How to reduce your reliance on "bad" open source packages ✨ RSVP

rugosa
Release 0.10.0

The next generation of kordesii. This is a library for managing emulation and provides utilities for interfacing with decompiled malware samples using dragodis.

Homepage PyPI Python

Keywords: malware, ida, ghidra, emulation, strings, automation, malware-analysis, malware-automation, python, string-decode
License: MIT
Install: pip install rugosa==0.10.0

Documentation

Rugosa

The next generation of kordesii. This is a library (not a framework) for managing emulation and provides utilities for interfacing with decompiled malware samples using dragodis.

Rugosa is meant to be used with an automation framework such as DC3-MWCP, but can also be used in one-off scripting.

Install

pip install rugosa

You will also need to setup a backend disassembler by following Dragodis's installation instructions.

Utilities

The following utilities are included with Rugosa:

Emulator Plugin

Rugosa includes a IDA and Ghidra plugin which provides a GUI for using the emulation utility. For more information on how to install and use the plugin please see the documentation.