/cast) that provides a familiar interface for installing and upgrading the REMnux distro. Once installed, the tool is named `remnux` and resides in `/usr/local/bin`. You can examine its source code in the [REMnux/distro](https://github.com/REMnux/distro) repository on GitHub.

## High-Level Workflow

At a high level, the REMnux installer takes the following actions:

1. Installs or upgrades [Cast](https://github.com/ekristen/cast), verifying the download's integrity using a SHA256 checksum.
2. Cast retrieves the appropriate release of Salt state files from the [REMnux/salt-states](https://github.com/REMnux/salt-states) repository on GitHub. These state files describe how [SaltStack should install and configure the tools](/behind-the-scenes/technologies/saltstack-management).
3. Cast validates the retrieved state files using the REMnux [Cosign](https://github.com/sigstore/cosign) signature.
4. Cast runs SaltStack, directing it to execute state files that correspond to the specified installation mode.

{% hint style="info" %}
The REMnux installer is presently [incompatible with non-transparent proxies](/tips/remnux-config-tips#behind-proxy).
{% endhint %}

## Installation Modes

The installer supports three modes, specified with the `--mode` option:

* **dedicated** (default): Sets up a full REMnux system with the REMnux look and feel. Use this for a [dedicated REMnux system](/install-distro/install-from-scratch) in a local lab.
* **addon**: Installs REMnux tools without changing the system's look and feel. Use this to [add REMnux to an existing system](/install-distro/add-to-existing-system).
* **cloud**: Like dedicated, but keeps the SSH daemon enabled for remote access. Use this for cloud-based deployments.

## State File Retrieval and Validation

Cast retrieves Salt state files as a compressed archive from the "releases" area of the REMnux/salt-states repository. After extracting the contents, it places them under `/var/cache/cast` in a subdirectory named according to the release version.

To validate the integrity of the retrieved archive, Cast uses the REMnux [Cosign](https://github.com/sigstore/cosign) signature. Each release of the state files is signed with the corresponding REMnux Cosign key, and Cast verifies the signature before applying the state files.

It's possible to [retrieve and invoke REMnux state files using SaltStack directly](/behind-the-scenes/technologies/state-files-without-the-remnux-installer), for example when experimenting with the installation without relying on the REMnux installer.

## Installing and Updating REMnux

To install or update your REMnux system to the latest version, run:

```
sudo remnux install
```

You can also use `sudo remnux upgrade`, which is an alias for `install`.

To install a specific version of the state files, use the `--version` option:

```
sudo remnux install --version=v2026.6.24
```

If the name of your current user isn't `remnux`, specify it with the `--user` option:

```
sudo remnux install --user=YOUR_USERNAME
```

To see version and diagnostic information about your REMnux installation:

```
remnux debug
```

To check the results of the last installation or update:

```
remnux results
```


# State Files Without the REMnux Installer

The best way to install, upgrade, or update your REMnux system is usually to use the [REMnux installer](/behind-the-scenes/technologies/remnux-installer). However, sometimes you might want to invoke the underlying Salt state files directly, perhaps when experimenting with REMnux or when getting around some deficiency of the REMnux installer.

## State File Groupings for REMnux Distro Installation <a href="#state-file-bundles" id="state-file-bundles"></a>

The Salt state files for the REMnux distro are grouped into "bundles," so it's easier to trigger the installation or upgrade without directly referring to every individual tool's SaltStack state file:

* [addon.sls](https://github.com/REMnux/salt-states/blob/master/remnux/addon.sls) installs the state files for [adding REMnux to an existing system](/install-distro/add-to-existing-system) without changing its look and feel. This corresponds to the `--mode=addon` parameter to the REMnux installer.
* [dedicated.sls](https://github.com/REMnux/salt-states/blob/master/remnux/dedicated.sls) installs the state files for [setting up a dedicated REMnux system](/install-distro/install-from-scratch) in a local lab. This applies the same state files as addon.sls, but also invokes the "theme" and "theme-dedicated" state files to adjust the system's configuration for the full REMnux experience, including disabling the SSH daemon. This corresponds to the `--mode=dedicated` parameter to the REMnux installer, and is the default if `--mode` isn't specified.
* [cloud.sls](https://github.com/REMnux/salt-states/blob/master/remnux/cloud.sls) installs the state files for setting up a dedicated REMnux system in a cloud environment. This applies the same state files as dedicated.sls, except it doesn't disable the SSH daemon, which many people use for remote access. This corresponds to the `--mode=cloud` parameter to the REMnux installer.

