GitHub Security Research Methodology
⛔ In-Depth Reference
5-Step Research Workflow
1. GitHub 搜索 → gh search repos / gh search code
2. 仓库分析 → gh repo view + 读关键文件
3. 模式提取 → 按 6 大类分类
4. 去重检查 → 查已有知识库避免重复
5. 入库保存 → 写入 evasion-techniques-db.json / loader-components-db.json
GitHub Search Command Quick Reference
# 搜仓库
gh search repos "shellcode loader language:C stars:>20" --limit 20
gh search repos "AMSI bypass" --limit 15
gh search repos "syscall direct" --language c --limit 15
# 搜代码
gh search code "VirtualAlloc PAGE_EXECUTE_READWRITE" --language c --limit 30
gh search code "NtCreateThreadEx" --language c --limit 20
6 Major Technique Categories
| Category |
Search Keywords |
| Memory Allocation |
VirtualAlloc, HeapCreate, NtAllocateVirtualMemory, MappedFile |
| Code Execution |
CreateThread, EnumWindows, APC, Fiber, callback |
| API Obfuscation |
API hashing, PEB walk, dynamic resolve |
| String Obfuscation |
XOR, AES, stack strings, compile-time encryption |
| Anti-Analysis |
IsDebuggerPresent, anti-VM, sandbox detection |
| Syscall |
direct syscall, indirect syscall, SSN, Hell's Gate |
Deduplication Rules
| Condition |
Action |
| Exactly the same name |
❌ Skip (duplicate) |
| Same technique, different name |
❌ Skip (duplicate) |
| Same objective, different implementation |
✅ Add (both are valuable) |
| Different objectives, similar API |
✅ Add (different purposes) |
Output Format
## 研究报告
### 发现的技术
1. [技术名] - [简述] - 复杂度: simple/medium/complex
### 知识库状态
- 新增: X 条
- 重复跳过: Y 条
- 变体补充: Z 条
### 参考链接
- <repository-url>
