Reverse Engineering Blog

VB Decompiler Pro v8.3 RETAIL INCL_KEYGEN+PATCH-FFF

2012-02-11T01:40:00.000-08:00

What's new in this version:
- Calling VTable properties and methods from some form to any other
form now can be decompiled. For example if you change in Form1
property of object in Form2 - it can be correctly decompiled (Native Code)
- Parameters of object method/property is now typicle. If object
have parameters as boolean or single - it will be decompiled correctly:
single as float variable, boolean as True/False) (Native Code)
- Decompile declaration of all types of array. Multifield arrays and
arrays of object (array of Form or commandButton for example) also
supported (Native Code)
- Decompile __vbaVar2Vec, __vbaAryMove msvbvm functions
- Italian language translation
- Parsing control array index in events
- Parsing function return value (P-Code)
- Help files (English and Russian) is updated. New topics writen:
Opening file, Working with database, Saving the list of procedures,
Jump to address, The main window, Viewing of code, Decompilation from offset,
Language selection, Plugins
- Language files changed
- BugFix: Correctly calculate count of parameters in public sub's
- BugFix: Procedure analyzer and optimazer now correctly process second parameter in For command
- BugFix: Correctly process some types of VarType integer and long (Native Code)
- BugFix: Correctly detect end of some non-standard procedures in source mode (Native Code)

Download: Multiupload - Depositfiles - WUpload

VMProtect Ultimate v2.06 Incl. key

2011-03-19T18:22:00.000-07:00

VMProtect is to protect next-generation software. Protected parts of code are executed on a virtual machine, which greatly complicates the analysis and breaking the protected program. Built-in disassembler and a MAP file will allow you to quickly select the necessary parts of code to protect against hacking.

Ultimate can provide maximum protection for your application. Supports work with serial numbers, black list, virtualization and mutation of the code, protection against debugging and more.

VMProtect helps protect the software from analysis and cracking. The basis of protection is the execution of program code sections in a virtual machine. Architecture of virtual machines is radically different from conventional processors, which renders meaningless most of the tools used by hackers.

VMProtect is a comprehensive solution for protecting software. In addition to the immediate protection package, VMProtect allows you to generate and check serial numbers, limiting their duration, to limit the period of free updates and much more.

Why VMProtect?
Here are five reasons to choose VMProtect to protect your software:
Virtualization package - is the next step in the field of software protection from analysis. Most security systems encrypt the executable code and decode it when you start the program. VMProtect never deciphered the code. In the process of protecting VMProtect translates program code into code that runs on a virtual processor. A set of commands that the processor does not like the command processor x86 or x64, and changes with each protection program.
Support all file formats - VMProtect allows you to protect executable files (EXE, SCR), dynamic library (DLL, OCX, BPL) and driver (SYS).
64-bit platforms - VMProtect can protect both 32-bit and 64-bit executable files, libraries and drivers.
Support line Windows - protected files VMProtect, can run on all versions of Windows, from Windows 95.

It supports 32 and 64-bit operating systems, there is a problem with DEP and UAC.
Integrated solution for protection - VMProtect allows you to generate and check serial numbers. Rooms can be generated either manually or automatically (Web-generators). Serial numbers may be limited by the time of action, may limit the period of free updates that can be attached to the equipment. Also VMProtect can make physically impossible to execute code in the absence of serial numbers.

Support for Compilers: Delphi, Borland C Builder, Visual C / C + +, Visual Basic (native), Virtual Pascal

Supported Formats (x32 and x64): EXE, DLL, BPL, OCX, SYS

Download Now

VMProtect Ultimate 2.06 Retail Incl. Key

2010-11-29T12:21:00.000-08:00

We’ve just released version 2.06 of VMProtect. The most important feature is the merging license manager into the main VMProtect executable. The detailed list of changes follows:

New features

Added support of MinGW map files
Added support of JCLDEBUG library
Scripts: new method Clear in TPEDirectory
Scripts: new properties InputSize and OutputSize in TVMProcedure
Ultimate: Two new API functions in SDK: VMProtectBeginVirtualizationLockByKey and VMProtectBeginUltraLockByKey

Improvements

VMP files are now in XML format
Scripts are stored in VMP files as well, VMS are not used anymore
Ultimate: License Manager is moved to VMProtect interface
Ultimate: the speed of code locked to serial number is significantly improved

Bugfixes

Fixed marked detection in MinGW files
Fixed import protection bug in 64-bit files
Fixed virtualization of FILD WORD PTR [XXXX] instruction
Fixed the incorrect disassembling of PSRLW instruction
Fixed DLL Box errors with some antivirus applications