## Manually Installing SaltStack

If you decide to interact with REMnux' Salt state files without the REMnux installer, first make sure a recent version of SaltStack is installed by executing the following commands, assuming you're using Ubuntu 24.04 (Noble) as the base OS:

```
sudo -s
apt-get update
apt-get install -y wget gnupg git
wget -O /etc/apt/keyrings/salt-archive-keyring.pgp https://packages.broadcom.com/artifactory/api/security/keypair/SaltProjectKey/public
wget -O /etc/apt/sources.list.d/salt.sources https://github.com/saltstack/salt-install-guide/releases/latest/download/salt.sources
apt-get update
apt-get install -y salt-common
mkdir -p /etc/salt
echo "file_client: local" > /etc/salt/minion
```

## Retrieving REMnux State Files

You can retrieve REMnux' Salt state files by downloading the desired state file archive from [the "releases" area of the REMnux/salt-states repository](https://github.com/REMnux/salt-states/releases) or by cloning the repo like this:

```
sudo git clone https://github.com/REMnux/salt-states.git /srv/salt
```

## Invoking SaltStack to Install State File Groupings

You can invoke SaltStack's `salt-call` utility to install the desired state file grouping. For example, for "dedicated" you'd use the command:

```
sudo salt-call -l debug --local state.sls remnux.dedicated
```

The parameter `-l debug` to the `salt-call` command provides verbose debug-level output of the operation. You can skip this parameter if you don't want that level of detail.

If the name of your current user isn't `remnux`, you'll need to add a `pillar` parameter to the `salt-call` command to specify your username:

```
sudo salt-call -l debug --local state.sls remnux.dedicated pillar='{"remnux_user": "YOUR_USERNAME"}'
```

Replace `YOUR_USERNAME` with your username. This is equivalent to the `--user=YOUR_USERNAME` optional parameter to the REMnux installer. The REMnux installer automatically passes the name of the currently-logged-in user, but you'll need to specify this yourself if running `salt-call` directly.


# Debian Packages

A common way of installing software on Linux distributions derived from [Debian](https://www.debian.org), including [Ubuntu](https://ubuntu.com), is to use the [Debian packaging format](https://help.ubuntu.com/community/SoftwarePackagingFormats#Debian_packages_.28.deb.29). Since REMnux is based on Ubuntu, it relies heavily on this format. As a result, many of the tools that SaltStack installs on REMnux are managed using the standard Ubuntu package management system called APT behind the scenes.

## Custom Debian Packages

Whenever possible, REMnux installs Debian-formatted packages from the standard Ubuntu repositories. In addition, there is a REMnux-specific repository of custom packages, which is [hosted on Launchpad](https://launchpad.net/~remnux/+archive/ubuntu/stable/+packages)--a website maintained by Ubuntu's parent company.

As part of the REMnux installation, the [remnux.sls](https://github.com/REMnux/salt-states/blob/master/remnux/repos/remnux.sls) Salt file adds the REMnux package repository to the system, so it's available to the APT package manager. The installation also adds [other repositories](https://github.com/REMnux/salt-states/tree/master/remnux/repos) where some packages reside, including the one for [SIFT Workstation](https://digital-forensics.sans.org/community/downloads).

Once built and tested, custom Debian-based packages are digitally signed using the REMnux private key, and are uploaded to Launchpad, which validates the signature and makes them available to REMnux systems via the APT package manager.

## Other Forms of Installation

In cases where the latest versions of malware analysis tools are not available as Debian-formatted packages, the distro installs them using other packaging formats such as:

* [pip](https://pypi.org/project/pip/) for Python
* [gems](https://rubygems.org) for Ruby
* [npm](https://www.npmjs.com) for Node.js
* [CPAN](https://www.cpan.org) for Perl

In some cases, REMnux directs SaltStack to install tools by directly downloading them from GitHub, their authors' websites, or other sources. This is done in situations where the author didn't package the tool using a standard format, and creating a custom Debian package was too time-consuming.

{% hint style="info" %}
The Debian-based packaging format offers the highest reliability, because it requires that the package be fully self-contained and not rely on external resources for installation. Installing tools by downloading them from authors' websites is on the other end of the reliability spectrum, and is the least preferred method for managing tools on REMnux.
{% endhint %}


# Website and Docs

Several technologies work together to generate and host the REMnux website and this documentation. Thank you to the people and companies behind these technologies for providing them as free resources to help make REMnux possible!

## The REMnux Website

The REMnux website, accessible at [https://REMnux.org](https://remnux.org), is a set of static pages and related asset files. It's hosted on GitHub using [GitHub Pages](https://pages.github.com). These contents reside in the [remnux/remnux.github.io](https://github.com/REMnux/remnux.github.io) repository.

