Quantcast
Channel: Reverse Engineering
Viewing all 50 articles
Browse latest View live

VMProtect CRC Bypass Methods

$
0
0
VMProtect CRC Bypass Methods
The tutorial and script has been made by LCF-AT.  In this tutorial, author will explain how to bypass the CRC check in an executable file packed with VMProtect.

 Caution:  The target file included with the package is packed, so that the author can show you how to unpack it.  Your antivirus might give you warning.

MirrorCreator:  DOWNLOAD
Extabit:  DOWNLOAD
RGhost:  DOWNLOAD
ZippyShare:  DOWNLOAD
Uppit:  DOWNLOAD


ASProtect SKE v2.10 [UnpackMe]

$
0
0


ASProtect SKE v2.10 [UnpackMe]

The file is packed with ASProtect SKE v2.10 and has been created by Teddy Rogers.  If you would be able to unpack it, please share your method with the others.  Good luck ;)

Caution:  The target file included with the package is packed.  Your antivirus might give you warning.



MirrorCreator:  DOWNLOAD
Extabit:  DOWNLOAD
RGhost:  DOWNLOAD
ZippyShare:  DOWNLOAD
Uppit:  DOWNLOAD

Scylla Launcher v2.0

$
0
0

Scylla Launcher v2.0

The tool has been coded by Mr. Exodia [Team TPoDT].  The tool will help you in launching the Scylla Import Reconstructor for your desired platform.  Just simply chose your platform with the tool and it will launch the Scylla for that platform.  Author notes are given below.


Hi,

For personal use I created a small launcher program that allows you to quickly select if you want to start
Scylla_x86.exe or Scylla_x64.exe. This was useful in my case because I assign hotkeys to tools, which means that I should've assigned two hotkeys to scylla instead of one.

MirrorCreator:  DOWNLOAD
Extabit:  DOWNLOAD
RGhost:  DOWNLOAD
ZippyShare:  DOWNLOAD
Uppit:  DOWNLOAD

Manually Rebuilding IAT & Injecting DLL

$
0
0
Rebuilding Manually The IAT & Injecting DLL

The tutorial has been created by E33.  In this tutorial, the author will explain about manually rebuilding the IAT and injecting the dll into a portable executable file.  The tutorial is really great and all the steps are explained briefly.  A must read tutorial if you want to learn about IAT rebuilding.

MirrorCreator:  DOWNLOAD
Extabit:  DOWNLOAD
RGhost:  DOWNLOAD
ZippyShare:  DOWNLOAD
Uppit:  DOWNLOAD

Xenocode Unpacking Tutorial

$
0
0
Xenocode Unpacking Tutorial

The tutorial has been created by Shockwawe.  In this tutorial, the author will demonstrate the unpacking process of Xenocode using a DotNet Generic Unpacker tool.  The tool is available in the DotNet tool section.  Watch the tutorial and learn how to use the tool.

MirrorCreator:  DOWNLOAD
Extabit:  DOWNLOAD
RGhost:  DOWNLOAD
ZippyShare:  DOWNLOAD
Uppit:  DOWNLOAD

ASProtect SKE v2.11 [UnpackMe]

$
0
0

ASProtect SKE v2.11 [UnpackMe]

The file is packed with ASProtect SKE v2.11 and has been created by Teddy Rogers.  If you would be able to unpack it, please share your method with the others.  Good luck ;)

Caution:  The target file included with the package is packed.  Your antivirus might give you warning.

MirrorCreator:  DOWNLOAD
Extabit:  DOWNLOAD
RGhost:  DOWNLOAD
ZippyShare:  DOWNLOAD
Uppit:  DOWNLOAD

ASProtect SKE v2.20 [UnpackMe]

$
0
0

ASProtect SKE v2.20 [UnpackMe]

The file is packed with ASProtect SKE v2.20 and has been created by Teddy Rogers.  If you would be able to unpack it, please share your method with the others.  Good luck ;)

Caution:  The target file included with the package is packed.  Your antivirus might give you warning.

