Requirements. Developed and tested mainly under Windows 2000 and Windows XP, but should work under any Windows version: 95, 98, ME, NT, 2000, XP, 2003 Server, Vista, Windows 7 and so on. For a comfortable debugging you will need at least 500-MHz processor. OllyDbg is memory hungry. If you debug large application with all features enabled, it may allocate 200-300 megabytes for backup and analysis data.

Supported instruction sets. OllyDbg 2.0 supports all existing 80×86-compatible CPUs: MMX, 3DNow!, including Athlon extentions, and SSE instructions up to SSSE3 and SSE4.

Configurability. More than 120 options (oh, no! This time it’s definitely too much!) control OllyDbg’s behaviour and appearance.

Data formats. Dump windows display data in all common formats: hexadecimal, ASCII, UNICODE, 16 and 32-bit signed/unsigned/hexadecimal integers, 32/64/80-bit floats, addresses, disassembly (MASM, IDEAL, HLA or AT&T). It also decodes and comments many Windows-specific structures, including PE headers, PEB, Thread data blocks and so on.

Help. OllyDbg 2.0 includes built-in help on all 80×86 integer and floating-point commands. If you possess Windows API help (win32.hlp, not included due to copyright reasons), you can attach it and get instant help on system API calls.

Startup. You can specify executable file in command line, select it from menu, drag-and-drop file to OllyDbg, restart last debugged program or attach to already running application. OllyDbg supports just-in-time debugging and debugging of child processes. You can detach from the debugged process, and it will continue execution. Installation is not necessary!

Code highlighting. Disassembler can highlight different types of commands (jumps, conditional jumps, pushes and pops, calls, returns, privileged and invalid) and different operands (general, FPU/SSE or segment/system registers, memory operands on stack or in other memory, constants). You can create custom highlighting schemes.

Threads. OllyDbg can debug multithread applications. You can switch from one thread to another, suspend, resume and kill threads or change their priorities. Threads window displays errors for each thread (as returned by call to GetLastError).

Analysis. Analyzer is one of the most significant parts of OllyDbg. It recognizes procedures, loops, switches, tables, constants and strings embedded in code, tricky constructs, calls to API functions, number of function’s arguments, import sections and so on. It attempts to determine not only the number of stack arguments in the unknown functions, but even their meaning. Analysis makes binary code much more readable, facilitates debugging and reduces probability of misinterpretations and crashes. It is not compiler-oriented and works equally good with any PE program.

Full UNICODE support. All operations available for ASCII strings are also available for UNICODE, and vice versa. OllyDbg is able to recognize UTF-8 strings.

Names. OllyDbg knows symbolic names of many (currently 7700) constants, like window messages, error codes or bit fields, and decodes them in calls to known functions.

Known functions. OllyDbg recognizes by name more than 2200 frequently used Windows API functions and decodes their arguments. You can add your own descriptions. You may set logging breakpoint on a known or guessed function and protocol arguments to the log.

Calls. OllyDbg can backtrace nested calls on the stack even when debugging information is unavailable and procedures use non-standard prologs and epilogs.

Stack. In the Stack window, OllyDbg uses heuristics to recognize return addresses and stack frames. Notice however that they can be remnants from the previous calls. If program is paused on the known function, stack window decodes arguments of known and guessed functions. Stack also traces and displays the chain of SE handlers.

Search. Plenty of possibilities! Search for command (exact or imprecise) or sequence of commands, for constant, binary or text string (not necessarily contiguous), for all commands that reference address, constant or address range, for all jumps to selected location, for all referenced text strings, for all intermodular calls, for masked binary sequence in the whole allocated memory and so on. If multiple locations are found, you can quickly navigate between them.

Breakpoints. OllyDbg supports all common kinds of breakpoints: INT3, memory and hardware. You may specify number of passes and set conditions for pause. Breakpoints may conditionally protocol data to the log. Number of INT3 and memory breakpoints is unlimited: in the extreme case of hit trace, OllyDbg sometimes sets more than 100000 INT3 breakpoints. On a fast CPU, OllyDbg can process up to 20-30 thousand breakpoints per second.