Download: http://www.megaupload.com/?d=UXEWNT7K

Mind Crypter v1.0 - by SpiderZ ~100% FUD Protection Solution~

2010-08-20T10:48:00.000-07:00

~ 100% FUD Protection Solution Provider ~

Features:

Clone File, Bind with File, Icon Changing (plus many common icons also included)

All AV's BYPASS ON RUNTIME + SCANTIME

Custom active process injection, Increase file size by Add extra bytes(mb)

In this version we used two best encryptions (RC4, TripleDES)

Stub Details:

First stub = Free (incl. with crypter)
Every time when you need stub update it will cost you 10$

Note: 1month stub protection

PRICE:

Crypter = 40$ (Incl. 1st stub)

Stub = 10$ (Every time you need)

Payment Options:

At this time we only accept Moneybookers, Western Union

Discount of 20$ If you pay through Moneybookers

INSTANT DOWNLOAD - NO WAITING!

Through bank payment? Contact me on:

VMProtect Ultimate v2.04.6 Retail

2010-08-13T20:05:00.000-07:00

VB Decompiler Pro v7.9 Incl.Keygen

2010-07-30T05:14:00.000-07:00

VB Decompiler - Decompiler is the program (EXE, DLL, OCX), written in Visual Basic 5.0 and 6.0 and disassembler programs written in any language. NET technology. As you know, programs developed in Visual Basic, can be compiled or interpreted p-code, or executable native code. Since p-code represents a high-level team, then there is a real opportunity to recover from this source code (although the names of variables and some functions will not be able to recover). VB Decompiler restores the source code from the pseudocode as close as possible to the original, so it is with some work really bring to the compiled. VB Decompiler also decompiled all forms and UserControl'y located in the file. In general, VB Decompiler - is an ideal tool for analyzing programs and is ideal in case of loss of source codes and the need to partially restore the project.

VB Decompiler is decompiler for programs (EXE, DLL or OCX) written in Visual Basic 5.0 and 6.0 and disassembler for programs written on. NET technology. As you know, programs in Visual Basic can be compiled into interpreted p-code or into native code. . NET assembly always compiled to just in time compilable IL code. Since p-code consists of high-level commands, there is a real possibility to decompile it into the source code (of course, the names of variables and some functions will not be decompiled). VB Decompiler restores source code from p-code as much as possible precisely. And after some modifications you may try to compile generated code.

If a program was compiled into the native code, restoring full source code from machine instructions is not possible. But VB decompiler can help to analyze the program even in this situation as well. It contains a powerful disassembler and emulator. This powerfull engine try to decode most assembler instructions to most likely VB commands. Of course, it fails on some optimizations of assembler code and sometimes generate not correct instructions. But at this time this is a best way to analyze native code applications.

Features:
Universal unpacking for packed applications (supported UPX, NSPack and more other popular EXE packers)
Decompiling forms (frm and frx) and usercontrols (ctl) object files
Fully p-code decompiling (with parsing opcodes to standart vb instructions, with decompile GUID objects)
"2 p-code decompiling modes (with stack parsing or without stack parsing)
Disassembling native code procedures
Disassembling native code procedures with String References and API Calls
Partially decompiling native code (using code emulation engine)
Syntax coloring in decompiled code
String reference list and search engine
Fast decompiling speed
Obfuscator for VB5 / 6 programs
Patcher for VB5 / 6 programs
Save decompiled data to single DB file
Disassembling. NET programs
Save procedures list to MAP file, IDC script or to HIEW Names file

Features:
"Universal unpacking packed applications (UPX, NSPack and many other famous EXE packers)
"Decompilation forms (frm and frx) and usercontrol'ov (ctl)
Full decompile p-code into the source-like code (including decompile GUID objects)
"3 mode decompilation p-code (in the processing stack, without processing and function of the analyzer procedures followed by the simplification and improvement of its code readability)
"Disassembling native code (using powerful Pentium Pro disassembler)
"Syntax Highlighting in the decompiled code
"Partial decompile Native Code'ovyh structures
"Indexing the rows found in the decompiled code and features quick search strings
"High-speed decompiling
Obfuscator for VB5 / 6 programs
"Possibility of a patch for VB5 / 6 programs
"Saving the decompiled result in database
"Disassembling. NET code
"Saving the procedure name in the MAP file, IDC script or file HIEW Names

OS: Windows 95/98/ME/2k/XP/2003/Vista/2008
Interface: English

Download Now

AnalyzeThis+ 0.24

2010-02-07T00:56:00.000-08:00

I made some improvements to AnalyzeThis mainly to analyze a memory section which originally reports "this section is not associated with any module".
....
Sometimes (especially when dealing with packers) you may need to run OllyDbg's code analysis function, only to find it's not available to you because the EIP is currently outside the code segment as defined by the PE header. AnalyzeThis! is an OllyDbg plugin to allow OllyDbg's analysis function to operate outside of the marked code segment, by telling OllyDbg the current segment *is* the code segment.

