VMUnpacker V1.2 August 6, 2007
Posted by reversengineering in TOOLS, UNPACKERS.3 comments
This tool based on the technology of virtual machine, it could unpack various known & unknown shells. It is suitable for unpacking the shelled Trojan horse in virus analyses, and because all codes are run under the virtual machine, so they will not take any danger to your system..
This product is free software; you can download it, install it, copy it and distribute it noncommercially; If you want use it for commercial sale, copy and distribute, you must get the warranty and permission of DSWLAB before(for example, if the anti-virus company want to use it to analyses the Trojan horse in batches, he must get mandate and permission of DSWLAB before).
By testing, this version could support 57 kinds shells (include 300 versions).
The detailed list:
upx 0.5x-3.00 All Version
BeRoEXEPacker
aspack 1.x–2.x All Version
PEcompact 0.90–1.76 2.06–2.79 All Version
fsg v1.0 v1.1 v1.2 v1.3 v1.31 v1.33 v2.0 All Version
vgcrypt v0.75
nspack 1.4–4.1 All Version
expressor v1.0 v1.1 v1.2 v1.3 v1.4 v1.501
npack v1.5 v2.5 v3.0
dxpack v0.86 v1.0
!epack v1.0 !epack v1.4
bjfnt v1.2 v1.3
mew5 mew v1.0 v1.1
packman v1.0
PEDiminisher v0.1
pex v0.99
petite v1.2 v1.3 v1.4 v2.2 v2.3 All Version
winkript v1.0
pklite32
pepack v0.99 v1.0
pcshrinker v0.71
wwpack32 1.0–1.2
upack 0.1–0.32 0.33–0.399
rlpack 1.11–1.14 1.15–1.18
exe32pack v1.42
kbys v0.22 v0.28
yoda’s protector v1.02 v1.025 v1.03.2
yoda’s crypt v1.1
yoda’s crypt v1.2 v1.3 v1.xModify
XJ
exestealth 2.72–2.76
hidepe v1.0 v1.1
jdpack v1.01 v2.1 v2.13
jdprotect 0.9b
PEncrypt v3.0 v3.1 v4.0
Stone’s PE Crypt v1.13
telock v0.42 v0.51 v0.60 v0.70 v0.71 v0.80 v0.85 v0.90 v0.92 v0.95 v0.96 v0.98 v0.99
ezip
hmimys_pack v1.0
lamecrypt v1.0
depack
polyene v0.01
dragonArmour
EP Protector v0.3
PackItBitch
trojan_protect
anti007 v2.5 v2.6
mkfpack
yzpack v1.1 v2.0
spack method1 spack method2
naked packer v1.0
upolyx v0.51
stealthPE v1.01 stealthPE v2.2
mslrh v0.31 v0.32
mslrh v0.2 == [G!X]’s Protect
morphine v1.3 morphine v1.6 morphine v2.7
rlpack full edition
VM Unpack Engine SDK
The commercial VM Unpack Engine SDK will be provided solemnly (VM Unpack Engine SDK).
Use VM Unpack Engine SDK, the developer does not need to care about the unpacked course and method, only needs to transmit the data to VMUE SDK, VMUE will finish analyzing and unpacking automatically. VMUE supports to send the result of unpacking to the file and memory at the same time, and returns OEP after unpacking directly, It help you unpack shells in your products and tools.
Rebuild PE file after unpacking, such as repair the import table, Overlay, etc. offer the essential condition that rebuilding can running EXE program.
VMUE SDK includes the following part mainly:
Relevant dynamic or static libraries
VMUE SDK technological white paper and the document about the interface of SDK
Codes of calling VMUE SDK
Shell’s signature library in binary
Other auxiliary routines and codes
Welcome to use this software and feedback the question to support@dswlab.com
If you have any question in using, send us email and we will try to help; please post the unpacked program in mail; it is better that you post the packed tool of the program.
Email: support@dswlab.com.
