ExeinfoPE v.0.0.3.4 Beta2 696 sign/Ext_Detector v.1.1.0

EXEInfo for Win32 by ASL Packer, Compressor Detector / unpack info / Internal Exe tools

ExeinfoPE v.0.0.3.4 Beta2 696 sign - for Beta Tester only not for usage ( with NAG )

Total not tested version , possible nonSense diagnose !!! , many signatures modified

fixed :

- file scaner changed ( ex. VMProtect ) Faster scan 
- compiler detector - add Cygwin - detect console app
- fixed detection for 2 section dll    *generic check - Microsoft Visual C# / Basic.NET / MS Visual Basic 
- Fixed - inteli check : MINGW - Bloodshed Software ( www.bloodshed.net )
- StatWin GUI - MD5 copy to clip fixed
- Copy As .bak - close removed and .ext fixed / path
- Rename file - fixed path and txt 
- added detection for : Private exe Protector v.4.1.2
- rar ripper file names changed to Hex "XX-rip.rar"
- rar added pass info : NOT EXE - its archive - .RAR >  Used : [ Password needed - HEADER Crypted ]
- Export view fixed
- added : LE - Linear Executable ( VxD driver Win 3.x / Dos Ext. /  OS/2 ) - mixed 16/32 bit

and more


new sign :

681. InstallIQ - 2012-2013 InstallX, LLC  [ MS C++ v.xx ] - www.installiqlearnmore.com
682. ToolBelt Installer - www.?????.com - Microsoft Visual C++ 9.0 - Visual Studio 2008
683. ( UPX 3.x modified ) Softonic Downloader - PUA / Adware / Downware - www.softonic.com*
684. Google Installer  www.google.com -  Microsoft Visual C++ ver. 8.0 / Visual Studio 2005
685. Squeez Sqx Archive Selfextractor v.5.63 SQ5SFX overlay - www.speedproject.de/enu/support/updates.html( Upx / not Upx )
686. Adobe Flash Player v11.x - www.adobe.com - Microsoft Visual C++ 9.0 - Visual Studio 2008 (E8)
687. FreeArc 0.5x -0.67 SFX stub - ovl .Arc Archive [ v0.xx ] - Dev-C++ / UPX stub
688. Tampared : Inno Setup -> [ '????' Setup v.5.1.13 ]
689. Logic Protect EXE Ceator 2.0.4 - www.logicprotect.com ( stub : Microsoft Visual C++ ver. 8.0 )
690. CodeWall 2010 v4.1.1.0 ( *trial .NET Protector ) - www.codewall.net - Microsoft Visual C# / Basic.NET
691. Private exe Protector v.4.1.2 (30.01.2013)  - www.setisoft.com
692. Private exe Protector v.4.1.2 *Trial- DLL - (30.01.2013)  - www.setisoft.com
693. Kaspersky AV Pack  ( exe/dll ) - www.kaspersky.com    *ACM
694. InstallAware DRM ( Trialware Creator )  Copyright 1998-2009 Softwrap Ltd.
695. [.NET source exe ] - InstallAware DRM ( Trialware Creator )  Copyright 1998-2009 Softwrap Ltd.
696. Themida/Winlicense v.2.1.0.0 ( std mode ) -> Oreans Technologies - www.oreans.com  *ACM

A.S.L.

 Full Version with Skins and all updates | Beta Version | Mirror

Homepage: http://exeinfo.atwebpages.com/
News on Facebook Fan page: https://www.facebook.com/pages/Exeinfo-Pe/157540614382356
Latest Final Version: http://www.woodmann.com/collaborative/tools/index.php/ExeInfo_PE
http://www.exeinfo.antserve.com/exeinfope.zip

UPX 3.91 has been released with 64bit support

UPX 3.91 has been released. Changes include

• experimental support for Win64/PE

To know more about this release, see the detailed changelog. Please report all problems and bugs in our bug tracker.