Watches. Watch is an expression evaluated each time the program pauses. You can use registers, constants, address expressions, boolean and algebraical operations of any complexity.

Execution. You can execute program step-by-step, either entering subroutines or executing them at once. You can run program till next return, to the specified location, or backtrace it from the deeply nested system API call back to the user code. When application runs, you keep full control over it. For example, you can view memory, set breakpoints and even modify code “on-the-fly”. At any time, you can pause or restart the debugged program.

Hit trace. Hit trace shows which commands or procedures were executed so far, allowing you to test all branches of your code. Hit trace starts from the actual location and sets INT3 breakpoints on all branches that were not traced so far. The breakpoints are removed when command is reached (hit).

Run trace. Run trace executes program in the step-by-step mode and protocols execution to the large circular buffer. Run trace is fast: when fast command emulation is enabled, OllyDbg traces up to 1 million commands per second! Run trace protocols registers (except for SSE), flags, contents of accessed memory, thread errors and – for the case that your code is self-modifying – the original commands. You may specify the condition to stop run trace, like address range, expression or command. You can save run trace to the file and compare two independent runs. Run trace allows to backtrack and analyse history of execution in details, millions and millions of commands.

Profiling. Profiler calculates how many times some instruction is listed in the run trace buffer. With profiler, you know which part of the code takes most of execution time.

Patching. Built-in assembler automatically selects the shortest possible code. Binary editor shows data simultaneously in ASCII, UNICODE and hexadecimal form. Old good copy-and-paste is also available. Automatical backup allows to undo changes. You can copy modifications directly to executable file, OllyDbg will even adjust fixups.

UDD. OllyDbg saves all program and module-related information to the individual file and restores it when module is reloaded. This information includes labels, comments, breakpoints, watches, analysis data, conditions and so on.

Customization. You can specify custom fonts, colour and highlighting schemes.

And much more! This list is far from complete, there are many features that make OllyDbg 2.0 the friendly debugger.

Author website http://www.ollydbg.de/

http://reversengineering.files.wordpress.com/2010/07/odbg200-rar.jpg

- detection of every major PC ISO Game / Application protection
- currently covers 475 detections, including win32/64 exe protectors & packers, .net protectors, dongles, licenses & installers
- sector scanning CDs / DVDs for Copy Protections
- files / folders can simply be drag & droped into pid
- strong scanning routines allowing it to detect multiple protections
- easy scanning via shell context menu
- usefully misc tools included
- coded 100% in Win32 assembly language
- fully 32bit & 64bit compliant
- working from Win9x to Windows 7

Author website http://pid.gamecopyworld.com/

http://reversengineering.files.wordpress.com/2010/07/protectionid-v6-4-0-rar.jpg

This plug-in provides three kinds of ways to initiate the process:

1, Normal – And the same manner as the original start, the STARTUPINFO inside unclean data
2, CreateAsUser – User with a mandate to initiate the process of the user, so that the process running under the purview of the User, unable to establish the process Admin operation.

Running is such a need in the local security strategy – the user rights assignment inside your users will join the two powers:

1, the replacement process-level marks (SeAssignPrimaryTokenPrivilege)
2, the operating system mode operations (SeTcbPrivilege)

If the home version of the windows, unable to set up, then you can try to use SuperMode and reopen the OD to upgrade the competence and strongly does not recommend the use of this option

3, CreateAsRestrict – The second option the user with User authority to initiate the process more restricted areas, and increase the third function to a explicit Admin users to initiate proceedings.