The contents of that repository are generated using [Hugo](https://gohugo.io), based on the source files that reside in the [remnux/website-source](https://github.com/REMnux/website-source) repository on GitHub. Updating the REMnux website involves:

* Adjusting these files to reflect the desired change
* Using Hugo to generate the static website content
* Placing the new content in the remnux/remnux.github.io repository

The website contents are formatted using a customized version of the [Raditian Free Hugo Theme](https://github.com/radity/raditian-free-hugo-theme), which was created by [Radity](https://radity.com).

## The REMnux Documentation Site <a href="#documentation-site" id="documentation-site"></a>

The REMnux documentation site, which you're reading now and which resides at <https://docs.remnux.org>, is generated and hosted by [GitBook](https://www.gitbook.com). GitBook is configured to use the [remnux/docs](https://github.com/REMnux/docs) repository on GitHub as the location where the documentation is stored. Pull requests to that repo, once accepted, propagate to the published version of the documentation.

The contents of this documentation site are available via an MCP server, so that AI tools can conveniently access them. The MCP server's URL is `https://docs.remnux.org/~gitbook/mcp`.


# License

The tools that are a part of REMnux are free, but they come with individual licenses. The [listing of these tools](/discover-the-tools/examine+static+properties) includes information about these licenses whenever practical. However, it's up to you to make sure that you understand and follow each tool's license restrictions.

The configuration, code, and other contents created for the REMnux toolkit that "glue" the tools together are licensed under [GNU General Public License v3.0](https://www.gnu.org/licenses/gpl-3.0.en.html) unless stated otherwise.

In addition, note this important disclaimer about REMnux:

{% hint style="warning" %}
THE SOFTWARE IS PROVIDED "AS IS," WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES, OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
{% endhint %}

REMnux is a registered trademark of Zeltser Security Corp, which is a company owned by [Lenny Zeltser](https://zeltser.com/).


# Ask and Answer Questions

If you need help with some aspect of REMnux, please open an issue in "Issues" area of the REMnux repository on GitHub that is most relevant to the nature of your request:

* The functioning and configuration of tools as part of the distro: [REMnux/salt-states](https://github.com/REMnux/salt-states/issues)
* The use of the REMnux distro installer: [REMnux/remnux-cli](https://github.com/REMnux/remnux-cli/issues)
* The main REMnux.org website: [REMnux/website-source](https://github.com/REMnux/website-source/issues)
* Contents of this REMnux documentation site: [REMnux/docs](https://github.com/REMnux/docs/issues)
* Docker images available as part of the REMnux toolkit: [REMnux/docker](https://github.com/REMnux/docker/issues)

If you're an experienced user of REMnux and related technologies, consider reviewing the locations above and sharing your expertise by helping resolve the issues.


# Write About the Tools

If you created an article, a blog post, or a video about using a malware analysis tool on REMnux, [let Lenny Zeltser know](https://zeltser.com/contact/), so he can point to your piece from the [REMnux Tool Tips](/tips/remnux-tool-tips) page.


# Add or Update Tools

One way to contribute to REMnux is to add or update the tools that are a part of the distro. To add a new tool:

1. First become familiar with the way REMnux uses [Salt Stack](/behind-the-scenes/technologies/saltstack-management) and [Debian packages](/behind-the-scenes/technologies/debian-packages) to install and configure tools.
2. Then consider creating a [Salt State file](/get-involved/add-or-update-tools/contribute-a-salt-state-file) or a [Debian package](/get-involved/add-or-update-tools/contribute-a-debian-package) for the tool by following instructions in this section of the documentation site.

{% hint style="info" %}
If you discovered an issue with an existing REMnux tool, you can help correct it by revising that tool's Salt state file. To do that, follow the instructions for [contributing a new state file,](/get-involved/add-or-update-tools/contribute-a-salt-state-file) but instead of creating a new file, find the state file for the tool and adjust it.
{% endhint %}


# Contribute a Salt State File

If there's a malware analysis tool you'd like to see as part of the REMnux distro, consider creating the Salt State file that would allow the tool to be included. The following steps explain how you can build such a file.

{% hint style="info" %}
Before starting this work, consider [reaching out to Lenny Zeltser](https://zeltser.com/contact) to confirm that it makes sense to include the tool as part of REMnux. Also, become familiar with the way REMnux uses [Salt Stack](/behind-the-scenes/technologies/saltstack-management) to manage the installation and configuration of tools.
{% endhint %}

## 1. Install Git and Docker

Follow the steps appropriate for your Operating System to install [Git](https://git-scm.com) and [Docker](https://www.docker.com/products/docker-desktop) on your system.