Caveats: OllyDbg can only store one analysis table, so if you analyze a new segment, it will remove any existing analysis that has been done.

Source code has not been included; not because I don't want to release it at this time, but because I can't find it offhand. If you really need it, email me and I'll look harder for it.

Download: http://www.megaupload.com/?d=6WFPOMED

StrongOD 0.2.9.561

2010-02-07T00:53:00.000-08:00

This will be a seperate download of StrongOD as of version 0.2.4.350 because - as strange as it sounds - the developer has protected it!

This plugin will now require a key for it to run and be used. You can obtain a valid key by emailing: StrongOD©safengine.com

Download: http://www.megaupload.com/?d=XWGTG9BB

VMProtect 1.7 - 2.0 (Unpacking) by LCF-AT

2010-02-07T00:48:00.000-08:00

As I promised here comes the next movie tutorial and a updated script which now also supports VMProtect 2.0. As always you can see in the movie how to use it correctly. My unpack target which I have selected was the VMProtect 2.0 Ultimate itself [Demo] version. I also declare you how to rebuild the OEP in this target. Moreover you will see a second show movie about the VMProtect 2.0.1.2 itself which I also unpacked. This version has some more features than the Ultimate version.

So I fixed also some small bugs in the script and added some more functions. So read all messages which you get with attention before you press a button. For VMP 1.8 - 2.0 you can choose the API TRACER to get all needed addresses, dwords,api´s, module infos into a new file. The trace process can take a longer time if you work with a low system so for this problem I have added the possibility that you can always cancel the current process. Just stop the script if you want... if you then restart Olly and the script then it will work further from the last stop.

Some words to the "PE Header Fixing". This you will need for example for the VMProtect 2.0.1.2 itself so till now it was the only target which I have found which used this protection but I added the fix function also now in the new script. Just use it if you need it.It can also prevent some "File corrupted!...." messages. If you get still this message after fixing the PE then your target can also use some CRC checks.

Download: http://www.megaupload.com/?d=XBQYAZF6

VB Decompiler Pro v7.7 Retail - Incl. FFF-KEYGEN

2010-01-12T12:21:00.000-08:00

DOWNLOAD NOW

VMProtect Ultimate 2.03 - Cracked

2010-01-08T01:12:00.000-08:00

PEBrowse Professional Interactive 9.3.1

2010-01-01T01:45:00.000-08:00

PEBrowse Professional Interactive (v9.3.1) is a debugger for Microsoft Windows 2000, Windows XP, Windows 2003, and Windows Vista32.

Changes since V 9.3
- Fixed kernel object display and added missing types in Windows 7
- Enable thread suspend, resume and terminate while debuggee is not stopped
- Enable zero-register and call-thru register displays
- Added dialogbox to minidump creation process
- Fixed for critical section display on OSes Win2003 and greater.
- Additional information for more kernel objects.
- Fixed session files storing incorrect executable names and settings.

Download: http://www.smidgeonsoft.com/download/PEBrowseDbg.zip

PROTECTiON iD v6.3.5

2010-01-01T01:40:00.000-08:00

Features

- detection of every major PC ISO Game / Application protection
- currently covers 475 detections, including win32/64 exe protectors & packers, .net protectors, dongles, licenses & installers
- sector scanning CDs / DVDs for Copy Protections
- files / folders can simply be drag & droped into pid
- strong scanning routines allowing it to detect multiple protections
- easy scanning via shell context menu
- usefully misc tools included
- coded 100% in Win32 assembly language
- fully 32bit & 64bit compliant
- working from Win9x to Windows 7

v6.3.5

hello folks!

We are proud to present you the next and most up2date version of protection id.
it was about time to bring this to the public, as the last version was released back in march.

During development of this version we ported it over to MASM v10,
using the latest compiler & linker available at the moment.

This version of pid features highly optimized scanning routines, resulting in very fast detections.
i.e. a 2 GB setup.exe in processed in less then 1 second (smart mode kicks in). We tweaked nearly all scans to benefit from our new procs.