The procedure is initiated Admin user, but power users only some of the default User authority, all authority to delete some risk (including SeDebugPrivilege, SeLoadDriverPrivilege, etc.), this procedure will not run OD cause great harm. In this way the proposed commencement of the proceedings.

http://www.unpack.cn/viewthread.php?tid=28854

http://reversengineering.files.wordpress.com/2010/07/strongod-v0-3-4-639-rar.jpg

دوستان لینکهایی که کار نمی کند را در این  بخش اعلام نمایند تا پس از یافتن آنها در سیستم مجدد اپلودشان نمایم

همه لینکها در این پست اعلام خواهد شد

hi

dear friends tell me about broken links in this post i will find it on my system and after that i will try to upload it

all of them will RLZ here

tnx in adv.

با تشکر فراروان

Tnx fly to his programmer

http://rapidshare.com/files/409095074/Trial-Reset40Final.zip

http://reversengineering.files.wordpress.com/2010/07/trial-reset40final-zip.jpg

you know what to do;)

The newest NOD32 keys with MVGM NOD32 Licence v1.0

احتمالا شما نیز از آنتی ویروس قدرتمند

NOD32

استفاده نموده اید و بطور یقین برای شما اتفاق افتاده است که برای آپدیت آن نیاز به یوزر و پسورد داشته باشید که باید تقریبا وقت زیادی را صرف بدست آوردن جدیدترین یوزر و پسوردهای این برنامه نمایید تا بتوانید آنتی ویروس آپدی را آپدیت نمایید.
بالاخره پس مدتی که نسخه آزمایشی برنامه به دلیل برخی مشکلات فنی از کار افتاده بود نسخه جدید برنامه که مشکلات نسخه قبلی آن رفع شده است و آماده عرضه می باشد.
با استفاده از برنا

NOD32 Licences

که محصولی از گروه نرم افزار

MVGM Soft

می باشد در کوتاه ترین زمان ممکن تنها با اجرا کردن برنامه جدیدترین کلید های آنتی ویروس قدرتمند

NOD32

را دریافت نمایید.
این برنامه بطور خودکار پس از اجرا جدیدترین کلیدها را از سرور دریافت و به شما نمایش می دهد و لازم به ذکر است که برنامه برای اجرا نیاز به اینترنت دارد (باید به اینترنت متصل باشید)

قابلیتهای کلیدی برنامه
جلوگیری از اتلاف وقت و جسجو
آپدیت جدیدترین یوزر و پسوردها به صورت روزانه
حجم بسیار پایین برنامه (500 کیلوبایت)
قابلیتهای افزوده در ورژن 1.0
سرعت بالاتر در دریافت کلیدها
محیط زیبا و کاربر پسند

http://letitbit.net/download/25885.259cecae0d91034696639f673/MVGM_NOD32_Licence.rar.html

i am here again thank u for ur supporting

سلام به همه  دوستان مخصو صا دوستانم در  تیم آنریل نیوبای، سودا،سینا،بلک بایت و معین وبقیه

امیدوارم همه سلامت و خوب باشید

The small program for remove trial of apps. Works with all the widespread systems of protection. The interface is very simple: scanning of object, removal of corresponding record, backup object, reception of the information.

Supported Protector:

