Утилита подменяет сигнатуры и позвоялет выдавать за любую сигну из предложенного списка.

EXEForger (SignsImitator) 1.0.40.10
Author: STRELiTZIA.
Release date: April 2010.
Type: RCE Tool.

-------//-------------------
False positive:
Check MD5 and SHA1 at www.delphi4arab.com or www.at4re.com
-------//-------------------

Version 1.0.40.10 [04/2010] BETA 01 (Test release)
— EXEForger <- New name.
— Add Anti fake signature detector.
— Add Fake linker.
— Add Fake subsystem.
— Add Random section name.
— Windows Vista/Seven support.

Version 1.0.20.08 [01/2008]
— Bug fixed : Crash if no padding after last section.
— Add false signs for All programs [See the tested files]
— .Net not supported.
— Add false signs in packed programs [See the tested files]

Version 1.0.10.08 [10/2007]
— First public release. (Test release)
— Add false signs only for Delphi programs.
— Use All PEiD Data base.

-------//-------------------
Greetz :
Arab Team 4 Reverse Engineering <<-- www.at4re.com
Delphi4Arab <<-- www.delphi4arab.com

Инструмент для анализа строк. Помощник в поиске строк исполняемых файлов.
v1.3
+'Patch References with SNK *only*' button added
*sometimes using 'SNK checked references' lock the assembly — fixed
v1.2j
+'vaccination' form — buttons added
+new button 'SNK checked references (8 bytes patch)'
+In 'SnR manifest' form — button added
+'Conversions' form added
+2 new context items — 'Copy PublicKey HEX' + 'Copy SNK PublicKey HEX' (no more space on form for a button!)
*ildasm switch 'unicode' enabled (drpcputte)

know issue (cant fixed) :
when compile IL , sometimes when ilasm failed , program freeze

v1.05
+new button 'Remove Strong (byte method)'
+new button 'Remove Strong + NULL References (byte method)'
+new button 'Search manifest for PublicKeyTokens (byte method)', enables search&patch the manifest for references (no more HEX SnR)
+new button 'NULL checked references' (byte method)
+new button 'Merge assemblies' (ilmerge.exe)
+new button 'Compile IL' (ilasm)
+main listview new context-items added 'Export IL code' (ildasm) , 'Identify Protector' (Rongchaua) , 'Deobfuscate' (Rongchaua) , 'Point File'
+resource listview new context-items added 'remove resource (s)' + 'replace resource' + 'rename resource'
*Now can extract resource with unprint char (s)
*[code] resources list function (better way)
*minor fixes

Свершилось долгожданное событие. Разработчики приняли решение опубликовать версию Quick Unpack 2.2. Проект теперь продолжается нашими друзьями — командой tPORt.

Вот список основных изменений:

[!] исправлены многие ошибки и сделаны улучшения, например, ускорена обработка импорта
[+] дельта для RDTSC теперь влияет и на GetTickCount
[+] обновлен Lua до 5.1.3
[+] обновлен generic OEP finder от UsAr
[+] модифицирован generic OEP finder от Human для нахождения OEP в DLL
[+] модифицирован generic OEP finder от deroko для нахождения OEP в DLL
[+] добавлена возможность сохранять лог из главного меню
[+] добавлена поддержка разных языков, достаточно создать свой lng-файл и подключить его в окошке preferences
[+] добавлено восстановление таблицы инициализации для Delphi. Следует включать только при уверенности, что программа написана на Delphi
[+] добавлено несколько новых функций и переменных для скриптов
[+] немного изменён хук RDTSC, при установке в дельте старшего бита, дельта высчитывается самостоятельно

Видео по распаковке RLPack

so today I want to post my new script which can fix RLPack´s 1.21 VM`d code back to the original code.
So I have test some 1.21 UnpackMe´s and protected app´s which I have found and I've seen some diffrent
VM routines which are the same.
I also have made a fresh movie how to unpack the main RLPack 1.21 exe itself.

Please read it carefully before complaining:
1. OllyDbg 2.0 is rewritten from scratch.
2. No, plugins are not yet implemented.
3. Yes, they will be implemented again — presumably in v2.02.

The second beta. I've planned that it will come with the more or less complete help file. Unfortunately, I had no time to write it. Therefore there will be also the third beta release... soon.
There are many — over 20 — bugfixes in the beta 2, some of them are really critical. As promised, there are no significant changes, with two exceptions. The recognition of UNICODE strings is vastly improved, they are no longer limited to ASCII subset (option «Use IsTextUnicode ()». Also I recognize strings in the UTF-8 format. By the way, if you have some small sample program with the free source that uses UTF-8 strings, please send it to me (together with the screenshot of displayed strings) so that I will be able to test OllyDbg.
The second new feature is in the run trace. New option «Pause when EIP points to modified command» helps, for example, to find the real entry point of the SFX-ed code. Just don't forget to create backup first (or use another new option, Auto backup user code)!