Download: ProtectionID_v6.3.5.rar

P32Dasm v2.6

2010-01-01T01:37:00.000-08:00

i prepare for you some Christmas gift - new release of P32Dasm :-) This release add some powerful features that allow you to analyze VB5/6 apps more detailed. More objects/classes are resolved, more procedures are identified with their real names, in some cases of .ocx, .dll files also added parameters with real names and types plus additional information as Enumerators, Constants, Events and Properties. So a lot of work was done here and i hope you enjoy this release. Your best tool for reversing VB5/6 apps is ready to use :-)

2.6 - [24.12.2009] - Christmas Release
+ Added procedure names identification
+ More objects recognition
+ Added reading more details (Enumerators, Constants, Events and Properties)
+ Added new Events icon for better resolution
+ Internal code tidy up and changes for displaying better debug info
+ More procedures details identified on some strange type apps (NCode)
- Removed displaying of procedure names list in output (moved to real names)
* fixed working of MRU files
* Fixed bug: missing end address in one procedure NCode object
* Fixed some GUI problems when app use visual styles

Download:
http://progress-tools.110mb.com/p32dasm.zip

DataRescue IDA Pro Advanced 5.5 with Hex Reys Decompiler 1.1

2010-01-01T01:30:00.000-08:00

What's new :

Other, probably less visible, improvements include the PDB plugin, the type system, more SDK functions (check out the exec_request_t if you develop multithreaded plugins), etc. The full list is below:

PROCESSOR MODULES
-----------------

+ PC: added detection of CException destructor; this helps to detect exception handlers and ignore them during function epilog analysis
+ PC: added support for another variation of PIC code by GCC
+ PC: more switches recognized in unoptimized MSVC code
+ ARM: added support for SUB Rx, R11, #fpoff stack variable references
+ ARM: added support for switches implemented using TBB/TBH instruction
+ ARM: better detection of R7-based frames
+ ARM: LDMED can be used for return too
+ ARM: type info and argument names are propagated for local variables passed by reference
+ ARM: other unspecified improvements (we removed them to keep the list short and more readable)
+ ARM: LSL Rx, Ry, #0 and ADD Rx, Ry, #0 are simplified to MOV Rx, Ry
+ I51: i/o port names are accepted for all segments (before only FSR definitions were handled)
+ MIPS: much improved analysis of ELF files
+ SuperH: simplified display of pc-relative literal loads

FILE FORMATS
------------

+ BOCHRC file loader: it is now possible to start IDA with a bochsrc file as the input file
+ CRASH DMP file loader: it is now possible to start IDA with an MS Windows Crask dump file
+ COFF: segment permissions are imported for MS object files
+ ELF: accept PPC64 ELF files
+ ELF: handle dynamic symbols in MIPS files
+ ELF: some new SuperH relocations are supported
+ ELF: added support for ARM TLS relocations
+ EPOC: added support for multiple imports with the same ordinal
+ EPOC: user contribution: ids files for epoc6/9 from Robert Krkic
+ EPOC: since AppTRK does not report thread creation/deletion, IDA forcibly refreshes the thread list if an unknown thread id is encountered
+ PDB: added the possibility to manually load a specific PDB file; to load only types from the PDB
+ PDB: added support for anonymous unions. types with bitfields are handled more correctly: we replace them with a corresponding POD type; ida kernel can not handle bitfields yet
+ PDB: added support for undefined enum types
+ PDB: better handling of C++ static methods and functions returning complex types.
+ PDB: better handling of string literals (??_C@...)
+ PDB: information about function argument names is applied, if available in the .pdb file
+ PDB: symbols can be loaded using EXE headers in the database, either from the module list during debugging or via File menu by specifying a valid base address
+ PE: added an option in pe.cfg to force loading of all PE file sections (usually .reloc and similar sections are skipped)
+ PE: if import and/or export tables lie outside .idata segment, they are parsed and formatted

KERNEL
------

+ Added some common C++ ABI functions to noret.cfg
+ Added support for __usercall functions with variable number of arguments (...)
+ Added functions to handle floating point instructions for the decompiler
+ Improved the browsing speed for big databases when autoanalysis is busy: moving around in huge databases is much better
+ Demangler: added support for the latest gcc4
+ Updated WinCE ARM ids files to Windows Mobile 6.0