UPX achieves an excellent compression ratio and offers very fast decompression. Your executables suffer no memory overhead or other drawbacks for most of the formats supported, because of in-place decompression. UPX strengths in a nutshell:

• excellent compression ratio: typically compresses better than WinZip/zip/gzip, use UPX to decrease the size of your distribution!
• very fast decompression: ~10 MB/sec on an ancient Pentium 133, ~200 MB/sec on an Athlon XP 2000+.
• no memory overhead for your compressed executables because of in-place decompression.
• safe: you can list, test and unpack your executables. Also, a checksum of both the compressed and uncompressed file is maintained internally.
• universal: UPX can pack a number of executable formats.
• portable: UPX is written in portable endian-neutral C++.
• extendable: because of the class layout it's very easy to add new executable formats or new compression algorithms.
• free: UPX is distributed with full source code under the GNU General Public License v2+, with special exceptions granting the free usage for commercial programs as stated in the UPX License Agreement.

You probably understand now why we call UPX the "Ultimate Packer for eXecutables". UPX aims to be commercial quality free software, based on experience with our previous packers (DJP, lzop, and the NRV library).

Homepage: http://upx.sourceforge.net/

 upx391w.zip

Good GUIs:

Free UPX: http://www.pazera-software.com/download.php?id=0022&f=Free_UPX.exe

UPX 3.08 executable packer

UPX is a portable, extendable, high-performance executable packer for several different executable formats, including Windows and Linux executables and DLLs. It achieves an excellent compression ratio and offers *very* fast decompression.

UPX 3.08 has been released. It is a minor 3.0x maintenance release to version 3 whose major additions were:

optional LZMA compression
support for BSD systems

Changes in 3.08 (12 Dec 2011):
* Fix allocation in runtime stub for darwin.macho-entry (i386 and amd64).
* Compress shared library on ELF i386 only [ld.so threatens even this case].
* Attempt to support ELF on QNX 6.3.0 for armel (experimental).
* Better diagnostic when ELF -fPIC is needed.
* PT_NOTE improvements for *BSD.
* Preserve more ELF .e_flags on ARM.
* Minor code improvements for ELF stubs.
* Defend against another flavor of corrupt PE header.
* bug fixes

Homepage



Extras:

UPX Graphical 1.39
Graphical GUI incl UPX 3.07 and a scrambler. Support Drag & Drop and context-menu.
- Homepage -

Free UPX 1.5
Free UPX is an advanced graphical interface for the UPX. It offers easy access to all documented and undocumented UPX parameters without the need for command line usage.
- Homepage -

Get one from 10 Licenses for Revo Uninstaller Pro

Revo Uninstaller Pro helps you to uninstall software and remove unwanted programs installed on your computer easily! Even if you have problems uninstalling and cannot uninstall them from "Windows Add or Remove Programs" control panel applet.

Revo Uninstaller is a much faster and more powerful alternative to "Windows Add or Remove Programs" applet! It has very powerful features to uninstall and remove programs.

• No more stubborn programs
• No more installation errors
• No more upgrade problems
• Remove programs easily

With its advanced and fast algorithms, Revo Uninstaller Pro analyzes an application's data before uninstall and scans for remnants after the uninstall of a program. After the program's regular uninstaller runs, you can remove additional unnecessary files, folders and registry keys that are usually left over on your computer. Revo Uninstaller Pro offers you some simple, easy to use, but effective and powerful methods for uninstalling software like tracing the program during its installation.

Revo Uninstaller Pro has a very powerful feature called Forced Uninstall. Forced Uninstall is the best solution when you have to remove stubborn programs, partially installed programs, partially uninstalled programs, and programs not listed as installed at all!

To remove a program completely, and without leaving a trace, you can monitor all system changes made during its installation, and then use that information to uninstall it with one click only – simple and easy!

Sothink SWF Decompiler Review and a License for Windows and MAC to GiveAway & Discount 30% Off Special offer for our readers

Lost your flash project file or just want to edit or extract elements from an animated flash file. All these can be easily done with Sothink SWF Decompiler. As one of the first Decompiler for SWF, Sothink can even decompile nearly all flash files created with 3th party tools including IncrediFlash and many more where most other Decompiler for SWF failed to work. Furthermore within a few clicks you can convert SWF to HTML5. Flash inside exe files can be extracted as well.

The Program can be switched from English to German, Italian, French, Chinese and Korean Language.
A live preview of the original Flash file as well as the edited flash next to detail info view in an easy to operate interface which supports drag'n drop are only a few highlights of this excellent software.
Download latest v6: Sothink SWF Decompiler 6.6 Build 4013
Read more about the features
Samples
Visit the Forum

Sothink SWF Decompiler is available for MAC and Windows.