ACProtect
1.x/2.x
2.1.1

ActiveMark
5.x/6.x
6.2

Armadillo
1.x/2.x/3.x/4.x/5.x/6.x/7.x
7.00

ASProtect
0.x/1.x/2.x
1.5/2.5

DBPE
1.x/2.x
2.33

EncryptPE
1.x/2.x
2.2008.6.10

Enigma
1.x
1.79

ExeCryptor
2.x
2.41

ExeShield
2.x/3.x
4.5.7.1

eXPressor
1.x
1.7.0.1

FlexNet
10.x/11.x
11.6.0.1

ICE License
2.x
2.6.2.1

LicenseProtector
2.x
2.7.0.774

Manco Licensing
5.x
5.0

Nalpeiron
4.x/5.x
5.3.1.0

NoCopy
3.x
3.3

NTkrnl Protector
0.x
0.15

Obsidium
1.x
1.4.0.10

OneWay
5.x/6.x
6.35

Orien
2.x
2.12

PCGuard
4.x/5.x
5.04

ProActivate
1.x
1.11

ProtectionPlus
4.x
4.5.0.2

ProtectShareware
1.x
1.1

Protexis Licensing
1.x/2.x/3.x
3.0.2.5

Safengine Licensor
1.x
1.7.40

SafeSerial
2.x
2.3.9

SDProtector
1.x
1.16

SGLicense
3.x
3.1

ShareGuard
2.x/3.x
4.0

Sheriff
2.x
3.0.0.4

SoftLocx
5.x/6.x/7.x
7.0

SoftSentry
3.x
3.00

SoftWrap
5.x/6.x
7.0.0

STProtector
1.x
1.5

SVKP
1.x
1.44

Thinstall
2.x
2.719

VBOLock
4.x
4.4.2.12

VBox
3.x/4.x
4.6.2

VisualProtect
2.x/3.x
3.5.4

Xheo Licensing
2.x
2.1.5000.28

XProtector
1.x
1.08

WinLicense
1.x/2.x
2.1.0.10

ZipWorx
3.x
3.0.0.1

ZProtect
1.4x
1.4.8.0

System Requirements

Trial-Reset requires a PC running Windows 95/98/ME/NT4/2000/XP/2003/Vista/7 with minimum of 16MB memory and about 0.2 MB of free hard disk space.

To use this program the VB6 run time and Windows Common Controls ActiveX 6 (MSCOMCTL.OCX) must be installed on your computer.

What’s new v4.0 Final (Public):

-Fixed auto-backup
-Fixed some minor bugs

http://letitbit.net/download/60248.607a020e52233928861ec1ada/Trial_Reset40Final.zip.html

Window, the process of selection, OD automatically minimize the window, select the target

window, then maximize the window, OD.

Note: Some versions of the OD program may cover an open button, can be changed according to

their own circumstances, under source code, do not change it, no big problem.

http://letitbit.net/download/0185.fea03c8fe180283b90a2e5af6/ODDragAttach_v1.1.rar.html

With this plugin, you can attach to process by identifying its PID directly, not only selecting process list. In addition, you can find PID of process by dragging a small cursor on each window (This can be used on some protection which remove process from process list like GameGuard).

by hero

http://letitbit.net/download/3236.38c30a80eb9c23920ac9a2de1/AttachExtended_v0.1.rar.html

Description     This is an open source OllyDbg plugin which will help you to import map files

exported by IDA or Dede. There are many plugins using which you can perform similar actions, but

mapimp:

- Recognizes debugged file segments and applies names correctly
- Has an option to overwrite or skip names that intersect already defined
- Has a filter option which gives you great name demangling potential

• Filter
The main idea is to apply series of masks to every single name loaded. Mask syntax goes.
as follows:

/key[/]regex

Key “c” cuts the matched substring selected by regular expression.

[SAMPLE]
name: System::__linkproc__ GetMem(int)
mask: /c__linkproc__
applied: System::GetMem(int)
[/SAMPLE]

Key “s” skips the name if regular expression succeeds. It may be useful if you want to skip some

dummy or incorrect names.

[SAMPLE]
name: unknown_libname_2519
mask: /sunknown_libname_
applied:
[/SAMPLE]

Key “r” replaces the substring selected by regular expression with your own.

/rsubstring/regex

As you can see slash character delims your substring from the regular expression. Use double

slash to define slash as a character of your substring.

[SAMPLE]
name: System@Function(System@AnsiString;System@AnsiString)
mask: /rsys::/System@
applied: sys::Function(sys::AnsiString;sys::AnsiString)

name: System@Function(System@AnsiString;System@AnsiString)
mask: /r//_/@
applied: System/_Function(System/_AnsiString;System/_AnsiString)
[/SAMPLE]

Remember that if the name met the mask condition it will be changed, then the second mask is

applied to the changed name and so on. The order of mask applying is undefined so be careful,

because some masks may intersect.