IDC & SDK
---------

+ IDC: added MoveSegm() and RebaseProgram() functions
+ IDC: added OpFloat() function
+ IDC: renamed segment modification functions to start with a verb. Old names continue to be available.
+ SDK: added append_buf() and unpack_buf(), append_obj() and unpack_obj()
+ SDK: added build_anon_type_name()
+ SDK: added build_func_type() to facilitate building of type strings that represent functions
+ SDK: added callbacks to AskUsingForm so that the dialog can be modified on the fly
+ SDK: added change_storage_type() to change the storage method of arbitrary address range. please note that the sparse storage method works well only with uninitialized areas with huge objects
+ SDK: added floating point conversion functions for 64bit values
+ SDK: added functions for working with imports (enum_import_names and others, see nalt.hpp)
+ SDK: added get_zero_areas() to retrieve info about huge zero inited ranges
+ SDK: added exec_request_t - class that allows for code execution in the main thread from any other thread
+ SDK: added more convenient areacb_t::for_all_areas2(), which accepts a functor instead of (function,data) pair
+ SDK: added qlist compiler-independent template
+ SDK: added qthread_self()
+ SDK: added set_process_options() to set debugger process options
+ SDK: added ui_enable_input_hotkeys notification to let plugins temporary disable alphanumeric hotkeys which can interfere with user input
+ SDK: added replace_wait_box()
+ SDK: added DBGINV_REDRAW bit to refresh the user interface while invalidating the debugger caches
+ SDK: bitfield definitions in type strings have been changed. since there was no support for bitfields in the parser, this change should not affect anybody
+ SDK: introduced dt_ldbl to represent long double types. long double is different from tbyte and can be 8,10,12, or 16 bytes depending on the compiler
+ SDK: is_sp_based() can now return information about operands which are substracted from stack pointer
+ SDK: patch_byte() and similar functions return success if they succeed in modifying either process memory or idb. before they were returning true only if both process memory and idb were modified
+ SDK: windbg kernel mode: added notion of virtual threads

USER INTERFACE
--------------

+ UI: it is possible to add several types at once from the local types list (previously only the first one was added)
+ UI: it is possible to delete segment register change points from the "Jump to segment register" dialog or "Segment registers" view
+ UI: it is possible to set the base for array indexes display (decimal, hexadecimal, octal or binary)
+ UI: hex view supports in-place editing, various data formats and unicode strings
+ UI: unicode strings: unprintable characters are grouped into arrays; extra trailing zeroes are omitted by default

DEBUGGER
--------

+ breakpoint condition is evaluated only after the breakpoint is hit
+ Symbian: added support for new AppTRK v3.0.8 (thanks to Bernhard Mueller from SEC Consult GmbH)

