Reverse Engineering b10g | REM

Trial Reset 4 Final July 26, 2010

Posted by reversengineering in OTHER, TOOLS.
add a comment

Trial Reset 4 Final

Tnx fly to his programmer

http://rapidshare.com/files/409095074/Trial-Reset40Final.zip

http://reversengineering.files.wordpress.com/2010/07/trial-reset40final-zip.jpg

you know what to do;)

The newest NOD32 keys with MVGM NOD32 Licence v1.0 May 21, 2010

Posted by reversengineering in OTHER, TOOLS.
add a comment

HI

The newest NOD32 keys with MVGM NOD32 Licence v1.0

احتمالا شما نیز از آنتی ویروس قدرتمند

NOD32

استفاده نموده اید و بطور یقین برای شما اتفاق افتاده است که برای آپدیت آن نیاز به یوزر و پسورد داشته باشید که باید تقریبا وقت زیادی را صرف بدست آوردن جدیدترین یوزر و پسوردهای این برنامه نمایید تا بتوانید آنتی ویروس آپدی را آپدیت نمایید.
بالاخره پس مدتی که نسخه آزمایشی برنامه به دلیل برخی مشکلات فنی از کار افتاده بود نسخه جدید برنامه که مشکلات نسخه قبلی آن رفع شده است و آماده عرضه می باشد.
با استفاده از برنا

NOD32 Licences

که محصولی از گروه نرم افزار

MVGM Soft

می باشد در کوتاه ترین زمان ممکن تنها با اجرا کردن برنامه جدیدترین کلید های آنتی ویروس قدرتمند

NOD32

را دریافت نمایید.
این برنامه بطور خودکار پس از اجرا جدیدترین کلیدها را از سرور دریافت و به شما نمایش می دهد و لازم به ذکر است که برنامه برای اجرا نیاز به اینترنت دارد (باید به اینترنت متصل باشید)

قابلیتهای کلیدی برنامه
جلوگیری از اتلاف وقت و جسجو
آپدیت جدیدترین یوزر و پسوردها به صورت روزانه
حجم بسیار پایین برنامه (500 کیلوبایت)
قابلیتهای افزوده در ورژن 1.0
سرعت بالاتر در دریافت کلیدها
محیط زیبا و کاربر پسند

http://letitbit.net/download/25885.259cecae0d91034696639f673/MVGM_NOD32_Licence.rar.html

TrialReset 4.0 Final (Public) May 21, 2010

Posted by reversengineering in OTHER, TOOLS.
1 comment so far

hi to all

i am here again thank u for ur supporting

سلام به همه  دوستان مخصو صا دوستانم در  تیم آنریل نیوبای، سودا،سینا،بلک بایت و معین وبقیه

امیدوارم همه سلامت و خوب باشید

The small program for remove trial of apps. Works with all the widespread systems of protection. The interface is very simple: scanning of object, removal of corresponding record, backup object, reception of the information.

Supported Protector:

ACProtect
1.x/2.x
2.1.1

ActiveMark
5.x/6.x
6.2

Armadillo
1.x/2.x/3.x/4.x/5.x/6.x/7.x
7.00

ASProtect
0.x/1.x/2.x
1.5/2.5

DBPE
1.x/2.x
2.33

EncryptPE
1.x/2.x
2.2008.6.10

Enigma
1.x
1.79

ExeCryptor
2.x
2.41

ExeShield
2.x/3.x
4.5.7.1

eXPressor
1.x
1.7.0.1

FlexNet
10.x/11.x
11.6.0.1

ICE License
2.x
2.6.2.1

LicenseProtector
2.x
2.7.0.774

Manco Licensing
5.x
5.0

Nalpeiron
4.x/5.x
5.3.1.0

NoCopy
3.x
3.3

NTkrnl Protector
0.x
0.15

Obsidium
1.x
1.4.0.10

OneWay
5.x/6.x
6.35

Orien
2.x
2.12

PCGuard
4.x/5.x
5.04

ProActivate
1.x
1.11

ProtectionPlus
4.x
4.5.0.2

ProtectShareware
1.x
1.1

Protexis Licensing
1.x/2.x/3.x
3.0.2.5

Safengine Licensor
1.x
1.7.40

SafeSerial
2.x
2.3.9

SDProtector
1.x
1.16

SGLicense
3.x
3.1

ShareGuard
2.x/3.x
4.0

Sheriff
2.x
3.0.0.4

SoftLocx
5.x/6.x/7.x
7.0

SoftSentry
3.x
3.00

SoftWrap
5.x/6.x
7.0.0

STProtector
1.x
1.5

SVKP
1.x
1.44

Thinstall
2.x
2.719

VBOLock
4.x
4.4.2.12

VBox
3.x/4.x
4.6.2

VisualProtect
2.x/3.x
3.5.4

Xheo Licensing
2.x
2.1.5000.28

XProtector
1.x
1.08

WinLicense
1.x/2.x
2.1.0.10

ZipWorx
3.x
3.0.0.1

ZProtect
1.4x
1.4.8.0

System Requirements

Trial-Reset requires a PC running Windows 95/98/ME/NT4/2000/XP/2003/Vista/7 with minimum of 16MB memory and about 0.2 MB of free hard disk space.

To use this program the VB6 run time and Windows Common Controls ActiveX 6 (MSCOMCTL.OCX) must be installed on your computer.

What’s new v4.0 Final (Public):

-Fixed auto-backup
-Fixed some minor bugs

http://letitbit.net/download/60248.607a020e52233928861ec1ada/Trial_Reset40Final.zip.html

Trial Reset version 3 , 3.2 & 3.4 October 14, 2009

Posted by reversengineering in OTHER, TOOLS.
1 comment so far

all of them cheked by NOD32 version 4490 (20091008)

http://letitbit.net/download/0161.0303434083b5d498587f75a69/Trial_Reset_V3.0_3.2_3.4.rar.html

dup 2.19 October 14, 2009

Posted by reversengineering in OTHER, TOOLS.
add a comment

http://letitbit.net/download/4461.4bf7acf1da8a214c89e38d1a8/dup2.rar.html

ArmaG3ddon v1.7 October 14, 2009

Posted by reversengineering in OTHER, TOOLS.
add a comment

ArmaG3ddon v1.7
Current Release: September 2009 v1.7
+ Fixed a problem resolving PE section names
+ Updated Arteam Import Reconstructor (Nacho_dj) version 1.5.0 September 2009
Includes:
+ New approach to get overlay offsets

http://www.accessroot.com/arteam/site/download.php?view.262

http://letitbit.net/download/3260.34501ca88a42e7a38bed86741/ArmaG3ddon_v17_by_CondZero.rar.html

Keygener Assistant v1.1 October 14, 2009

Posted by reversengineering in OTHER, TOOLS.
3 comments

http://letitbit.net/download/2474.2e32f867ffffcf16d49f00f77/keygener_Assistant_v1.1.

rar.html

ExcpHook 0.0.5-rc2 February 26, 2009

Posted by reversengineering in OTHER, TOOLS.
add a comment

The source code / binary is also available as a part of http://code.google.com/p/openrce-snippets/

ExcpHook is an open source (see license.txt) Exception Monitor for Windows made by Gynvael Coldwind (Team Vexillium).
Currently supported Windows versions: XP SP2 and XP SP3
Please note that this is ALPHA version.

ExcpHook Exception Monitor is an exception monitor, made for Windows XP. The monitoring part is kernel-level (technically, in a driver), so in opposite to user-land monitors, ExcpHook does not have to be a debugger for the monitored processes, nor it doesn’t have to change their environment/code/data in anyway. Additionally, ExcpHook is not tied up with one process – it monitors every process in the system, letting the user filter out the interesting processes by providing a part of the image name of the process.

Well, thats it, any comments are welcomed

— Changelog:
0.0.4 -> 0.0.5-rc2
* Fixed 100% CPU eating bug
* Rewritten the code to use IOCTL insted of Write/Read
* Added driver status checking mechanism
* Commented the source code, made it more readable
* Fixed multiCPU/multicore race condition possibility
* Fixed BSoD on some systems when patching the kernel
* Added some more spinlocks here and there
* Fixed BSoD on some kernel versions, the signature seeking
mechanism has been changed to a more decent one
* Added general/control register logging/display
* Added image name acquiring from EPROCESS
* Added one-instatnce-at-a-time limit (this is needed due to design)
* Added disasembly display (using diStorm lib)
* Added some more minor things

