# REMnux Analysis Wiki

> 397 tools | 15 workflows | 27 recipes

## Browse by Category

- [[categories/analyze-documents-email-messages|Analyze Documents > Email Messages]] (4 tools)
- [[categories/analyze-documents-general|Analyze Documents > General]] (1 tools)
- [[categories/analyze-documents-microsoft-office|Analyze Documents > Microsoft Office]] (16 tools)
- [[categories/analyze-documents-pdf|Analyze Documents > PDF]] (8 tools)
- [[categories/dynamically-reverse-engineer-code-general|Dynamically Reverse-Engineer Code > General]] (3 tools)
- [[categories/dynamically-reverse-engineer-code-scripts|Dynamically Reverse-Engineer Code > Scripts]] (5 tools)
- [[categories/dynamically-reverse-engineer-code-shellcode|Dynamically Reverse-Engineer Code > Shellcode]] (5 tools)
- [[categories/examine-static-properties-net|Examine Static Properties > .NET]] (3 tools)
- [[categories/examine-static-properties-deobfuscation|Examine Static Properties > Deobfuscation]] (28 tools)
- [[categories/examine-static-properties-general|Examine Static Properties > General]] (28 tools)
- [[categories/examine-static-properties-go|Examine Static Properties > Go]] (2 tools)
- [[categories/explore-network-interactions-connecting|Explore Network Interactions > Connecting]] (9 tools)
- [[categories/explore-network-interactions-monitoring|Explore Network Interactions > Monitoring]] (12 tools)
- [[categories/explore-network-interactions-services|Explore Network Interactions > Services]] (8 tools)
- [[categories/gather-and-analyze-data|Gather and Analyze Data]] (13 tools)
- [[categories/general-utilities|General Utilities]] (17 tools)
- [[categories/investigate-system-interactions|Investigate System Interactions]] (3 tools)
- [[categories/perform-memory-forensics|Perform Memory Forensics]] (3 tools)
- [[categories/statically-analyze-code-net|Statically Analyze Code > .NET]] (2 tools)
- [[categories/statically-analyze-code-android|Statically Analyze Code > Android]] (7 tools)
- [[categories/statically-analyze-code-general|Statically Analyze Code > General]] (5 tools)
- [[categories/statically-analyze-code-java|Statically Analyze Code > Java]] (5 tools)
- [[categories/statically-analyze-code-pe-files|Statically Analyze Code > PE Files]] (4 tools)
- [[categories/statically-analyze-code-python|Statically Analyze Code > Python]] (4 tools)
- [[categories/statically-analyze-code-scripts|Statically Analyze Code > Scripts]] (3 tools)
- [[categories/statically-analyze-code-unpacking|Statically Analyze Code > Unpacking]] (2 tools)
- [[categories/use-artificial-intelligence|Use Artificial Intelligence]] (3 tools)
- [[categories/view-or-edit-files|View or Edit Files]] (7 tools)
- [[categories/dotnet-analysis|dotnet-analysis]] (1 tools)
- [[categories/network-analysis|network-analysis]] (3 tools)
- [[categories/static-analysis-pe|static-analysis-pe]] (2 tools)
- [[categories/string-deobfuscation|string-deobfuscation]] (1 tools)
- [[categories/utilities|utilities]] (5 tools)

## Workflows

- [[workflows/static-analysis-workflow|Static Properties Analysis]]
- [[workflows/behavioral-analysis-workflow|Behavioral Analysis]]
- [[workflows/network-interception-workflow|Network Traffic Interception]]
- [[workflows/document-analysis-workflow|Malicious Document Analysis]]
- [[workflows/javascript-deobfuscation-workflow|JavaScript Deobfuscation]]
- [[workflows/unpacking-workflow|Unpacking Packed Executables]]
- [[workflows/code-injection-workflow|Code Injection Analysis]]
- [[workflows/dotnet-analysis-workflow|.NET Malware Analysis]]
- [[workflows/shellcode-analysis-workflow|Shellcode Analysis]]
- [[workflows/string-deobfuscation-workflow|String & Data Deobfuscation]]
- [[workflows/memory-forensics-workflow|Memory Forensics]]
- [[workflows/android-analysis-workflow|Android Malware Analysis]]
- [[workflows/java-analysis-workflow|Java Malware Analysis]]
- [[workflows/email-analysis-workflow|Email & Phishing Analysis]]
- [[workflows/cobalt-strike-workflow|Cobalt Strike Analysis]]

## Recipes

- [[recipes/extract-base64-ps-from-vba|Extract Base64 PowerShell from Office Macro]]
- [[recipes/vba-number-string-decode|Decode VBA Number Arrays to Strings]]
- [[recipes/multi-stage-base64-gzip|Decode Base64 + Gzip Payload]]
- [[recipes/base64-xor-shellcode|Decode Base64 + XOR Shellcode]]
- [[recipes/office-full-decode-chain|Full Office Macro Decode Chain]]
- [[recipes/password-protected-office|Decrypt Password-Protected Office Document]]
- [[recipes/excel-xlm-macros|Deobfuscate Excel 4.0 (XLM) Macros]]
- [[recipes/vba-pcode-decompile|Recover VBA from p-code (source removed)]]
- [[recipes/rtf-shellcode-extraction|Extract Shellcode from RTF Document]]
- [[recipes/pdf-object-extraction|Extract Embedded Object from PDF]]
- [[recipes/pdf-javascript-extraction|Extract JavaScript from PDF]]
- [[recipes/js-deobfuscation-spidermonkey|Deobfuscate JavaScript with SpiderMonkey]]
- [[recipes/js-null-byte-cleanup|Clean Null Bytes from UTF-16 JavaScript]]
- [[recipes/shellcode-emulate-with-offset|Emulate Shellcode at Specific Offset]]
- [[recipes/cobalt-strike-beacon-parse|Parse Cobalt Strike Beacon Configuration]]
- [[recipes/shellcode-to-exe|Convert Shellcode to Executable]]
- [[recipes/xor-key-brute-force|Brute-Force XOR Key]]
- [[recipes/stack-string-extraction|Extract Stack-Built Strings]]
- [[recipes/cyberchef-xor-decode|Visual XOR/Base64 Decode with CyberChef]]
- [[recipes/speakeasy-emulation-with-json|Emulate Malware and Extract API Calls]]
- [[recipes/capa-capability-filter|Filter Capabilities by Technique]]
- [[recipes/pcap-file-carving|Extract Files from Network Capture]]
- [[recipes/dns-interception-setup|Set Up DNS + HTTP Interception]]
- [[recipes/dotnet-decompile-cli|Decompile .NET on Command Line]]
- [[recipes/volatility-quick-triage|Quick Memory Dump Triage]]
- [[recipes/apk-quick-triage|Quick APK Triage]]
- [[recipes/email-attachment-extraction|Extract and Triage Email Attachments]]

## Quick Access

```bash
# Browse interactively
zk list --interactive

# Search by tag
zk list --tag pdf

# Find what links to a tool
zk list --mention pdfid
```

#index #wiki