As about regular expressions, the plugin uses pcre library which syntax is compatible with perl

regular expression. Check http://www.pcre.org for docs and sources.

http://letitbit.net/download/4104.4c9d1a75c7d9867799b30b069/Mapimp_v0.4.rar.html

Author     Pavka

- labels and data (C-style string)
- external jumps and calls.

http://letitbit.net/download/6671.c63ed09074b57c49b4cd2067e/MUltimate_Assembler_v1.2.rar.html

by LCF-AT

1) Deobfuscate

Select instructions in disasm window and execute this command. It will try to clear the code from junk instructions.

Example:

Original:
00874372 57 PUSH EDI
00874373 BF 352AAF6A MOV EDI,6AAF2A35
00874378 81E7 0D152A41 AND EDI,412A150D
0087437E 81F7 01002A40 XOR EDI,402A0001
00874384 01FB ADD EBX,EDI
00874386 5F POP EDI

Deobfuscated:
00874372 83C3 04 ADD EBX,4

________________________________________________________

2) Deobfuscate – Single Step

This works like previous command, but does one transformation at a time

_______________________________________________________

3) Move NOPs to bottom

Converts this:

00874396 50 PUSH EAX
00874397 90 NOP
00874398 90 NOP
00874399 52 PUSH EDX
0087439A BA 3F976B00 MOV EDX,somesoft.006B973F
0087439F 90 NOP
008743A0 90 NOP
008743A1 90 NOP

to this:

00874396 50 PUSH EAX
00874397 52 PUSH EDX
00874398 BA 3F976B00 MOV EDX,somesoft.006B973F
0087439D 90 NOP
0087439E 90 NOP
0087439F 90 NOP
008743A0 90 NOP
008743A1 90 NOP

Limitations: it breaks all jumps and calls pointing inwards

________________________________________________________

4) Undo / Redo

Undo or Redo last operation (from one of the above functions)

________________________________________________________

5) Retrieve Jumpy function

This will statically parse instructions and follow all jumps. This is useful for situations, when program jumps here and there and here and there… When it encounters some instruction, that can’t be followed, it stop and copies all parsed instruction to an allocated place in memory.

Use settings to set some parameters:

Step over calls – if set, it will step over calls, otherwise it will follow them
Step over jccs – dtto, but for Jccs
Deobfuscate – it will deobfuscate instruction, when it encounters Jcc, RET, JMP reg/exp, CALL reg/exp; useful for multi-branch

Example:

Original:
00874389 /EB 05 JMP SHORT somesoft.00874390
0087438B |43 INC EBX
0087438C |41 INC ECX
0087438D |42 INC EDX
0087438E |EB 07 JMP SHORT somesoft.00874397
00874390 \B8 07000000 MOV EAX,7
00874395 ^ EB F4 JMP SHORT somesoft.0087438B
00874397 C3 RET

Result:
003B0000 B8 07000000 MOV EAX,7
003B0005 43 INC EBX
003B0006 41 INC ECX
003B0007 42 INC EDX
003B0008 C3 RET

________________________________________________________

6) Rebuild RSRC and Realign

This function has some limited use when unpacking. It opens the debugged file from disc. Then it retrieves all resources and rebuilds them to one place (currently it rebuilds them only to original place in exe). Then it realigns file and saves it under new name.

When is this useful? For example when unpacking aspack/asprotect or some other packers. These steal some resources from original place and put them to its own section, therefore increasing overall size and preventing you from cutting packer’s section. It also prevents Resource hacker from displaying these resouces. This puts all resources to one place.

I’m sure there are better tools for this, but it may come handy sometimes.

_____________________________________________________

7) AsProtect Unpacker

This will unpack file packed by AsProtect, fix it, dump asprotect.dll and print various information to text file. Please report targets, where it fails.

Limitations:
1) Doesn’t find or fix SDK functions in 1.x versions (you need to find these manually).