MirrorCreator:  DOWNLOAD
Extabit:  DOWNLOAD
RGhost:  DOWNLOAD
ZippyShare:  DOWNLOAD
Uppit:  DOWNLOAD

WeakOD OllyDbg Plugin

$
0
0
WeakOD OllyDbg Plugin
WeakOD is a plugin for  OllyDbg v2.01h and has been coded by Goldenegg.  The features of WeakOD are given below.
  • Auto clears debugger bit in PEB on new process creation.
  • Allocate few memory to do small fixes for debugee.
  • Inject dll into debugee to help changing debugee's behavior.
  • Break on dll and stops on dll entry point, so you can ananyze it or find out why it's loaded.

MirrorCreator:  DOWNLOAD
Extabit:  DOWNLOAD
RGhost:  DOWNLOAD
ZippyShare:  DOWNLOAD
Uppit:  DOWNLOAD


ASProtect SKE v2.30 [UnpackMe]

$
0
0

ASProtect SKE v2.30 [UnpackMe]

The file is packed with ASProtect SKE v2.30 and has been created by Teddy Rogers.  If you would be able to unpack it, please share your method with the others.  Good luck ;)

Caution:  The target file included with the package is packed.  Your antivirus might give you warning.

MirrorCreator:  DOWNLOAD
Extabit:  DOWNLOAD
RGhost:  DOWNLOAD
ZippyShare:  DOWNLOAD
Uppit:  DOWNLOAD

VMProtect v2.09 Unpacking Tutorial

$
0
0
VMProtect v2.09 Unpacking Tutorial

The tutorial has been created by GIV [Team REPT].  In this tutorial, the author will demonstrate how to unpack an executable file packed with VMProtect v2.09.  The author has used a script to unpack it which has been created by LCF-AT.

Caution:  The target file included with the package is packed, so that the author can show you how to unpack it.  Your antivirus might give you warning.

MirrorCreator:  DOWNLOAD
Extabit:  DOWNLOAD
RGhost:  DOWNLOAD
ZippyShare:  DOWNLOAD
Uppit:  DOWNLOAD

ExeCryptor Basic Unpacker v1.0

$
0
0
ExeCryptor Basic Unpacker v1.0

The script and video tutorial has been created by LCF-AT.  In this tutorial, author will explain how to unpack an executable file packed with Execryptor.  Author notes are given below.


Today, I wanna release some new created video and text tutorials and a new script.So this time everything turns around ExeCryptor.Normally it was not my intention and also unplanned to create a EC tutorial and script but the reason why I did it now was our member "antrobs" and his trouble with EC in a very long time.So I just started and now I am finished.So I just made a big package this time and also pack and post all together in this topic to prevent creating a another topic.

Note 1: For all of you who are interested how to handle EC manually they can check out the long ExeCryptor Manually Unpack Tutorial first.So there you can see all steps from A til Z about OEP | IAT | DUMPING | Problem find check & fix.All manually.So the tutorial is very long and includes seven longer videos.Most of them are created in realtime with much tracings so it's no tutorial where I explain every single frame with text!The important parts can you read in the diffrent created text files so it's no "newbie friendly" tutorial so keep this in your mind if you are a newbie or if you have not much ideas so you should have already some RCE prerequisites so that you can follow and understand my steps.

Note 2: For all other lazy guys  they can watch the script video and can use the script to unpack EC targets after watching it.

Note 3: So I know there is already a great EC unpacker tool by RSI which you can use to get your EC files unpacked in the most cases and the script is just a alternativ which you can use if the EC unpacker tool failed or if you need some more detailed infos about your target etc.


ExeCryptor Basic Unpacker 1.0
***************************************************
( 1.) Unpacking of ExeCryptor 2.xx
( 2.) VM OEP Finder - Anti Debug Patch
( 3.) Clean Dump Position Stop
( 4.) GMHA Pointer Scan & Log
( 5.) IAT Find & Fixing via Turbo Hook Mode
( 6.) CRC's Scan & Log
( 7.) Return Bytes Pre & After Scan & Log
( 8.) Supports Exe Files
***************************************************

Like name already says it's a "basic" version so also if you use it you will have to do some little steps manually [I left it open "hehe" ] like CRC's & Ret patchings but no fear so all informations and addresses will craeted in a exrta LogFile of each target so you just need to change some bytes later that's all and no big deal of course.In the single script video you can see three unpack - fix - other OS check exsamples.Just watch it one time then you know what your part is.