A special offer to our readers, purchase SWF Decompiler for Mac or Windows now with 30% Discount using this Coupon code: SuM3p42D


Together with Sothink we give away one License with full support and product updates for the Windows Version and one for the MAC version.

A free 30-Day Trial Version can be downloaded on the Homepage.

To join this contest and win a License:
Download and install the software.
Decompile/Edit any flash file as shown in this sample and upload it (for example to http://dropdo.com/, http://minus.com/, http://www.megaswf.com/, or any other file host). To save the edited file use the old version 4.5 (register with this link)
Include the link of the original Flash file and your edited/modified flash file in your comment. Tell us if you want to win Sothink SWF Decompiler for Windows or MAC.
Optional share this news on Forums, Personal Blogs and Follow us on Twitter/Facebook.

We draw random from all comments which fulfill the requirements a winner of a license for Windows and one for the MAC version.

PESpin Freeware PE-File Compressor/Protector

PESpin is a Windows executable files (EXE, DLL) protector, compressor coded in pure assembly using MASM. It allows compression of the whole executable - code, data and resources, leaving them executable and protects against patching and disassembling.

Changelog:
- v1.33 - x32
+ added support for vs2010 files
+ minor bugs fixed

- v1.21 - x64
+ fixed DLLs compatibility with IE9
+ minor GUI changes

- v1.2 - x64
+ added password protection
+ added overlays handling

Compatibility with Windows® XP/Vista/7

Screenshots
Homepage + Downloads

We write here about an Executable Packer which is not often used. A high False Positive rating from most AV's is suspected as well as related Tools such as WOT rating might be low. Most AV's can not unpack the file and/or files packed with it and therefore not scan inside the binaries so they flag it falsely as Virus.

Analysis Reports PESpin.exe 32bit (the behavior is harmless - no online connections - but mirrors that many AV's are wrong reporting as Trojan): Anubis | CWSandbox | ThreatExpert

Bitsum PeCompact had similar problems with false positive and wrote on his page if you are a Security Company and need assistance to scan inside the compressed modules - support help will be provided.
PeCompact will be as well one outstanding ExePacker to make files smaller but cause of unwanted malware authors who abuse such tools the distribution have been limited.
It will be great if all AV's implement unpacking support to scan inside packed exe/dll/ocx files and reduce the large number of false positive alerts instead of flag all files falsely as Viruses.

UPX 3.08 x64 for Windows and 32bit binaries

A 64 bit executable of UPX in Version 3.08 Dev have been released next to a traditional 32bit version.

Homepage and program description

If you are not so familiar with command line parameter tools, there exists a great GUI which supports almost all switches and parameters from UPX: Free UPX 1.4
Support for the 64bit version can be implement if you replace the upx.exe in Free_UPX folder with the 64bit one.

Compressing 64 bit windows executables is not supported yet. It will show an error message "can't pack new-exe."

Dev Log
Summary log
Discussion

Downloads UPX 3.08 Dev:

x86: upx308w-dev.zip
x64: upx308w-x64-dev.zip

UPX Graphical 1.39 Freeware from Dirk Paehl

Graphical GUI incl UPX 3.07 and a scrambler.

Support Drag & Drop and context-menu. With many further information. UPX. NO external program required. UPX is a very good exe compressor and opensource freeware. With this scrambler you can't unpack the exe with upx any more. With German manual.

New: You can choose between external (DOS-Windows) or an internal output, Result after compression. You can choose an external UPX.EXE or the internal.

Homepage

| DDL | Mirror

A.S.L released ExeInfo PE in Version 0.0.2.9

ExeInfo PE ver. 0.0.2.9 by A.S.L ( c ) 2006.03 - 2011

freeware version for Windows XP

Windows 32 PE executable file checker, compilators, exe packers ....

with solve hint for unpack / internal exe tools / rippers

Sometimes it can be happen that you downloaded a file with a wrong file extension. For example an .avi as .zip without its packed or alike. This tool can identify a wide range of different file types, show how they are made, if exe packers are used and give you hints how to unpack them.

ExeInfo Pe can display an incredible variety of technical information about a file background.
Exeinfo can do much more then analyse for example extract embedded Graphics or Flash from an exe, search websites/urls inside an executable and so on.

