letitbit is ok now February 26, 2009
Posted by reversengineering in NEWS.add a comment
hi
i test letitbit today and see its work fine 
all files online now and u can dl it
all files of 26 feb posts February 26, 2009
Posted by reversengineering in Request, TOOLS.add a comment
plus more ….
DownloadLink: http://rapidshare.com/files/202799005/26_feb_2009_uploaded.rar
EXECryptor And CrC Check. February 26, 2009
Posted by reversengineering in execryptor, MUPS.4 comments
EXECryptor And CrC Check. tutur by phpb
ExcpHook 0.0.5-rc2 February 26, 2009
Posted by reversengineering in OTHER, TOOLS.add a comment
The source code / binary is also available as a part of http://code.google.com/p/openrce-snippets/
ExcpHook is an open source (see license.txt) Exception Monitor for Windows made by Gynvael Coldwind (Team Vexillium).
Currently supported Windows versions: XP SP2 and XP SP3
Please note that this is ALPHA version.
ExcpHook Exception Monitor is an exception monitor, made for Windows XP. The monitoring part is kernel-level (technically, in a driver), so in opposite to user-land monitors, ExcpHook does not have to be a debugger for the monitored processes, nor it doesn’t have to change their environment/code/data in anyway. Additionally, ExcpHook is not tied up with one process – it monitors every process in the system, letting the user filter out the interesting processes by providing a part of the image name of the process.
Well, thats it, any comments are welcomed
— Changelog:
0.0.4 -> 0.0.5-rc2
* Fixed 100% CPU eating bug
* Rewritten the code to use IOCTL insted of Write/Read
* Added driver status checking mechanism
* Commented the source code, made it more readable
* Fixed multiCPU/multicore race condition possibility
* Fixed BSoD on some systems when patching the kernel
* Added some more spinlocks here and there
* Fixed BSoD on some kernel versions, the signature seeking
mechanism has been changed to a more decent one
* Added general/control register logging/display
* Added image name acquiring from EPROCESS
* Added one-instatnce-at-a-time limit (this is needed due to design)
* Added disasembly display (using diStorm lib)
* Added some more minor things
— Example of usage:
c:\Tools\ExcpHookMonitor_0.0.5-rc1>ExcpHook.exe excp_
ExcpHook Exception Monitor v0.0.5-rc2 by gynvael.coldwind//vx
(use -h or –help for help)
Filtering results only to ones containing “excp_”
Loading driver…OK
Opening device…OK
Requesting info on driver…OK
Driver: ExcpHook driver v0.0.5-rc2 by gynvael.coldwind//vx.
Driver status: All OK
Entering loop… press ctrl+c to exit
— Exception detected —
PID: 1440 First Chance: YES
Exception code: 10000004 (KI_EXCEPTION_ACCESS_VIOLATION)
Exception addr: 0040130a
Image (from OpenProcess): c:\Tools\ExcpHookMonitor_0.0.5-rc1\TestSuite\excp_accviol.c.exe
Image (from EPROCESS) : excp_accviol.c.
Param count : 2
Params:
00000000 88776655
Access Violation Type : READ
Accessed Memory Address: 88776655
Eax: 00401360 Edx: 77c51ae8 Ecx: 00401360 Ebx: 00004000
Esi: 7c90d950 Edi: 0006a19c Esp: 0022ff60 Ebp: 0022ff78
Eip: 0040130a
EFlags: 00010247
CF: 1 PF: 1 AF: 0 ZF: 1 SF: 0 TF: 0
IF: 1 DF: 0 OF: 0 NT: 0 RF: 1 VM: 0
AC: 0 ID: 0
IOPL: 0 VIF: 0 VIP: 0
Stack:
77c2aead 0006a19c 003e29f0 00401305 00000010 00000002 0022ffb0 00401237
00000001 003e2498 003e29f0 00404000 0022ffa4 ffffffff 0022ffa8 00000001
Code:
[0040130a] a1 55667788 MOV EAX, [0x88776655]
[0040130f] 8945 fc MOV [EBP-0x4], EAX
[00401312] b8 00000000 MOV EAX, 0×0
[00401317] c9 LEAVE
[00401318] c3 RET
[00401319] 90 NOP
[0040131a] 90 NOP
[0040131b] 90 NOP
[0040131c] 90 NOP
[0040131d] 90 NOP
[0040131e] 90 NOP
[0040131f] 90 NOP
[00401320] 55 PUSH EBP
[00401321] b9 c0304000 MOV ECX, 0x4030c0
[00401326] 89e5 MOV EBP, ESP
[00401328] eb 14 JMP 0x40133e
Hash & Crypto Detector 1.1 February 26, 2009
Posted by reversengineering in OTHER, TOOLS.add a comment
* HCD detects most common Hash & crypto Algorithmes and compilers for PE files.