BUGFIXES
--------

BUGFIX: 'move segment' command could affect segments outside of selection
BUGFIX: 'search for immediate' would ignore unexplored dword values (except in some very rare cases)
BUGFIX: "load debug info" command was not available from the module list if the database was created by instant debugger
BUGFIX: 68K: immediate floating-point operands were displayed incorrectly
BUGFIX: 8051: 'x' key didn't work with named bit operands (like P35)
BUGFIX: apply_tinfo() could not apply array types correctly; also applying char[] types was not always producing nice results
BUGFIX: ARM: some Thumb2 instructions were not decoded
BUGFIX: attaching to a process that generates exceptions or any other non-white listed event would still generate an ATTACH event first
BUGFIX: autoanalysis could loop indefinitely in some rare cases
BUGFIX: bochs could hang while parsing a binary file as bochsrc text file
BUGFIX: bochs dbg/rc file selectors were using save dialog and not open dialog
BUGFIX: bochs debugger could not handle some malformed PE files
BUGFIX: bochs debugger PE files with no sections were handled incorrectly
BUGFIX: bochs debugger was not initializing the FPU before running the program
BUGFIX: bochs debugger: CR4.bit9 should be set otherwise an invalid opcode will be thrown if a program attempts to use any of SSE{n} instructions.
BUGFIX: CodeView debug information was applied to wrong addresses
BUGFIX: corrupted epoc executables could not be loaded
BUGFIX: deleting a segment from UI sometimes led to deletion of wrong segment
BUGFIX: demangler: Visual Age was always interpreted as GNU compiler
BUGFIX: ELF: if file had .got.plt section but no .got, IDA did not rename PLT import stubs
BUGFIX: equal_types() was considering floating point and integral types of the same size equal
BUGFIX: esp alignment in 32-bit programs is only 2 bytes, not 4 bytes (push ax/add esp, 2 are perfectly valid but ida was aligning esp to 4 bytes)
BUGFIX: fild/fistp qword operands are marked as floating point doubles
BUGFIX: fpval->integer conversion functions were broken since very long time
BUGFIX: generating html file with inverted colors would hang ida
BUGFIX: GetProcessQty() was failing if called before running the debugger
BUGFIX: huge (>2GB) areas could not be displayed in the navigation band in all zoom levels
BUGFIX: ida could complain about patched bytes at the start of a debugging session while no bytes had been patched
BUGFIX: ida was always asking for a confirmation of array creation if the first byte of the array was unexplored
BUGFIX: ida was not using export information from available DLLs due to a logic error in the code
BUGFIX: ida was silently failing to use dummy prefixes as new location names; now it displays a correct error message
BUGFIX: ida would crash in linux trying to display the debugger specific options dialog box
BUGFIX: IDACall GetProcAddress() was returning wrong addresses for forwarded entries
BUGFIX: idb2scr() was broken. it was impossible to edit comments with 8-bit ascii characters, the dialog box would display them as garbage
BUGFIX: IDC was not comparing floating point with integers correctly
BUGFIX: idc: fixed a typo in INF_SIZEOF_LDBL
BUGFIX: if attaching to multithreaded application, the thread window would not focus on the current thread (no thread would be selected)
BUGFIX: in some cases IDA was still showing the "IDA Pro failed to stop/detach from the debugged program" dialog even if the process was already terminated
BUGFIX: in some rare cases IDA could display an exception if "full stack pointer analysis" was enabled.
BUGFIX: it was impossible to refuse to import types from local type window to enum/structure windows
BUGFIX: it was impossible to debug a dll when two or more dlls of the same name are loaded
BUGFIX: it was impossible to suspend a process that keeps on generating masked exceptions.
BUGFIX: java module could crash trying to display an automatic comment for a long (multi-line) output
BUGFIX: linux debugger could interr if the input file name was incorrect in the process options
BUGFIX: long descriptions of local void and typedef types were lacking the 'typedef' keyword
BUGFIX: LX: some LE files were not completely loaded (if the object's virtual size was less than the actual size)
BUGFIX: mac executables could not be used under Mac OS X 10.3
BUGFIX: mac os x debugger could exit with "can’t find dll name" error
BUGFIX: mips dmfc1/dmtc1 instructions were not supported
BUGFIX: mips module was requiring even fp register numbers for ldc1/sdc1 instructions; removed this limitation
BUGFIX: mips: clz/clo/plzcw/movf/movt instructions could not be disassembled in delay slots
BUGFIX: move_segm() would rebase offset expressions regardless of the MSF_NOFIX flag
BUGFIX: multiple problems with the linux debugger module have been fixed
BUGFIX: nlm loader was not populating the imports window
BUGFIX: noType() called on a tail byte could corrupt the database
BUGFIX: pausing execution in VMWare was reported as an exception
BUGFIX: PC: (x64) movq instruction was decoded as movd
BUGFIX: PC: fixed occasional inifinite loop during analysis
BUGFIX: PC: fpu instructions had wrong values in the dtyp field (fpu reg types are still set to be dt_double, ideally it should be dt_tbyte)
BUGFIX: PC: functions with _SEH_prolog were not analyzed properly when using PDB symbols
BUGFIX: PC: LAHF/SAHF instructions could not be disassembled in 64-bit mode
BUGFIX: PC: operands of the fcompp insn were displayed in reverse order; they are not displayed anymore if they are regular st, st(1)
BUGFIX: PC: some one-byte opcodes were decoded incorrectly in 64-bit mode. REX.B was not ignored for opcodes 05, 25 etc
BUGFIX: PDB plugin could create a circular dependency in type, which would later crash IDA
BUGFIX: PE: imports in files with zero sections were parsed incorrectly
BUGFIX: PE: several fixes to handle unusual alignment values (thanks to Ivan Teblin)
BUGFIX: PIC files were loaded with 8-bit 'bytes' by default
BUGFIX: pressing and holding F8 in bochs debugger could lead to a racing condition and deadlock
BUGFIX: SDK: c2ustr was returning a string with an extra terminating zero which was included in the string length
BUGFIX: SDK: for 16bit segmented memory, ida would set incorrect value for eip after a breakpoint (visible with third-party 16bit debugger plugins)
BUGFIX: SDK: open_hexdump_window() didn't work in GUI version
BUGFIX: SDK: patch_word()/patch_long() did not work properly if the new value had some bytes matching the database
BUGFIX: set_offset_ex() with RVAOFF could fail randomly
BUGFIX: some symbian sisx files could not be loaded (ida crashed)
BUGFIX: some undefined types referenced by name were imported as 'void'
BUGFIX: structure alignment was sometimes wrong in types created by the pdb plugin
BUGFIX: structures with arrays of structures should not be displayed in terse form
BUGFIX: Symbian: file names in embedded sis files were displayed incorrectly
BUGFIX: the horizontal scrollbar in disassembly views was handled incorrectly
BUGFIX: tms6 module was incorrectly commenting branch/call targets under linux
BUGFIX: type system was not adding comments for arguments that were handled from generic code (gen_use_arg_types())
BUGFIX: u2cstr() was returning a string with an extra terminating zero which was included in the string length
BUGFIX: UI: ida could display "Access denied" message when running in a remote desktop session and the session was minimized or closed
BUGFIX: unicode support in the mac version of ida was broken
BUGFIX: unix implementation of qsem() functions could crash on NULL pointer
BUGFIX: unpatched PIC GOT32/GOTOFF relocations were handled incorrectly
BUGFIX: validate_tofs() could not handle variable sized structures. modifying a byte of a variable sized structure could lead to interrs.
BUGFIX: win32 debugger would freeze trying to attach to a crippled program that would generate exceptions during attaching
BUGFIX: win7 rc has a hardcoded int3 instruction in LdrpDoDebuggerBreak() instead of a call to DbgBreakPoint() and IDA stops on it
BUGFIX: wince debugger could not attach to an already running process if the "debugger->process options->input file" was specified
BUGFIX: WinCE debugger module could hang in some cases if ida_kdstub.dll was missing from IDA directory and the PocketPC
BUGFIX: wince debugger was causing system wide memory leaks on the PDA
BUGFIX: windbg debugger module (kernel mode) generates duplicate debug names each single step
BUGFIX: windbg debugger module was not enabled for drivers
BUGFIX: windbg was reverting the debugging tools path to the default at each process start
BUGFIX: wrong types with circular dependencies could crash ida (like typedef x x