## 2. Clone the REMnux/salt-states Repository

Get a copy of the current REMnux/salt-states repository, which contains the REMnux Salt State files. A common way to do this is to run:

```
git clone https://github.com/REMnux/salt-states.git
```

## 3. Create the Salt State File

Determine in which subdirectory under salt-states/remnux your new Salt State file should reside. Common locations are:

* For Ubuntu packages: `packages`
* For Python packages: `python3-packages`
* For Node.js packages: `node-packages`
* For Perl packages: `perl-packages`
* For Ruby gems: `rubygems`
* For tools distributed as compiled or JAR files: `tools`
* For scripts that aren't installable using a package manager: `scripts`

Instead of attempting to create a file from scratch, consider identifying a State File that operates similarly to what you have in mind, and copying its contents to form the basis of your new file.

{% hint style="success" %}
The State File should fully describe all dependencies of the software you're aiming to install. When crafting the file, assume that the installation will occur on a pristine, minimal system without any existing packages. Be sure to explicitly specify all the dependencies.
{% endhint %}

## 4. Test the Salt State File

Once the State File is ready, test it locally by running it in a Docker container. The easiest way to do it is to run the [dev-state.sh](https://github.com/REMnux/salt-states/blob/master/.ci/dev-state.sh) script, which is a part of the REMnux/salt-states repository in the .ci directory.

{% hint style="info" %}
The dev-state.sh script is a wrapper around Docker. It retrieves and launches the baseline container "[remnux/saltstack-tester](https://hub.docker.com/r/remnux/saltstack-tester)" built for testing State Files. The container is just the base Ubuntu OS without any optional packages, plus Salt Stack. This minimal state allows you to confirm that the State File you'll be testing specifies all the dependencies for the new tool.
{% endhint %}

Once you're at the command prompt inside the tester container, direct SaltStack to process your new Salt State file by running this command in the container:

```
salt-call -l debug --local --retcode-passthrough --state-output=mixed state.sls STATE-PATH
```

In the command above, replace "STATE-PATH" with the Salt Stack path to your new file using dots instead of slashes. For example, if you were running peframe.sls, which is in remnux/python3-packages, you'd specify `remnux.python3-packages.peframe`.

The command will produce verbose debug-level output, so you can diagnose any issues. Adjust your new Salt State file to address whichever problems arise, so the `salt-call` command completes successfully.

## 5. Add Metadata to the Salt State File

To make sure the tool is properly included in the REMnux tool listing, include the following metadata comments on top of your Salt State file to describe the tool:

```
# Name: 
# Website: 
# Description: 
# Category: 
# Author: 
# License: 
# Notes: 
```

## 6. Update the Directory's init.sls File

Add a reference to your new State File in the `init.sls` file in the same directory. This file controls which states are included in the REMnux installation. Without this entry, your new tool won't be installed as part of the distro.

## 7. Create a Pull Request

Once you have a working, tested Salt State file in the local copy of the REMnux/salt-states repository, [create a GitHub pull request](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request) for that repo, so your file may be considered for inclusion in the REMnux distro. If the pull request isn't working, consider submitting the file to Lenny Zeltser [by email](https://zeltser.com/contact).


# Contribute a Debian Package

The following steps describe how you can build and locally test a Debian-based package for a new tool, in case you'd like to contribute it to REMnux. You can perform these steps on macOS, Linux, or Windows using Docker.

{% hint style="info" %}
Before starting this work, consider [reaching out to Lenny Zeltser](https://zeltser.com/contact) to confirm that it makes sense to include the tool as part of REMnux. Also, become familiar with the way REMnux uses [custom Debian packages](/behind-the-scenes/technologies/debian-packages) to install tools when practical.
{% endhint %}

## 1. Install Git and Docker

Follow the steps appropriate for your operating system to install [Git](https://git-scm.com) and [Docker](https://www.docker.com/products/docker-desktop) on your system.

REMnux provides a Docker image called `remnux/package-builder` that contains all the tools needed to build Debian packages, including `debhelper`, `dpkg-buildpackage`, and related utilities. You don't need to install any packaging tools on your local system.