Download OllyDbg 2.0 beta 2 (1401)

Свеженькие скрипты ODBGScript для распаковки последних версий ASProtect.

Восстановление таблицы IAT и вызовов APIs.osc

Восстановление таблицы IAT и инструкций вызовов переадресованных APIs
Разработан — vnekrilov
Дата — 01 декабря 2008
Установить флажки на все исключения отладчика
Удалить все установленные breakpoints
Скрипт тестировался только на WinXP, OllyDbg 1.10, ODBGScript 1.48 (эта версия plugin корректно обрабатывает ассемблирование инструкций)
Поддерживает Asprotect 1.32, 1.33, ,1.35, 1.4, 2.0, 2.1, 2.11, 2.2beta, 2.2, 2.3, 2.4, 2.41

Восстановление таблицы INIT.osc

Восстановление таблицы INIT
Разработан — vnekrilov
Установить флажки на все исключения отладчика
Удалить все установленные breakpoints
Тестировался только на WinXP
Поддерживает Asprotect 1.32, 1.33, ,1.35, 1.4, 2.0, 2.1, 2.11, 2.2beta, 2.2, 2.3, 2.4, 2.41

Поиск прыжков из кода в область Stolen Code и восстановление эмулированных инструкций.osc

Поиск прыжков из секции кода в области Stolen Code и восстановление эмулированных инструкций в областях Stolen Code
Разработан — vnekrilov
Дата — 01 декабря 2008
Установить флажки на все исключения отладчика
Удалить все установленные breakpoints
Скрипт тестировался только на WinXP, OllyDbg 1.10, ODBGScript 1.66.3 (эта версия plugin корректно обрабатывает ассемблирование инструкций)
Поддерживает Asprotect 1.32, 1.33, ,1.35, 1.4, 2.0, 2.1, 2.11, 2.2beta, 2.2, 2.3, 2.4, 2.41

Прохождение на OEP_SBOEP.osc

Прохождение на OEP_SBOEP
Разработан — vnekrilov
Дата — 01 декабря 2008
Установить флажки на все исключения отладчика
Удалить все установленные breakpoints
Скрипт тестировался только на WinXP, OllyDbg 1.10, ODBGScript 1.48 (эта версия plugin корректно обрабатывает ассемблирование инструкций)
Поддерживает Asprotect 1.32, 1.33, ,1.35, 1.4, 2.0, 2.1, 2.11, 2.2beta, 2.2, 2.3, 2.4, 2.41

Автор: vnekrilov

Download ASProtect unpacking scripts by vnekrilov (2402)

SecurePE — бесплатная утилита, которая защищает PE файлы паролем с RC4 шифрованием. Попробовать стоит, хотя на malware неплохо б и проверитэтот продукт

SecurePE is a user friendly freeware utility coded in 32bit assembly language that protects Microsoft Windows® PE files with a password, strong RC4 encryption and checksum while leaving them totally functional.

SecurePE user-friendly interface supports both drag & drop and shell operation of Windows Explorer. So you can protect files easily with a mouse click.

When a protected file is executed it displays a dialogbox asking the user for the correct password. The password is not stored in the file but a CRC32 hash algorithm. You must remember the password or you will not be able to execute the protected program again until you restore it from a backup. With the correct password you can run the program and even deprotect the file and give back it to its original state.

Unlike other protection utilities you may copy SecurePE protected files to another computer and it stays protected and functional without the need of re-protect the file again no matter what operating system this computer runs.

At last, but not at least, SecurePE has a checksum routine that detects any manipulation in the PE Header of the protected files.

Changelog

Version 1.6

-Added: Support for x64 based systems.
— Added: Windows Vista UAC compliant.
— Added: Show/Hide password while typing.
— Improved: Some minor tweaks.

Notice: SecurePE v1.6 is no longer compatible with old versions so you need to deprotect your files, desinstall old version, install 1.6 and protect them again.

Version 1.5

-First stable version.

Versions 1.0b to 1.4b

-Initial beta releases.

Универсальный распаковщик программ от китайских разработчиков. Конкурент Quick Unpack.

Отзывы противоречивые.

General-assisted shell tool
GUnpacker-assisted shell tool is that it has two main functions:
1. OEP positioning
2.Dump been decrypted code and data can be used to repair the follow-up of PE

At present, only in my own machine with a number of tests done Shell (which will support the concrete shell, I do not know ^_^), for the time being no bug,
Therefore, made up hope that we try to help, such as found in the shell can not support or bug, that keep abreast of trouble, or send e-mail to hi.gunpacker @ gmail.com [code] format is as follows:

Operating System: WinXp sp2
Shell name: UPX
Version: 0.89
Results: The success of the shell or other failure of the shell:

Upload Attachment:
The following is a rough, I tested through the list of the shell, the shell for protection, it is possible to position FakeOEP:
eXPressor 1.4.5.1
RLPack 1.1
ACProtect 1.09,1.32,1.41,2.0
EXECrypt 1.0
ASProtect 1.1,1.2,1.23 RC1, 1.33,1.35,1.40, SKE .2.11, SKE .2.1, SKE .2.2,2.3.04.26,2.4.09.11
PELock 1.06
SDProtector 1.12,1.16
SVKP 1.32,1.43
PE-Armor 0.46,0.49,0.75,0.765

AHPack 0.1
SimplePack 1.0,1.1,1.2
PE Cryptor 1.5
UPX All
EPPort 0.3
JDProtect 0.9,1.01,2.0
UPC UnKown
PEncrypt 4.0
PECompact 1.x
teLock All
UPolyX 0.5
WinKript 1.0
PolyCryptA UnKown
Hmimys Packer UnKown
FSG 1.33,2.0
Beria 0.07
ASPack All
Mpress UnKown
Packman UnKown
MEW 11 1.0/1.2
PEtite 2.3
Bero 1.0
BJFNT 1.2
DragonArmor 1.0
eXe32Pack 1.42
eXeStealth 2.64,2.73,2.76
MaskPE 1.6,1.7,2.0
MKFpack 1.0
Mucki 1.0
NCPH 1.0
PCShrink 0.71
PEDiminisher 0.1
PKlite32 1.1
Rubbish 2.0
V2Packer 0.02
WindCrypt 1.0
yoda 1.1,1.2

Note: trouble confirm the test exe or dll is the normal load.

ToDo List:
1. To identify the unknown shell
2. PE header repair and import
3. Based on feedback from users, the need to increase support for the shell

Disclaimer stated:
1. This is just a free-assisted shell tool, you should not be used for commercial purposes.
2. This is just a free-assisted shell tool from the tool directly or indirectly lead to problems, I have no responsibility.
3. I will update as soon as possible, but the energy is limited, hope that we may be excused.

Скачать с DepositFiles.com

SoftwarePassport technology expands your global sales capabilities while providing maximum protection for your digital assets.

It contains powerful features such as flexible server-based licensing and activation, trialware distribution and marketing, in-application purchasing and sophisticated country based licensing to name just a few. Altogether, they enable software publishers like you to grow revenue by:

• Exposing your products to rapidly expanding global markets,
• Identifying who is buying and using your software,
• Maximizing the lifetime value of your buyers whether they are consumers, small to mid-size businesses or enterprises, and
• Attracting new customers in lucrative and untapped markets.

Скачать с DepositFiles.com

There is support for addressing «hex / decimal», «RO / RW», «INS / OVR». Just as the Windows-application that supports «drag & drop», wheel mouse, change the font display, Tabs, bookmarks, color schemes, the opportunity to record macros and embedded calculator.

New in Version 3.3:
* Floating (modeless) Explorer window
* Simplified Options navigation (tree)
* More than a dozen new options
* Show ruler (hex or decimal)
* Functions to convert to/from EBCDIC strings
* Function to obtain user input (templates!)
* Other template improvements
* Support for Real48 (properties, templates, etc)
* Many other improvements

Feature Summary:
* Easy to use interface familiar to Windows users
* Unlimited undo (incl. cursor moves), undo changes
* Window tabs to see/jump to any open window
* Highlighter mode to remember important bytes
* Built-in calculator, integrated with macros
* Autofit, hex/decimal addresses, OVR/INS, RO etc
* Drag and drop files onto the main window
* Background searches (using low priority thread)
* Background search progress/count in status bar
* Configure all colours, save in colour schemes
* Ability to display IBM/OEM (MSDOS) graphics
* Easily change font, increase/decrease font size
* Printer margins, headers/footers etc & print preview
* Complete clipboard support: binary, ASCII, etc
* Easy to use hex/text searches with the «Find Tool»
* Address tools for fast jumps
* Compare files or parts of the same file
* Open multiple files from Open dialog/cmd line
* Full EBCDIC support (incl. cut/paste etc)
* Keystroke macros with error levels
* Continually updated properties display (tab dialog)
* Monitor/edit over 60 file/byte/numeric/date values
* 8 floating point formats, 15 date formats
* 8/16/32/64 bit integers (signed/unsigned) in decimal
* Customize toolbars, keyboard, context menus ...
* Customizable filter (Files of type) list for all file dialogs
* Hex text, Motorola-S & Intel-hex import/export
* CRC-32, CRC-CCITT, & checksum of selection
* Advanced templates handle almost any type of file
* Templates can have variable length and optional parts
* Included templates: GIF, SWF, BMP, DBF, JPG etc
* Recent files dialog stores info on up to 20000 files
* Use C-like expressions in jump tools and templates
* Unlimited bookmarks associated with a file+address
* Advanced find (& replace options) including:
* scope: to mark, to EOF, whole file, all open files
* bookmark all, replace all, alignment, wildcards/bitmask
* Edit files of more than 4 Gbytes (>2^32)

Скачать с DepositFiles.com