DOWNLOAD

Pass: chevrosky

StrongOD.v0.2.8.478.By.海风月影[CUG]

2009-12-01T07:51:00.000-08:00

Download:

http://www.megaupload.com/?d=N35WGW5G

VMProtect.Professional.v.2.01.2.Cracked.by.Nooby

2009-12-01T01:17:00.000-08:00

Download:

http://www.megaupload.com/?d=IL91YMHW

Unpacking VMProtect 1.7 - 1.8 Tutorial Set & Script by LCF-AT

2009-11-15T06:33:00.000-08:00

What's inside?All belong together!
******************************************************
Vid_01. Unpacking VMProtect 1.7 - 1.8 Debugger and system setup.swf
Vid_02. Unpacking VMProtect 1.7 - 1.8 OEP and API analysis.swf
Vid_03. Unpacking VMProtect 1.7 - 1.8 Unpacking VMP 1.7 target.swf
Vid_04. Unpacking VMProtect 1.7 - 1.8 Unpacking VMP 1.8 target.swf
Vid_05. Unpacking VMProtect 1.7 - 1.8 Test all unpacked files.swf

Six small exsample targets.Three protected by VMProtect 1.8 and three more protected by VMProtect 1.7.I added also all unpacked files and txt & mem files which was created by my script so that you can also understand & test it.

VMProtect 1.7 - 1.8 OEP & Unpack Helper 1.0.txt / 37 KB

*************************************************** 
( 1.) OEP Finder                                     

( 2.) API Place Finder Break & LOG                   

( 3.) Creating IATPATCH.txt & IAT_INLINE Section M|2 

( 4.) Creating Session Info File                     

( 4.) Creating Extra APIs For Some Cases

How to Use Information`s | Step List Choice
***************************************************
You have 3 methods | Follow this | *2=1 *2=2 *3=3 *
*
*2 <- Search the API Holder Address           [1] * 
*1 <- Search the OEP / SubRoutine Address     [2] * 
*3 <- Write IATPATCH.txt File                 [3] *

***************************************************

So how you can alraedy see are there five movie tutorials to watch so I've decided to do this to give you also a good overview how to find the important places we need and what we can to do there.I also commented all so that you can do nothing wrong and it´s also qualified for some newbies.

The script content some diffrent methods which you can choose so it`s also important to choose these in the right turn you know.So just watch all movies and then you can start to unpack something by youself with the script.This prevents also me for some unnecessary questions later.Try also to use the same or higher ODbgScript.dll plugin v1.76.3 to prevent mistake`s!

I also added the Nooby.dll in my package and I explain what the dll makes.I also have made my script compatible for this dll and VMProtect 1.8 versions if you want to use this dll but this is not required so you have the choice.I show you also how to get the dumped files working for other OS which you can also see in Vid_05.So all in all I can say it´s the biggest tutorial which I have made till now so the package size of 30 MB so I hope you have a little bit time to watch all.
So then I have no more to tell at the moment about it.Now I whish all interested people much fun at watching all movies and I also hope that you get it also working for you.If you get after all still some problems during the unpack process then you can use this topic to put your questions in here.