Ok so I think I said all so far at the moment about it.Now I wish you much fun and a good watch and testing by yourself and if something does not work etc then just ask on "this topic".

Caution:  The target file included with the package is packed, so that the author can show you how to unpack it.  Your antivirus might give you warning.

MirrorCreator:  DOWNLOAD
Extabit:  DOWNLOAD
RGhost:  DOWNLOAD
ZippyShare:  DOWNLOAD
Uppit:  DOWNLOAD

Offset Converter

Anti Deep Freeze

$
0
0

Anti Deep Freeze v0.5 Beta3

Anti Deep Freeze v0.5 Beta3

Use it when you forgets the Deep-Freeze password.

What's new in this version:
1- Fix some bugs
2- Add Deep Freeze v7.61.020.4320 Standard
3- Add Deep Freeze v7.61.020.4320 Enterprise
4- Add Deep Freeze v7.61.020.4320 Server Enterprise

Supported Versions:
1- Deep Freeze Standard v4.10.020.0448
2- Deep Freeze Standard v5.70.020.1372
3- Deep Freeze Standard v5.70.220.1372
4- Deep Freeze Standard v6.61.020.2822
5- Deep Freeze Standard v6.62.020.3058
6- Deep Freeze Standard v7.00.020.3172
7- Deep Freeze Standard v7.60.020.4298
8- Deep Freeze Enterprise V7.10.220.3176
9- Deep Freeze Workstation v7.60.20.4298
10-Deep Freeze Standard v7.61.020.4320
11-Deep Freeze Enterprise v7.61.020.4320
12-Deep Freeze Server Enterprise v7.61.020.4320

Note: This version is protected with VMP so don't worry if you get any false antivirus alarm.

MirrorCreator:  DOWNLOAD
Extabit:  DOWNLOAD
RGhost:  DOWNLOAD
ZippyShare:  DOWNLOAD
Uppit:  DOWNLOAD

Incoming Search Terms:

Olly Portable

$
0
0
Olly Portable
This is the modified version of OllyDbg, which has been created by Mr. Exodia [TPoDT].   This modified olly includes various plugins which will help you in running any target without having any kind of anti-debugging crashing or error issues.  Olly Portable has been tested on various targets till now like VMProtect, Themida, ASProtect etc. and it seems to bypass all the anti-debugging techniques.

Extabit:  DOWNLOAD
ZippyShare:  DOWNLOAD
Uppit:  DOWNLOAD

PECompact Unpacker

$
0
0
PECompact Unpacker

The tool has been coded by Nacho DJ [AR Team].  This tool will help you in unpacking an executable file packed with PECompact.  The tool is very simple to use, just select your executable file and hit unpack.

MirrorCreator:  DOWNLOAD
Extabit:  DOWNLOAD
RGhost:  DOWNLOAD
ZippyShare:  DOWNLOAD
Uppit:  DOWNLOAD


Dotnet IL Editor (DILE)

$
0
0
Dotnet IL Editor (DILE) v0.2.9


Dotnet IL Editor (DILE) v0.2.9

v0.2.9:
  - fixed bug: calling CloseEnum() could throw an unhandled exception in the 64-bit version of DILE when .NET 4.5/VS2012 was installed as well

v0.2.8:
    - slightly updated the code to be able to read the .NET 4.5 mscorlib.dll (and all other .NET Framework 4.5 assemblies as well)

v0.2.7:
    - several bug fixes (see SVN log for more details)

v0.2.6:
    - added debugging full support for generics (expressions with type parameters can be evaluated and the Object Viewer will also display these values correctly)
    - added support for creating nested classes with expression evaluation
    - added support for creating arrays of nested classes with expression evaluation
    - added support for evaluating expressions that contain enumerations
    - added correct reading of events from metadata (class events are collected in the Project Explorer under the "Events" node similarly to Properties)
    - added parsing of .NET 2.0 format of permission sets
    - fixed bug: debug expression parser did not recognize array parameters correctly that had more than 1 parameters
    - fixed bug: creating array of value types was not possible
    - fixed bug no. 1672137: "Constant string fields are not fully displayed"
    - fixed bug: after adding a dynamic assembly to the project, adding a new assembly was not possible
    - fixed bug: method resolution failed when an overload contained pointer parameter