There are two types of these. One has a form of one or more functions called before OEP, that do various initializations. If they are not run, the program may appear expired or not run at all. Find them and run them

The second type is run after OEP and hides behind GetProcAddress with special parameters, which AsProtect (if available) redirects to its own code. You need to deal with these manually.

2) in 2.30 – 2.51, there are two types of stolen functions – one is PolyOEP style, the other is virtualized; it can fix only the former, while the latter is used in AsProtect itself only

3) it doesn’t find CRC or envelope checks, but it can prevent one type of envelope check, which checks for E8 in jumps to API

4) it doesn’t decrypt encrypted parts or sections

5) it doesn’t find serial, fix trial etc.

6) if it has overlay, it may be broken after unpacking (for example if it needs to be in fixed offset in file or if it’s a certificate)

Bugs:
- doesn’t work with certain 1.10 variations, I will fix this when I have time

Notes:
- after unpacking files protected by AsProtect 2.x, you may need aspr_ide.dll; get it from aspack.com and modify if needed

by Hnedka

http://letitbit.net/download/6926.6f92506c265686d06475011a2/CodeDoctor_v0.90.rar.html

http://letitbit.net/download/5120.c5ff8c01bf87b5594de7f4fbc/Themida___WinLicense_1.1.0.0___2.1.0.0_Dumper___IAT_Repair___CodeEncrypt_Repair_v2.6.0.txt.html

http://letitbit.net/download/3316.36752f6bb46e115cd0783f9ce/Scripad_v1.0.rar.html

http://letitbit.net/download/8134.80ce16ba4868818583ea8d745/ODbgScript_v1.77.3.rar.html

This plugin will now require a key for it to run and be used. You can obtain a valid key by emailing: StrongOD©safengine.com
http://letitbit.net/download/9563.9f5459d00eca80b4993740279/StrongOD_v0.2.6.415.rar.html

pass :www.2baksa.net

So if I could get some input on the following that would be great.

http://letitbit.net/download/3997.d3730400452d29f3a615da1f7/HOlly_v0.2_Build_81.rar.html

By [SND]quosego

Hi all,

It’s time to make a final stand. Oreans it’s your turn now.
This package includes the following;

WL.&.TM.VM.dumper.&.IAT.CodeEnc.Fixer.v2.6.0-SnD
A script to unpack all known versions of Winlicense and Themida using any options.

The script will unpack all known Themida and Winlicense applications
using virtual machine antidump on Windows XP. (v1.8x – 2.1.0.0)

Known issues;
-Version retrieving can error, switch it off when neccesary.
-VM oeps are not always retrieved you must rebuild or find them yourself.
-Memory loaded dll’s are not dumped.
-The script stops after asking for the new antidump locations, just resume the script when it does.

Usage;
Step 1: Unpack an application using this script.
(Start at system entrypoint, EP break must be available,
no other breakpoints)
Step 2: When neccesary attach the dumped VM. Fix VM oep.
Step 3: Dump and Imprec.

Always read the log it holds vital information. Also there are several options that can be modified in the first few lines of this script.
Tinker with it if it doesn’t unpack your app.

The.Oreans.(Themida&Winlicense).VM.antidumps-Q
An article covering all antidumps, including more newer ones.

Running.Winlicense.Protected.Applications.Without.Licenses-SND
An article on how to run Winlicense protected apps without licenses.

I owe my gratitude to the whole of the webscene for support,
inspiration , ideas and the supply of information/executables.

Especially;

-A lot of suppliers.
-ARteam for being rumored to be the first to have found the first antidumps.
-An unnamed American.
-Lena for showing so many people the way.
-Teddy, for supplying us tuts4you.
-Team SND old and new members.

And most of all just have fun with this all. Use it for knowledge, the challenge and fun.
Monetary gain is never to be aspired.

regards,

http://letitbit.net/download/2216.28c286be4bac9432d2fd791f9/tmd.rar.html