{% hint style="success" %}
The tag `noble` corresponds to Ubuntu 24.04, which is the current target for REMnux packages. If you need to build for a different Ubuntu version, replace `noble` with the appropriate codename in the commands throughout this guide.
{% endhint %}

## 2. Create the Package Files

The source files for custom REMnux packages are in the REMnux/distro repository on GitHub in the `ppasrc` subdirectory. Start by cloning that repo and navigating to that subdirectory:

```
git clone https://github.com/REMnux/distro.git
cd distro/ppasrc
```

The existing packages here serve as templates for your new one. Instead of creating files from scratch, identify a package that operates similarly to the tool you're packaging and use it as a starting point. Choose a template based on what kind of tool you're packaging:

* **Compiled from source code** (e.g., `xorsearch`): The tool has C or similar source code and a Makefile. Place the source files alongside the `debian/` directory; the build process compiles them during package creation.
* **Pre-compiled binary** (e.g., `flare-floss`): A single executable placed directly into `/usr/bin`. Place the binary alongside the `debian/` directory.
* **JAR file with wrapper script** (e.g., `baksmali`): A Java archive installed to `/opt/` with a shell script in `/usr/bin` that invokes it. Place the `.jar` file and wrapper script alongside the `debian/` directory.

Create a directory structure that follows the naming convention `PACKAGE/PACKAGE-VERSION-DISTRO/`, then copy the `debian/` directory from your chosen template:

```
mkdir -p mypackage/mypackage-1.0.0-noble
cp -r flare-floss/flare-floss-3.1-noble/debian mypackage/mypackage-1.0.0-noble/
mkdir -p mypackage/mypackage-1.0.0-noble/debian/source
```

Place the tool's files (source code, binaries, or wrapper scripts) into the `mypackage-1.0.0-noble/` directory next to the `debian/` folder. The `install` file inside `debian/` will reference these files to specify where they get installed on the system.

## 3. Customize the Debian Files

The `debian/` subdirectory contains the files that describe how the package should be built and installed. Customize each file based on the examples below.

### changelog

Specifies the package version, target distribution, and release notes. The formatting and whitespace are significant—use `date -R` to generate the timestamp in the required format.

```
mypackage (1.0.0-noble) noble; urgency=medium

  * Initial release.

 -- REMnux Distribution <distro@remnux.org>  Wed, 05 Feb 2026 12:00:00 -0500
```

Note that the version string includes the distribution codename (e.g., `1.0.0-noble`) and the distribution field also says `noble`. The line beginning with `--` must start with exactly one space.

### control

Defines package metadata, build dependencies, runtime dependencies, and the description.

For a compiled package like `xorsearch`:

```
Source: xorsearch
Section: utils
Priority: optional
Maintainer: REMnux Distribution <distro@remnux.org>
Build-Depends: debhelper (>= 8.0.0)
Standards-Version: 3.9.4
Homepage: https://blog.didierstevens.com/programs/xorsearch/

Package: xorsearch
Architecture: any
Depends: ${shlibs:Depends}, ${misc:Depends}
Description: Locate and decode strings obfuscated using common techniques.
```

For a JAR-based package like `baksmali` that needs Java at runtime:

```
Source: baksmali
Section: utils
Priority: optional
Maintainer: REMnux Distribution <distro@remnux.org>
Build-Depends: debhelper (>= 10)
Standards-Version: 4.1.2
Homepage: https://bitbucket.org/JesusFreke/smali/src/master/

Package: baksmali
Architecture: any
Depends: ${shlibs:Depends}, ${misc:Depends}, default-jre
Description: Disassembler for the dex format used by Dalvik, Android's Java VM implementation.
```

Set `Maintainer` to `REMnux Distribution <distro@remnux.org>` for all packages, not your personal name. For new packages, use `Build-Depends: debhelper (>= 10)` and `Standards-Version: 4.1.2`. Use `Architecture: any` for most packages, or `Architecture: amd64` if the tool only supports 64-bit x86 systems. List runtime dependencies in the `Depends` field (e.g., `default-jre` for Java tools). List build-time dependencies in `Build-Depends`.

### install

Lists source-to-destination file mappings, one per line. The source path is relative to the package directory (next to the `debian/` folder); the destination is relative to the system root.

For a compiled package that also installs data files:

```
rules.txt usr/share/xorsearch
```

For a pre-compiled binary:

```
floss usr/bin
```

For a JAR with a wrapper script:

```
baksmali-2.4.0.jar opt/baksmali
baksmali usr/bin
```

Note that compiled packages typically have their binary installed automatically by the Makefile, so the `install` file only lists additional files. Pre-compiled binaries and JAR packages rely on `install` to place all their files.