MirrorCreator:  DOWNLOAD
Extabit:  DOWNLOAD
RGhost:  DOWNLOAD
ZippyShare:  DOWNLOAD
Uppit:  DOWNLOAD

ILSpy Debugger

$
0
0

ILSpy Debugger

ILSpy Debugger v2.1

The debugger engine - Debugger.Core.dll - is basically the same as the one in SharpDevelop IDE - some modifications were made in order to use the latest version of NRefactory. The library that handles the UI stuff (like breakpoints, tooltips, attach to process window) - ILSpy.Debugger.dll - is based on SharpDevelop Debugger.Addin library.

When opening ILSpy, a new menu item is available: Debugger. Under this menu, you will find the following menu-items:

Debug an executable - you will be asked to point to an .NET executable that ILSpy will start debugging
Attach to a running application - you will be asked to point to a running .NET executable that ILSpy will debug
Continue debugging (F5) - will continue the execution of the process
Step into (F11) - will step into the code
Step over (F10) - will step over the code
Steo out (F11) - will step out the code
Detach from running application - will detach the debugger
Remove all breakpoints - will remove all breakpoints

MirrorCreator:  DOWNLOAD
Extabit:  DOWNLOAD
RGhost:  DOWNLOAD
ZippyShare:  DOWNLOAD
Uppit:  DOWNLOAD

DotNet Tools Source Codes

$
0
0
DotNet Tools Source Codes by CodeCracker
As you know, there are lots of tools which has been coded by CodeCracker regarding DotNet, for example string decryptor, dotnet dumper, universal fixer etc.  These tools can help you in dealing with very complex DotNet programs.  The author is providing you the source code of all of his tools.  Dont RIP, just learn from it.

StrongName tools - C#

Assembly_Resigner
Minimum_Resign_Calculator
PKT_AssemblyRef_Replacer
StrongName_Killer
StrongNameVerifier


PatchingSamples&1Use - C#

BabelDelegateKiller
BabelIntDecryptor
DexScator_Decryptor
DexScator_Strings
For PV Logiciels
MemberRefAdd
MonoCecilPatch
MonoCecilPatch2
MonoCecilVM_CrackMe
Universal_Fixer2
Universal_Fixer3

MirrorCreator:  DOWNLOAD
Extabit:  DOWNLOAD
RGhost:  DOWNLOAD
ZippyShare:  DOWNLOAD
Uppit:  DOWNLOAD

Armadillo v9.60 (CopyMem II + Debug Blocker) Unpacking Tutorial

$
0
0
Armadillo v9.60 (CopyMem II + Debug Blocker) Unpacking Tutorial

The tutorial has been made by Gmax.  In this tutorial, the author will explain how to unpack an executable file packed with Armadillo v9.60 (CopyMem II + Debug Blocker) protection system.

Caution:  The target file included with the package is packed, so that the author can show you how to unpack it.  Your antivirus might give you warning.

MirrorCreator:  DOWNLOAD

Dyamar Protector v1.3.6 Unpacking Tutorial

$
0
0

Dyamar Protector v1.3.6 Unpacking Tutorial

The tutorial has been made by Ellvis.  In this tutorial, the author will explain how to unpack an executable file packed with Dyamar Protector v1.3.6.

Caution:  The target file included with the package is packed, so that the author can show you how to unpack it.  Your antivirus might give you warning.

MirrorCreator:  DOWNLOAD
RGhost:  DOWNLOAD
ZippyShare:  DOWNLOAD


Viewing all 50 articles
Browse latest View live