ExeInfoPE shows if a file have a digital certificate and if the file is untouched the signature will show the digital certificate is ok.

It is great for analyzing false positive Virus alerts. Packed, compressed exe files have a high false positive rate. Exe packers if they are used to make files smaller such as MEW, FSG,... results in some AV's so called false positive. If you unpack these files, the false positive alerts will be gone.

The new version of ExeInfo PE supports custom program skins and the GUI can be switched to a bigger screen mode.

Homepage: www.exeinfo.xwp.pl

Download: http://www.box.net/shared/y58pzheb9i

exeinfope_0.0.2.9.zip (616.91 KB)

DDL: http://ExeInfoPE.4shared.com

diablo2oo2s Universal Patcher [dUP] 2.21

diablo2oo2's Universal Patcher [dUP]
************************************
Version: 2.21

Features:
-multiple file patcher
-programmable patching procedure
-create Offset and Search&Replace patch/loader
-compare files (RawOffset and VirtualAddress) with different filesize
-text patcher
-registry patcher, also for loaders
-attach files to patcher
-get filepaths from registry
-usage of CRC32 and filesize checks
-patching packed files
-compress patcher with your favorite packer
-saving projects
-use custom skin in your patcher
-add music (Tracker Modules: xm,mod,it,s3m,mtm,umx,v2m,ahx,sid) to patcher
-multilanguage support
-and many more...


Version History
---------------
[2.21]
-new option to keep original file time and date
-new option to disable the WOW64 File System Redirector (for 64 Bit Patching)
-new option to import multiple file attachments
-new: tooltip for bytepattern shows now also the ASCII text of the bytepattern
-bugfix: inline patching should now also work on windows 7
-bugfix: improved inline patching method
-text patch: single wildcards (?) will not be cut out any longer at end and begin of the 'Find Text'
-added new "Registry Check" module
-improved access to 64 Bit registry (small bugfix)
-improved menu structure of dup2 gui (adding patchdata is now easier)
-bugfix: crash when open project
-new option for the project: run patch with administrator rights

Homepage

http://diablo2oo2.di.funpic.de/downloads/?C=M;O=D

Universal Extractor 1.6.1

Universal Extractor is a program designed to decompress and extract files from any type of archive or installer, such as ZIP or RAR files, self-extracting EXE files, application installers, etc.

Homepage: http://legroom.net/software/uniextract


Portable

diablo2oo2's Universal Patcher [dUP] 2.21 Beta 2

diablo2oo2's Universal Patcher [dUP]
************************************



dUP Version: 2.21

Features:

-multiple file patcher
-programmable patching procedure
-create Offset and Search&Replace patch/loader
-compare files (RawOffset and VirtualAddress) with different filesize
-text patcher
-registry patcher, also for loaders
-attach files to patcher
-get filepaths from registry
-usage of CRC32 and filesize checks
-patching packed files
-compress patcher with your favorite packer
-saving projects
-use custom skin in your patcher
-add music (Tracker Modules: xm,mod,it,s3m,mtm,umx,v2m,ahx,sid) to patcher
-multilanguage support
-and many more...


Version History
---------------
[2.21]
-new option to disable the WOW64 File System Redirector (for 64 Bit Patching)
-new option to import multiple file attachments

[2.20]
-added wildcard support for textpatch module
-windowresize bugs fixed
-minimize patcherwindow with rightmouseclick
-added new "Event" module for patcher. Now you can programm your patcher!
-added new "File Check" module for patcher
-bugfixes in textpatch module
-bugfix: executing attached files
-bugfix: problem with nested environment variables
-bugfix: tooltips will be shown without flicker effect on windows 7
-bugfix: increased pattersize limit for search & replace compare module
-fix: remove quotation marks from paths when reading fom registry

Homepage: http://navig8.to/diablo2oo2



http://diablo2oo2.di.funpic.de/stuff/

Exeinfo PE 0.0.2.8 by A.S.L. 574 sign (Testversion)

ExE info PE v0.0.2.8 by A.S.L. 574 sign (Testversion)