— Example of usage:
c:\Tools\ExcpHookMonitor_0.0.5-rc1>ExcpHook.exe excp_
ExcpHook Exception Monitor v0.0.5-rc2 by gynvael.coldwind//vx
(use -h or –help for help)
Filtering results only to ones containing “excp_”
Loading driver…OK
Opening device…OK
Requesting info on driver…OK
Driver: ExcpHook driver v0.0.5-rc2 by gynvael.coldwind//vx.
Driver status: All OK
Entering loop… press ctrl+c to exit

— Exception detected —
PID: 1440 First Chance: YES
Exception code: 10000004 (KI_EXCEPTION_ACCESS_VIOLATION)
Exception addr: 0040130a
Image (from OpenProcess): c:\Tools\ExcpHookMonitor_0.0.5-rc1\TestSuite\excp_accviol.c.exe
Image (from EPROCESS) : excp_accviol.c.
Param count : 2
Params:
00000000 88776655
Access Violation Type : READ
Accessed Memory Address: 88776655
Eax: 00401360 Edx: 77c51ae8 Ecx: 00401360 Ebx: 00004000
Esi: 7c90d950 Edi: 0006a19c Esp: 0022ff60 Ebp: 0022ff78
Eip: 0040130a
EFlags: 00010247
CF: 1 PF: 1 AF: 0 ZF: 1 SF: 0 TF: 0
IF: 1 DF: 0 OF: 0 NT: 0 RF: 1 VM: 0
AC: 0 ID: 0
IOPL: 0 VIF: 0 VIP: 0

Stack:
77c2aead 0006a19c 003e29f0 00401305 00000010 00000002 0022ffb0 00401237
00000001 003e2498 003e29f0 00404000 0022ffa4 ffffffff 0022ffa8 00000001

Code:
[0040130a] a1 55667788 MOV EAX, [0x88776655]
[0040130f] 8945 fc MOV [EBP-0x4], EAX
[00401312] b8 00000000 MOV EAX, 0×0
[00401317] c9 LEAVE
[00401318] c3 RET
[00401319] 90 NOP
[0040131a] 90 NOP
[0040131b] 90 NOP
[0040131c] 90 NOP
[0040131d] 90 NOP
[0040131e] 90 NOP
[0040131f] 90 NOP
[00401320] 55 PUSH EBP
[00401321] b9 c0304000 MOV ECX, 0x4030c0
[00401326] 89e5 MOV EBP, ESP
[00401328] eb 14 JMP 0x40133e

Hash & Crypto Detector 1.1 February 26, 2009

Posted by reversengineering in OTHER, TOOLS.
add a comment

* HCD detects most common Hash & crypto Algorithmes and compilers for PE files.
* It can currently detect more than 90 different signatures .
* HCD is special in some aspects when compared to other identifiers already out there!

############################################################################################

1. It has a superb GUI and the interface is really intuitive and simple.
2. The rate of detection is very good.
3. Shell integration, Command line support.
4. Always on top And Drag’n'Drop capabilities.
5. Extra scanning techniques used for even better detections.
6. Total Scan able to find duplicate signatures and determine the location VA.
7. Save Log allows you to choose the place of keeping or copying the result.

Resource Binder 3.0 February 24, 2009

Posted by reversengineering in OTHER, TOOLS.
2 comments

v. 3.0

+ New GUI

+ External language files + Bugs fixes

 + Drag & Drop support

 + Increase reconstruction speed

HideToolz 2.2(Vista & Windows 7) February 24, 2009

Posted by reversengineering in OTHER, TOOLS.
13 comments

HideToolz 2.2(终于支持Vista和Windows 7了)
This is version 2.2 of HideToolz. Version 2.1 did not work on Windows Vista SP1 or higher. I have modified the device driver so HideToolz now works on Vista SP1 through Windows 7. -Fyyre

- – -

HideToolz is a configurable GUI based utilility that allows hiding of RCE tools from annoying detection (such as Themida). It does so by kernel mode driver which hooks functions such as NtQueryInformationProcess, NtSetContextThread, NtQuerySystemInformation, NtOpenProcess, NtOpenThread, etc… allowing you to debug ‘protected’ applications easily.

Features include:
Hide Processes
Protect Processes
Hide Windows
Protection from Windows hooks
Emulation of partent process (sets parent pid of target PID to explorer.exe).
Anti-Anti debug features.