* It can currently detect more than 90 different signatures .
* HCD is special in some aspects when compared to other identifiers already out there!
############################################################################################
1. It has a superb GUI and the interface is really intuitive and simple.
2. The rate of detection is very good.
3. Shell integration, Command line support.
4. Always on top And Drag’n'Drop capabilities.
5. Extra scanning techniques used for even better detections.
6. Total Scan able to find duplicate signatures and determine the location VA.
7. Save Log allows you to choose the place of keeping or copying the result.
NW PE Builder February 26, 2009
Posted by reversengineering in PACKER, TOOLS.add a comment
Simple and easy to use PE Editor.
Rebel.NET 1.3.0.1 February 26, 2009
Posted by reversengineering in .NET, TOOLS.add a comment
Rebel.NET is a rebuilding tool for .NET assemblies which is capable of adding and replacing methods and streams.
It’s possible to replace only a limited number of methods or every method contained in a .NET assembly. The simplicity of Rebel.NET consists in the replacing process: one can choose what to replace. For instance, one may choose to replace only the method code, instead of its signature or method header.
The interface of Rebel.NET is quite a simple one. As input it requires a .NET assembly to be rebuilded and a Rebel.NET rebuilding file. The Rebel.NET file contains the data that has to be replaced in the original assembly.
Rebel.NET can also create a Rebel.NET file from a given assembly. This is a key functionality, since some times the data of the original assembly has to be processed first to produce a Rebel.NET file for the rebuilding of the assembly. This sort of “report” feature can also be used to analyze the methods of an assembly, since reading the original data from a .NET assembly isn’t as easy as reading a Rebel.NET file. It’s possible to choose what should be contained in the Rebel.NET file.
All the Rebel.NET features can used through command line, which comes very handy when an automated rebuilding process is needed.
Rebel.NET is, mainly, a very solid base to overcome every .NET protection and to re-create a fully decompilable .NET assembly. As such, Rebel.NET has to be considered a research project, not an encouragement to violate licensing terms.
ActiveMARK Version Viewer 1.2 February 26, 2009
Posted by reversengineering in DETECTOR, TOOLS.1 comment so far
ActiveMARK Version Viewer 1.2 – 2009/01/14 – Bilingual edition (English/Spanish)
Updated for the new version AM6.50.767.
History
——-
*** version 1.1 – 2008/08/14 – Bilingual edition (English/Spanish)
When checking an ActiveMARK license file, it shows the Activation Code.
*** version 1.0 – 2008/04/13 – Bilingual edition (English/Spanish)
Tool for detecting if a target is protected with ActiveMARK protection.
Available for any kind of file.
Running on an executable will launch it with the proper arguments to show the version by using the ActiveMARK internal engine.
It permits a static analysis (not executing anything), by checking ‘Do not launch executables’ checkbox. This option will prevent your system from getting neither new hidden registry entries that the protection adds to your system, nor hidden files, too, both of them being used by the protection for memorize the trial uses of the target.
For getting the possibility of use from a contextual menu, check ‘Add to contextual menu’ checkbox.
It detects if your system language is english or spanish before showing you all strings.
I hope you enjoy it 
Nacho_dj / ARTeam
Coded & Developed by Nacho_dj / ARTeam
SecurePE 1.6 February 26, 2009
Posted by reversengineering in PACKER, TOOLS.add a comment
SecurePE is a user friendly freeware utility coded in 32bit assembly language that protects Microsoft Windows® PE files with a password, strong RC4 encryption and checksum while leaving them totally functional.
IceStealth February 26, 2009
Posted by reversengineering in DEBUGGER, OTHER, TOOLS.1 comment so far
Last updated: Feb 25, 2009
Author: Daniel Steinhäußer
IceStealth is a SoftICE hiding tool, that should protect from:
CreateFileA, CreateFileW, NtCreateFile, also nmtrans.dll wont find SoftICE with these methods
NtQueryDirectoryObject
NtQueryObject
OpenServiceA, OpenServiceW, EnumServicesStatusA,EnumServicesStatusW,EnumServicesStatusExA, EnumServicesStatusExW
UnhandledExceptionFilter (2 Options)
SEH BPM protect
NtQuerySystemInformation
int 41 killed + DPL 0
int 1 DPL 0
Basic Registry Protection (if ever needed)