Homepage: http://www.exeinfo.xwp.pl/ | http://users.cjb.net/exeinfo/

PROTECTiON iD 6.4.0

PROTECTiON iD v6.4.0

Features

- detection of every major PC ISO Game / Application protection
- currently covers 499 detections, including win32/64 exe protectors & packers, .net protectors, dongles, licenses & installers
- sector scanning CDs / DVDs for Copy Protections
- files / folders can simply be drag & droped into pid
- strong scanning routines allowing it to detect multiple protections
- easy scanning via shell context menu
- usefully misc tools included
- coded 100% in Win32 assembly language
- fully 32bit & 64bit compliant
- working from Win9x to Windows 7

Homepage: http://pid.gamecopyworld.com/

FUU (Faster Universal Unpacker) 0.1.1 Beta

Latest changes:

FUU v0.1.1 (29/06/2010)

--

- Minor release

fixed bugs:

- Avoid the resize of the main GUI window.
- Fixed an inconsistency between the about showed in the "About" menu and the one showed in the "About" button.
- Fixed the problem with "Refresh" button.
- The open file dialog now has filter strings.
- Editbox is now editable so, you can type the path of the file.

enhancements:

- Updated the TitanEngine library (current version 2.0.3).
- Added a clickable blogspot link and email address.
- Added a save file dialog in every included plugin.
- Added "Drag&Drop" for .exe and .dll files.
- Added a "Copy Overlay Data" button.
- Added "Auto Scroll" to the browse file edit box.

code refactoring:

- Added comments to every function in the main GUI and every plugin (see SVN).
- Added a "GetControlHandles" function (see SVN).
- Improved the way we check for Windows Messages.

new features:

- Added a simple signatures identifier using PETools signatures database (thanks marciano!)
- Added three newer plugins for nPack, Packman and dePack.

522a8f08d20a43cd904b46eeb73deeb0

Homepage: http://crackinglandia.blogspot.com/

FUU v0.1 Beta - [F]aster [U]niversal [U]npacker

FUU (Faster Universal Unpacker) is a GUI Windows Tool with a set of tools (plugins) to help you to unpack, decompress and decrypt most of the programs packed, compressed or encrypted with the very well knowns software protection programs like UPX, ASPack, FSG, ACProtect, etc.

The GUI was designed using RadASM and MASM. Every plugin included in the official release was written in ASM using MASM.

The core of every plugin use TitanEngine SDK from ReversingLabs under the hood, this help to the developer to write plugins very easy and very fast without the need to worry about some repetitive and boring functions like dump, fix the iat, add sections, etc. You can develop a plugin for FUU in a very easy way using TitanEngine.

Also, FUU include some extra tools like:

* Generic OEP Finder
* Cryto Signature Detector
* Generic Unpacker
* Signatures Detector (next release)

Generic OEP Finder, Cryto Signature Detector and Generic Unpacker are from PEiD's team.

This first version is just a PoC (Proof of Concept) but will be updated very soon with many more things to make it a more interesting tool.

The idea of this tool was born from interest to test TitanEngine from ReversingLabs and see how it works and what kind of things can be done with it.

Homepage: http://crackinglandia.blogspot.com/
http://code.google.com/p/fuu


Source: FUU v0.1 Beta.source.7z

dUP 2.20 BETA 9 diablo2oo2s Universal Patcher

diablo2oo2's Universal Patcher [dUP]

Version: 2.20

Features:
-multiple file patcher
-programmable patching procedure
-create Offset and Search&Replace patch/loader
-compare files (RawOffset and VirtualAddress) with different filesize
-text patcher
-registry patcher, also for loaders
-attach files to patcher
-get filepaths from registry
-usage of CRC32 and filesize checks
-patching packed files
-compress patcher with your favorite packer
-saving projects
-use custom skin in your patcher
-add music (Tracker Modules: xm,mod,it,s3m,mtm,umx,v2m,ahx,sid) to patcher
-multilanguage support
-and many more...


Version History
---------------
[2.20]
-added wildcard support for textpatch module
-windowresize bugs fixed
-minimize patcherwindow with rightmouseclick
-added new "Event" module for patcher. Now you can programm your patcher!
-added new "File Check" module for patcher
-bugfixes in textpatch module
-bugfix: executing attached files
-bugfix: problem with nested environment variables
-bugfix: tooltips will be shown without flicker effect on windows 7
-bugfix: increased pattersize limit to 1024 bytes for search & replace compare module

BBS: http://mp2kforum.mp.funpic.de
Homepage: http://navig8.to/diablo2oo2

http://diablo2oo2.di.funpic.de/stuff/dup2.beta.rar

EXEForger (SignsImitator) 1.0.40.10

The utility replaces the signature and ident issue for any sign from the list.