Runs very stable under Windows XP (all service packs). Please be aware some anti-virus detections HideToolz driver as a rootkit – this is basically correct, except HideToolz contains no payload, does not access any network api, etc… if you doubt, disasm the driver yourself.

VISTA USERS:
If you are running Vista SP1+ you need to apply the vista shutdown fix\shutdown_fix_vista_only.reg to
the registry and reboot BEFORE running HideToolz. This patch disables kernel paging of device drivers, and fixes the problem
with BSOD at shutdown. You may apply this patch simply by double clicking the file and clicking “Yes” – this will set:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management

DisablePagingExecutive from its default of 0 to 1.

Process Lasso v3.47.3 Beta February 24, 2009

Posted by reversengineering in OTHER, TOOLS.
1 comment so far

Process Lasso v3.47.3 Beta
2009-02-17

Changelog:

Fix.Installer: Fixed second, redundant query for language selection in Vista+ /w UAC.
Fix.Localization: Changed much internal string handling to wide-character (unicode).
Fix.Localization: Fixed installer component names in Japanese translation.
Fix.Localization: Fixed update checker not translated in Japanese.
Fix.InstallHelper: (XP/2k only) Fixed preservation of last selected rights assignment between installs.
Change.InstallHelper: Default rights assignment to ‘highest’ when running the core engine as a service, and disable lower rights selection.
Change.AdvancedTools: Merged TweakScheduler and VistaMMSC resources into main resource module.
Change.AdvancedTools: Readied TweakScheduler for localization.
Change.AdvancedTools: Readied VistaMMSC for localization.
Addition.Localization: Added Serbian language by ?zzii, ??????.
Addition.Package: Included advanced tools TweakScheduler and VistaMMSC in freeware build.
Addition.GUI: Added new 48×48 @ 24bpp application/shell icon, by Vitor Machado.

Download:

http://www.bitsum.com/files/beta/pssetup.zip
http://www.bitsum.com/files/beta/pssetup64.zip

Sh4DoVV tools January 10, 2009

Posted by reversengineering in OTHER, TOOLS.
4 comments

Armadillo Detacher special for  Debug-Blocker & Copy-MemII

Sh4DoVV Enigma 1.5x-1.6x Generic Loader

by Sh4DoVV

http://rapidshare.com/files/181251204/Sh4DoVV_Armadillo_Detacher.rar.html

http://rapidshare.com/files/181251856/Sh4DoVV_Generic_Enigma_1.5x-1.6x_Loader.rar.html

AutoRuns for Windows v9.37 January 7, 2009

Posted by reversengineering in OTHER, TOOLS.
add a comment

AutoRuns for Windows v9.37 By Mark Russinovich and Bryce Cogswell Published: December 19, 2008 Introduction This utility, which has the most comprehensive knowledge of auto-starting locations of any startup monitor, shows you what programs are configured to run during system bootup or login, and shows you the entries in the order Windows processes them. These programs include ones in your startup folder, Run, RunOnce, and other Registry keys. You can configure Autoruns to show other locations, including Explorer shell extensions, toolbars, browser helper objects, Winlogon notifications, auto-start services, and much more. Autoruns goes way beyond the MSConfig utility bundled with Windows Me and XP. Autoruns’ Hide Signed Microsoft Entries option helps you to zoom in on third-party auto-starting images that have been added to your system and it has support for looking at the auto-starting images configured for other accounts configured on a system. Also included in the download package is a command-line equivalent that can output in CSV format, Autorunsc. You’ll probably be surprised at how many executables are launched automatically! http://download.sysinternals.com/Files/Autoruns.zip

PE Explorer v1.99 R5 FULL December 18, 2008

Posted by reversengineering in OTHER, TOOLS.
1 comment so far

http://vip-file.com/download/d473ef664967/PE-Explorer-v1.99-R5-FULL.rar.html

Thinstal Package Extractor December 9, 2008

Posted by reversengineering in OTHER, TOOLS.
11 comments

http://letitbit.net/download/99ab99101406/Thinstall-Package–Extractor.rar.html

HideSyser Plugin 1.94 December 9, 2008

Posted by reversengineering in OTHER, TOOLS.
1 comment so far

Syser is a wonderfull tool but not have a lot of plugins for it. I make one plugin (in a beta stage) that have 2 functions:

- Use “gta” or “getaddr” command in Syser control panel for get a kernel function memory address, ex.”gta DbgPrint” and you get the memory entry point. Only works with Kernel exported functions (Kernel and Hal).