### copyright

Includes the upstream license and a GPL-3.0+ declaration for the Debian packaging files.

```
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: mypackage
Source: https://github.com/author/mypackage

Files: *
Copyright: 2026 Author Name
License: MIT
 https://github.com/author/mypackage/blob/main/LICENSE

Files: debian/*
Copyright: 2026 REMnux Distribution <distro@remnux.org>
License: GPL-3.0+
```

Adjust the upstream license to match the tool's actual license.

### rules

Controls the build process. For most packages, the default is sufficient:

```
#!/usr/bin/make -f

%:
	dh $@
```

Only modify this file if the build requires custom steps beyond what the Makefile or `install` file handles.

### compat

Specifies the debhelper compatibility level. Use `9` or `10`:

```
10
```

### source/format

Specifies the source package format. Use `3.0 (native)` for REMnux packages:

```
3.0 (native)
```

{% hint style="info" %}
If you copied the `debian/` directory from an existing package, delete the `debian/files` file if it's present. This file is a build artifact and should not be included in your submission.
{% endhint %}

## 4. Build and Test Using Docker

Build the package by running the following command from the root of the `distro` repository. This mounts the repository into the container and runs `dpkg-buildpackage` in the package directory:

```
docker run --rm -v "$(pwd)":/distro remnux/package-builder:noble bash -c "cd /distro/ppasrc/mypackage/mypackage-1.0.0-noble && dpkg-buildpackage -us -uc"
```

{% hint style="success" %}
The `$(pwd)` syntax works on macOS and Linux. On Windows, replace `"$(pwd)"` with the full path to your `distro` directory, for example: `-v "C:\Users\you\distro":/distro`.
{% endhint %}

The `-us -uc` flags tell `dpkg-buildpackage` not to sign the package, since only the REMnux maintainer has the signing key. If the build succeeds, it will generate a `.deb` file and several other files in the parent directory (`ppasrc/mypackage/`).

{% hint style="success" %}
Use `dpkg-deb --info` inside Docker to verify the generated package, since this is a Linux tool that may not be available on your host system:

```
docker run --rm -v "$(pwd)":/distro remnux/package-builder:noble dpkg-deb --info /distro/ppasrc/mypackage/mypackage_1.0.0-noble_amd64.deb
```

{% endhint %}

After testing, clean up the `.deb` files from the repository before committing, since they are not excluded by `.gitignore`. Other build artifacts such as `.changes`, `.buildinfo`, and `.tar.xz` files are already gitignored. The `.dsc` files present in the repository are signed versions committed by the maintainer—do not include unsigned `.dsc` files in your pull request.

{% hint style="info" %}
If the build fails, common causes include:

* **Missing build dependencies**: Add them to `Build-Depends` in the `control` file.
* **Incorrect install paths**: Verify the file paths in the `install` file match the actual files in your package directory.
* **Makefile issues**: If the source code's Makefile uses non-standard targets, you may need to add override rules in the `rules` file.
* **Permission errors**: Ensure scripts and binaries have the correct executable permissions before building.
  {% endhint %}

## 5. Create a Pull Request

Once you have a working, tested set of package files in the local copy of the REMnux/distro repository, [create a GitHub pull request](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request) for that repo, so the package may be considered for inclusion in the REMnux distro.

Your pull request should include the `PACKAGE/PACKAGE-VERSION-DISTRO/` directory with the tool's files and the `debian/` subdirectory. Do not include build artifacts such as `.deb`, `.changes`, `.buildinfo`, or unsigned `.dsc` files.

If the pull request isn't working, consider submitting the files to Lenny Zeltser [by email](https://zeltser.com/contact).

{% hint style="info" %}
After accepting the pull request, the REMnux maintainer handles signing the package and uploading it to the [Launchpad PPA](https://launchpad.net/~remnux/+archive/ubuntu/stable/+packages). You don't need to interact with Launchpad as a contributor.
{% endhint %}

If the tool also needs a Salt State file for installation on the REMnux system, see [Contribute a Salt State File](/get-involved/add-or-update-tools/contribute-a-salt-state-file) for instructions on creating one.


# Contribute a Dockerfile

The following steps describe how you can create a Dockerfile for a malware analysis tool and contribute it to the [REMnux collection of Docker images](/run-tools-in-containers/remnux-containers).

To get started, review:

1. [REMnux documentation on Docker images.](/run-tools-in-containers/remnux-containers)
2. [Docker documentation on Dockerfile creation.](https://docs.docker.com/engine/reference/builder/)
3. [Dockerfiles in the REMnux Docker repository on GitHub.](https://github.com/remnux/docker)
4. The details below.