EXEForger (SignsImitator) 1.0.40.10
Author: STRELiTZIA.
Release date: April 2010.
Type: RCE Tool.

--------------------------
False positive:
Check MD5 and SHA1 at www.delphi4arab.com or www.at4re.com
--------------------------
Version 1.0.40.10 [04/2010] BETA 01 (Test release)

- EXEForger - New name.
- Add Anti fake signature detector
- Add Fake linker
- Add Fake subsystem
- Add Random section name
- Windows Vista / Seven support

Version 1.0.20.08 [01/2008]
- Bug fixed: Crash if no padding after last section
- Add false signs for All programs [See the tested files]
- .Net not supported
- Add false signs in packed programs [See the tested files]

Version 1.0.10.08 [10/2007]
- First public release (Test release)
- Add false signs only for Delphi programs
- Use All PEiD Data base

Greetz:
Arab Team 4 Reverse Engineering - www.at4re.com
Delphi4Arab - www.delphi4arab.com

Homepage: http://qunpack.ahteam.org/
EXEForger_(SignsImitator)_1.0.40.10.rar 298.34 KB

UPX 3.05 — the Ultimate Packer for eXecutables

UPX — the Ultimate Packer for eXecutables

UPX is a free, portable, extendable, high-performance executable packer for several different executable formats. It achieves an excellent compression ratio and offers very fast decompression. Your executables suffer no memory overhead or other drawbacks for most of the formats supported, because of in-place decompression.

UPX Version 3.05
27 Apr 2010

UPX 3.05 has been released.
The main news in version 3 are:

* optional LZMA compression
* support for BSD systems

Changes in UPX 3.05 (27 Apr 2010):
* i386-linux and amd64-linux support shared libraries (DT_INIT must
exist, all info needed by runtime loader must be first in .text, etc.)
* Linux /proc/self/exe now is preserved by default, by leaving behind
one page. New compress-time option --unmap-all-pages is available.
* Withdraw support for shared libraries on Darwin (Apple Mac OS X)
because upx does not understand enough about .dylib.
* bug fixes

read full changelog: http://upx.sourceforge.net/upx-news.txt

Copyright (C) 1996 - 2010
Markus F.X.J. Oberhumer, László Molnár & John F. Reiser

Homepage: http://upx.sourceforge.net/

upx305w.zip — Win32 console version
upx305d.zip 32-bit DOS version

other Versions: http://upx.sourceforge.net/#download

Inno Setup 5.3.9 - innounp 0.31

Inno Setup 5 introduced a number of significant enhancements including:

* 5.0: Pascal Scripting at uninstall time
* 5.0: All-new, easier-to-use custom wizard page support
* 5.0: Expression support in Components/Tasks/Languages/Check
* 5.0: Live installation log viewing from within the IDE during debugging
* 5.1: Extensive support for installation of 64-bit applications on the 64-bit editions of Windows
* 5.2: Support for running programs with the (normally non-elevated) credentials of the user that started Setup initially
* 5.2: Automated digital signing of Setup and Uninstall
* 5.2: Improved support for right-to-left languages (Arabic and Hebrew)
* 5.3: Support for new Windows 7 features and LZMA2 compression

Inno Setup 5.3 also introduces Unicode support:

There's now a second version of Inno Setup available called Unicode Inno Setup. Key features of this version are its ability to display any language on any system regardless of the system code page, and its ability to work with Unicode filenames. One could consider Unicode Inno Setup as the new standard Inno Setup and Non Unicode Inno Setup as an old special Inno Setup for those who still need to support NT/9x or who want the very smallest size possible.

Changelog: http://www.jrsoftware.org/files/is5-whatsnew.htm

HP & Download: http://www.jrsoftware.org/isdl.php

innosetup tool: http://downloads.sourceforge.net/istool/istool-5.3.0.1.exe

innounp - the Inno Setup Unpacker
Unpacker for installations made by Inno Setup
innounp Version 0.31
Supports Inno Setup versions 2.0.11 through 5.3.9

Homepage: http://innounp.sourceforge.net/
Download: http://sourceforge.net/projects/innounp/files/