- Use “hide” command to hide Syser against NtCreateFile (a lot of programs try find Syser using it)
- Use “unhide” command to unhide Syser against NtCreateFile

It is a POC. Only tested in Windows XP Proffesional SP2/SP3 in VMWare and without VMWare with success

For install put in the %SystemFolder%\drivers\plugin\386i and reboot Syser

http://letitbit.net/download/c6ed40972286/HideSyser-v-1.94.rar.html

dup2.19 beta 4 December 9, 2008

Posted by reversengineering in OTHER, TOOLS.
add a comment

Version:

Features:
-multiple file patcher
-create Offset and Search&Replace patch/loader
-compare files (RawOffset and VirtualAddress) with different filesize
-registry patcher, also for loaders
-attach files to patcher
-get filepaths from registry
-usage of CRC32 and filesize checks
-patching packed files
-compress patcher with your favorite packer
-saving projects
-use custom skin in your patcher
-add music (Tracker Modules: xm,mod,it,s3m,mtm,umx,v2m,ahx,sid) to patcher
-and many more…

http://diablo2oo2.di.funpic.de/stuff/dup2.beta.rar

Armadillo-6.x-HWID-Changer December 9, 2008

Posted by reversengineering in OTHER, TOOLS.
4 comments

This Is A Simple Tool For Changing Armadillo 6.0.x Hardware ID In Standard Protection Mode
Armadillo Is A Bad Protector , Because You Can Crack It Without Any User And Key
Next Time I Release My Tool For Armadillo Cracking

http://vip-file.com/download/8af781236861/Sh4DoVV-Armadillo-6.x-HWID-Changer.rar.html

Tola Patching Engine December 9, 2008

Posted by reversengineering in OTHER, TOOLS.
add a comment

http://s2.ipicture.ru/uploads/081208/BfTTGhSDJY.png

http://vip-file.com/download/5da9b2328045/Tola.rar.html

VMware ThinApp 4.0.1-2837 December 9, 2008

Posted by reversengineering in OTHER, TOOLS.
add a comment

” ..This a maintenance release that addresses a number of known issues. It also delivers some nice
additions to utilities within the ThinApp Suite including the ThinReg application..”

- The following features have been added for this release :

The thinreg.exe utility has been enhanced, facilitating file type association. It also includes support for DDE, extra verbs, and MIME type registration.

Enhanced support for double-byte applications and double-byte locales.

Enhanced support for 16-bit MSDOS programs.

Support for control panel extensions. Some applications, such as QuickTime or the mail applet for Microsoft Outlook 2007, have control panel extensions that you can now see in a ThinApp environment.

Ability to register files other than .exe files. For example, if you install an application that installed a README file or has another link to documentation, you can access those files.

Protocol registration. If an application invokes SMTP or HTTP, ThinApp starts any virtual applications that can handle the tasks. If ThinApp cannot locate virtual applications, ThinApp invokes native applications to handle the tasks.

ThinApp includes the RequiredAppLinks parameter in the Package.ini file. Previously, the user had to manually add this parameter.

ThinApp makes the MSI build template accessible to users to customize the MSI database.

User documentation has been restructured to start with basic functionality targeted at the novice user, building towards advanced functionality regarding deployment and customizations.

Log Monitor now supports the ability to pause and resume trace file capture.

Application link now supports multi-level links, such that application A links to application B, which links to application C, and so on.

Special entrypoints cmd, regedit and iexplore are marked with an asterisk (*) to denote these are not virtual applications. Rather, they load respective native EXEs in virtual environment.

Isolation mode can now be specified at the root of registry (for example, for HKCU, HKLM).

Stub executables changed to improve security and interaction with roaming profiles and system-installed applications.

Support for creating MSI distribution larger than 2GB (requires separate CAB file to be distributed).

Support for creation of compressed trace files.

Support for running ThinApp application on GoGlobal platform.

Support packaging application wrapped with the “Shrinker” packer.

…and more :
vmware.com/support/thinapp4/doc/releasenotes_thinapp401.html

http://rapidshare.com/files/171695546/4.0.1-2837.zip