{% hint style="info" %}
Before starting this work, consider [reaching out to Lenny Zeltser](https://zeltser.com/contact) to confirm that it makes sense to include the tool as part of the REMnux collection of Docker images.
{% endhint %}

## 1. Install Git and Docker

Follow the steps appropriate for your operating system to install [Git](https://git-scm.com) and [Docker](https://www.docker.com/products/docker-desktop) on your system.

Clone the REMnux/docker repository, which contains the existing Dockerfiles:

```
git clone https://github.com/REMnux/docker.git
```

Browse the existing Dockerfiles in the repository to see how other tools are packaged. Instead of creating a file from scratch, consider using an existing Dockerfile as a starting point for your own.

## 2. Create the Dockerfile

Create a subdirectory named after your tool in the local copy of the repository, and add a `Dockerfile` inside it. A REMnux Dockerfile follows a consistent structure. The sections below explain each part, using the [radare2 Dockerfile](https://github.com/REMnux/docker/blob/master/radare2/Dockerfile) as the primary example.

### Header Comments

Begin the file with comments that state the tool's name, website, description, author, license, and usage instructions:

```
# Name: radare2
# Website: https://www.radare.org/n/radare2.html
# Description: Examine binary files, including disassembling and debugging.
# Category: Dynamically Reverse-Engineer Code: General
# Author: https://github.com/radareorg/radare2/blob/master/AUTHORS.md
# License: GNU Lesser General Public License (LGPL) v3: https://github.com/radareorg/radare2/blob/master/COPYING
# Notes: r2, rasm2, rabin2, rahash2, rafind2, r2agent
#
# To run this image after installing Docker, use the command below, replacing
# "~/workdir" with the path to your working directory on the underlying host.
# Before running the docker, create ~/workdir on your host.
#
# docker run --rm -it --cap-drop=ALL --cap-add=SYS_PTRACE -v ~/workdir:/home/nonroot/workdir remnux/radare2
#
# Then run "r2" or other Radare2 commands inside the container.
```

### Base Image and Labels

Use a `FROM` directive to specify the base image, followed by `LABEL` directives for maintainer information and the date of the last update:

```
FROM ubuntu:24.04
LABEL maintainer="Lenny Zeltser (@lennyzeltser, www.zeltser.com)"
LABEL updated="9 Feb 2026"
LABEL updated_by="lennyzeltser"
```

{% hint style="success" %}
New Dockerfiles should use a current Ubuntu LTS base image such as `ubuntu:24.04`. Some existing images in the repository use older versions.
{% endhint %}

### Locale Settings

Set the locale environment variables so that tools don't encounter encoding issues:

```
ENV LANG=C.UTF-8
ENV LANGUAGE=C.UTF-8
ENV LC_ALL=C.UTF-8
```

### Build Arguments

Use `ARG` to define version numbers as build-time variables. This makes it easy to update the tool version later without changing multiple lines:

```
ARG R2VER=6.0.8
```

### Package Installation

Install the Ubuntu packages your tool requires using `apt-get`. Chain commands with `&&` and clean up the package cache in the same `RUN` layer to minimize the image size. The `\` character breaks the package list across multiple lines for readability. Assume that a given package is absent unless you explicitly install it, since the base image is a minimal Ubuntu installation:

```
USER root
RUN apt-get update && \
    DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
    ca-certificates \
    sudo \
    wget \
    git && \
    rm -rf /var/lib/apt/lists/*
```

### Non-Root User Creation

Create a non-root user so that the tool runs with restricted privileges. The following block creates the user, sets up a home directory and working directory, and grants passwordless sudo access:

```
RUN groupadd -r nonroot && \
  useradd -m -d /home/nonroot -g nonroot -s /usr/sbin/nologin -c "Nonroot User" nonroot && \
  mkdir -p /home/nonroot/workdir && \
  chown -R nonroot:nonroot /home/nonroot && \
  usermod -a -G sudo nonroot && echo 'nonroot:nonroot' | chpasswd && \
  echo "nonroot ALL=(ALL) NOPASSWD: ALL" >/etc/sudoers.d/nonroot
```

### Application Installation

The installation steps vary by tool. The radare2 Dockerfile downloads a `.deb` package from a GitHub release and installs it using `apt-get`, which also resolves any dependencies the package requires. The `ARG` variable defined earlier keeps the version number in one place:

```
RUN wget -q -O /tmp/radare2_${R2VER}_amd64.deb \
    https://github.com/radareorg/radare2/releases/download/${R2VER}/radare2_${R2VER}_amd64.deb && \
    apt-get update && \
    apt-get install -y /tmp/radare2_${R2VER}_amd64.deb && \
    (apt-get remove --purge -y libradare2-common 2>/dev/null || true) && \
    rm -f /tmp/radare2_${R2VER}_amd64.deb && \
    rm -rf /var/lib/apt/lists/*
```