DownLoadLink:
http://www.megaupload.com/?d=33QZB757
PASS: VMP_UNPACKING_SET

Ad Banner Remover Plus - Version 1.0.4.1

2009-11-13T01:26:00.000-08:00

Advert Options
Main Messenger Advert - Removable
Change Room Banner - Replaceable
Chat Room Advert - Removable
Webcam Adverts - Replaceable
Other Options
Enable / Disable Multiple Instances of Yahoo Messenger 10, 9, or 8
Disable "Automatically start Yahoo Messenger" - When Windows Starts
Enable/Disable Smiley Search - Yahoo Messenger 10 Only
MD5
5CBA3FDC9E83A3BA51ED7762B6F87FB7
Download
Download from Megaupload - Download
Download from Mediafire - Download
Versions File
Download from Mediafire - Download ( Updated 11/12/2009 )
If you download Ad Banner Remover Plus from one of the download
links above then you do not need download an updated Versions file.
-----------------------------------------------------------------------------------------------

Yahoo Messenger 10.0.0.1102 is supported.

I have made some small changes to the User Interface in some places of the
application. I have also added a Help tab which includes a Help Document.

ASProtect SKE v2.x Unpacking Tuts

2009-11-07T06:25:00.000-08:00

ASProt_unp.rar
http://www.megaupload.com/?d=X0FDMFTS
---------------
ASProtect 2.3 SKE (Bypass HardwareID Lock).rar
http://www.megaupload.com/?d=MOKUV0DV
---------------
ASProtect 2.4 SKE (OEP + Advanced Import Protection).rar
http://www.megaupload.com/?d=TU6RS5T4
---------------
ASProtect 2.xx (Attack on Activation Key).rar
http://www.megaupload.com/?d=G50HQ4JD
---------------
ASProtect SKE Unpacking Approach.rar
http://www.megaupload.com/?d=31QQJ28M
---------------
ASProtect.SKE2.x Unpacking.rar
http://www.megaupload.com/?d=SIG6MVN0
---------------
Asprotect_Ske2.3_U_Series.rar
http://www.megaupload.com/?d=2YVX75F0

Armadillo v4x/5x/6x Unpacking Tuts

2009-11-07T05:49:00.000-08:00

arma6.24 tut X Video Converter.rar 1.2MB
http://www.megaupload.com/?d=6E2KNR6P
--------------
Armadillo 6.40 (CopyMem 2 + Debug Blocker).rar 7.7MB
http://www.megaupload.com/?d=3GAKAL0F
--------------
Unpacking Armadillo 4.66 (Debug-Blocker).zip 12.4MB
http://www.megaupload.com/?d=WJNWDJBK
--------------
Unpacking Armadillo 4.66 (Standard).zip 10.16MB
http://www.megaupload.com/?d=HK4WZFP4
--------------
Unpacking Armadillo 4.xx (Standard with Trial Keys).zip 10.29MB
http://www.megaupload.com/?d=7IL608WC
--------------
Unpacking Armadillo 5.xx (Debug-Blocker + new Overlay signature).zip 9.36MB
http://www.megaupload.com/?d=A3YW8D0U
--------------
Unpacking Armadillo v6.xx Debug-Blocker+Nanomites - Pogo Games.zip 5.69MB
http://www.megaupload.com/?d=B7LS4K7L
--------------
Unpacking Armadillo v6.xx Standard - iWin Games.zip 5.74MB
http://www.megaupload.com/?d=KHI59WQD
--------------
Unpacking Armadillo v6.xx Standard - RegCompact.zip 4.98MB
http://www.megaupload.com/?d=XSAUXJ3F

Ollydbg 60 Plugins Latest - 07-11-2009

2009-11-07T04:52:00.000-08:00

Download: 5.4MB
http://www.megaupload.com/?d=I6WMI0DW

Ollydbg 867 Scripts Pack - 2008-05-17

2009-11-07T04:44:00.001-08:00

Download: 1.15MB
http://www.megaupload.com/?d=JYLSNOJE

All 959 Scripts by LCF-AT

2009-11-07T04:40:00.000-08:00

Download: 845KB
http://www.megaupload.com/?d=4ZZF3UIW

Olly Script Editor v2.0

2009-11-07T04:38:00.001-08:00

Download:
http://www.megaupload.com/?d=8S3B67BZ