Supercop Kill various kinds of Trojan horse completely, protect the security of system in an all-round way.
more free tools download http://www.dswlab.com
Specialized desktop and safe products of content http://www.unnoo.com
link:
http://rapidshare.com/files/47221978/VMUnpacker.zip
DLL Export Viewer v1.11 August 6, 2007
Posted by reversengineering in MONITORING, TOOLS.add a comment
This utility displays the list of all exported functions and their virtual memory addresses for the specified DLL files. You can easily copy the memory address of the desired function, paste it into your debugger, and set a breakpoint for this memoery address. When this function is called, the debugger will stop in the beginning of this function
–screen shot:
http://www.nirsoft.net/utils/dllexp.gif
–webpage:
http://www.nirsoft.net/utils/dll_export_viewer.html
–link:
—-4 win32
http://rapidshare.com/files/45132358/dllexp.zip
—-4 x64
http://rapidshare.com/files/45132362/dllexp-x64.zip
WinLicense 1.9.3.0 NEWS August 6, 2007
Posted by reversengineering in NEWS.add a comment
WinLicense [1.9.3.0] (02-Aug-2007)
[+]
Added support for VS2007 applications
[+]
Support to execute a Shell command (start) when an application expires
[+]
Added new API SDK: WLTrialExtGetLevel
[+]
Added File Patching option to support signed files
[+]
Added support to protect DLLs with empty relocation table
[+]
Improved compatibility with some .NET applicatins under Vista
[!]
Fixed compatibility wrapping ICMP.IcmpCreateFile
[!]
Fixed compatibility in some applicatons with API-Wrapper enabled and running under Wine
[!]
HKEY_CURRENT_USER was ignored in exported generator when creating trial extension keys
[!]
.NET: fixed compatibility issue loading libraries as image resource
[!]
Fixed compatibility with some DLLs protected with Code Virtualizer + Themida/WinLicense
[!]
“Launch application when trial expires” was not working if main application was launched from Start Menu
[!]
Minor bugs fixed
Protected: Restorator 2007 3.70 build 1746 August 6, 2007
Posted by reversengineering in HEX EDITOR, TOOLS.Enter your password to view comments
Protected: Themida 1.9.1.0.NET Loader August 6, 2007
Posted by reversengineering in PROTECTOR, TOOLS.Enter your password to view comments
Unpacking & Dumping ExeCryptor and Coding Loader August 6, 2007
Posted by reversengineering in MUPS, execryptor.2 comments
hi
this is nice MUP tutor :
http://rapidshare.com/files/36400151/Unpacking_And_Dumping_ExeCryptor_and_Coding_Loader.rar
Process Monitor v 1.2 August 6, 2007
Posted by reversengineering in MONITORING, TOOLS.add a comment
hi
if u rember filemon and regmon ……this is another tools for monitoring :
link:
http://rapidshare.com/files/45131759/ProcessMonitor.zip
Protected: Private EXE Protector v2.0 August 6, 2007
Posted by reversengineering in PROTECTOR, TOOLS.Enter your password to view comments
Protected: WINHEX 14.3 SR3 August 6, 2007
Posted by reversengineering in HEX EDITOR, TOOLS.Enter your password to view comments
Olly Script Editor v2.0 August 6, 2007
Posted by reversengineering in OLLY'S PLUGINS, TOOLS.add a comment
HI
For editing Scripts of OllyDbg
LINK:
http://rapidshare.com/files/47218138/Olly_Script_Editor_v2.0.zip
Malicious Mobile Code Virus Protection for Windows August 6, 2007
Posted by reversengineering in E-BOOK.add a comment
HI
only for review
if u like this book buy it
link:
http://rapidshare.com/files/47095843/OReilly-Malicious.Mobile.Code.Virus.Protection.for.Windows.rar
APIScan 2.1 August 6, 2007
Posted by reversengineering in MONITORING, TOOLS.add a comment
APIScan is a simple tool to gather a list of APIs that a target process uses.
You can use this list in an initial analysis to help determine a target’s
general operating nature. Also can be used to help determine patch/update
changes by doing a WinDif on “before” and “after”.
There are similar tools, often more robust (like “Dependency Walker”), but
most of these just parse the target IAT (”Import Address Table”) alone.
APIScan catches dynamically/delayed loaded modules too; and dumps them as a
simple list.
While only tested (extensively) on Windows XP SP2 32bit, APIScan should work
on everything from W2K to Vista.
link:
http://rapidshare.com/files/47217248/APIScan_2.1.zip