### Final Directives

The closing directives switch to the non-root user, run any user-level initialization the tool requires, set environment variables and the working directory, declare a volume for file sharing, expose network ports, and specify the default command:

```
USER nonroot
RUN r2pm -U

ENV HOME=/home/nonroot
ENV USER=nonroot
WORKDIR /home/nonroot/workdir
VOLUME ["/home/nonroot/workdir"]
EXPOSE 8080
CMD ["/bin/bash"]
```

{% hint style="info" %}
`CMD` specifies a default command that can be overridden when the user launches the container. `ENTRYPOINT` specifies a command that always runs, with any arguments passed at launch appended to it. For example, the [thug Dockerfile](https://github.com/REMnux/docker/blob/master/thug/Dockerfile) uses `ENTRYPOINT ["thug"]` so users can pass URLs directly: `docker run --rm remnux/thug http://example.com`. Most REMnux images use `CMD ["/bin/bash"]` to provide an interactive shell by default.
{% endhint %}

{% hint style="success" %}
Simple Python tools can use a `python:3-slim` base image instead of Ubuntu. For an example, see the [binary-refinery Dockerfile](https://github.com/REMnux/docker/blob/master/binary-refinery/Dockerfile), which installs the tool using `pip` directly.
{% endhint %}

## 3. Build and Test the Image

It's difficult to create a working Dockerfile in one step. When developing your Dockerfile, consider launching a base container interactively to figure out the installation commands:

```
docker run --rm -it ubuntu:24.04 bash
```

Manually type and test each installation command inside the container's shell. Once you've validated that a specific sequence of commands works, transcribe them into your Dockerfile.

{% hint style="success" %}
This prototyping workflow saves time: launch the base container, figure out the steps interactively, then write them into the Dockerfile one or two directives at a time.
{% endhint %}

Once your Dockerfile is ready, go to the directory where it resides and build the image, replacing "image-name" with the name you'd like to assign:

```
docker build -t image-name .
```

After Docker builds the image, run it to verify that the tool works:

```
docker run --rm -it image-name bash
```

Test the following inside the container:

* The tool runs and produces expected output.
* The non-root user is active (check with `whoami`).
* Volume mounting works: run with `-v ~/workdir:/home/nonroot/workdir` and verify files are accessible.

## 4. Handle File and Network Interactions

The container is isolated from the host system: by default it can communicate over the network in the outbound direction, but won't accept inbound traffic. If the container is invoked with the `--rm` parameter, its contents disappear after it stops running. When building the image, anticipate the user's need to communicate with the application inside the container over the network or to pass files in and out of the container.

### Accessing Network Ports in the Container

If the tool listens on a network port, the user must explicitly expose it when launching the container using the `-p` parameter. For example, radare2 includes `r2agent`, which provides a web interface on port 8080. To access this from outside the container, the user specifies `-p 8080:8080`:

```
docker run --rm -it -p 8080:8080 remnux/radare2
```

This maps the container's port 8080 to the underlying host's port 8080, allowing the user to connect by browsing to `http://localhost:8080`. Use the `EXPOSE` directive in the Dockerfile to document which ports the application uses, and include the `-p` flag in the usage instructions in the header comments.

### Sharing Files with the Container

Some tools expect the user to provide input or retrieve output via the file system. Docker supports the `-v` parameter to share a directory between the underlying host and the container. For example, to share a working directory with the radare2 container:

```
docker run --rm -it -v ~/workdir:/home/nonroot/workdir remnux/radare2
```

This maps the local `~/workdir` directory to `/home/nonroot/workdir` inside the container. Use the `VOLUME` directive in the Dockerfile to declare the expected mount point. To ensure the non-root user inside the container has access to the shared directory, the user may need to make it world-accessible (`chmod a+xwr ~/workdir`) before launching the container.

## 5. Create a Pull Request

Once you have a working, tested Dockerfile in the local copy of the REMnux/docker repository, [create a GitHub pull request](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request) for that repo, so your Dockerfile may be considered for inclusion in the REMnux collection. Your pull request should include a directory named after the tool, containing the Dockerfile.

If the pull request isn't working, consider submitting the file to Lenny Zeltser [by email](https://zeltser.com/contact).

{% hint style="info" %}
After accepting the pull request, the REMnux maintainer handles building and publishing the Docker image to [Docker Hub](https://hub.docker.com/u/remnux). You don't need to push the image yourself.
{% endhint %}