From b1e131130467d41d589ac0e99a481e07e9c5d977 Mon Sep 17 00:00:00 2001 From: DSR! Date: Sun, 26 Feb 2023 16:04:55 -0300 Subject: [PATCH] Refactor for implement new category --- CHANGELOG.md | 1 + TOOLS.md | 104 ++++++++++------- bin/updater/tools.ini | 106 +++++++++--------- .../ImpREC/ImpREC - 1.7e.7z | Bin .../ImpREC/ImpREC - 1.7f.7z | Bin 5 files changed, 116 insertions(+), 95 deletions(-) rename extras/oldies/toolkit/{Other => Reverse}/ImpREC/ImpREC - 1.7e.7z (100%) rename extras/oldies/toolkit/{Other => Reverse}/ImpREC/ImpREC - 1.7f.7z (100%) diff --git a/CHANGELOG.md b/CHANGELOG.md index 86892e5..ed96e0a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -17,6 +17,7 @@ - Bump Universal Updater to 1.8.0 - Extract all old tools to new package +- New Reverse catalog created to improve the ordering of tools - Fix ImHex re_download regex - Fix VirusTotalUploader re_download regex - Improvements in self updater of tools.ini diff --git a/TOOLS.md b/TOOLS.md index 50d1d50..18d88d3 100644 --- a/TOOLS.md +++ b/TOOLS.md @@ -7,7 +7,7 @@ 1. [Monitor](#monitor) 1. [NFOMaker](#nfomaker) 1. [Other](#other) -1. [Patcher](#patcher) +1. [Reverse](#reverse) 1. [Rootkits detector](#rootkits-detector) 1. [Unpacking](#unpacking) @@ -327,11 +327,6 @@ It is the first and only program of its kind to support output for display in va ***Developer:*** NirSoft
***Description:*** HashMyFiles is small utility that allows you to calculate the MD5 and SHA1 hashes of one or more files in your system. You can easily copy the MD5/SHA1 hashes list into the clipboard, or save them into text/html/xml file.
-### ImpREC (with plugins) -***Web:*** Unknown
-***Developer:*** MackT/uCF
-***Description:*** ImpRec is a very handy tool that can be used to repair/reconstruct the import table for packed programs.
- ### Indetectables Offset Locator ***Web:*** https://www.indetectables.net/viewtopic.php?t=29725
***Developer:*** Mingo, Yorll & Metal
@@ -342,11 +337,6 @@ It is the first and only program of its kind to support output for display in va ***Developer:*** CERT.at
***Description:*** ProcDOT aids malware analysis via visual means, by correlating ProcMon and PCAP data and showing it as an interactive, animated graph. It also detects and shows Thread Injection, smartly follows algorithms, filters out noise, and correlates network events with the involved processes.
-### Process Dump -***Web:*** http://split-code.com/processdump.html
-***Developer:*** Split-Code
-***Description:*** Process Dump is a Windows reverse-engineering tool to dump malware memory components back to disk for analysis. It uses an aggressive import reconstruction approach to make analysis easier, and supports 32 and 64 bit modules.
- ### RawCap ***Web:*** https://www.netresec.com/?page=RawCap
***Developer:*** Netresec
@@ -357,11 +347,6 @@ It is the first and only program of its kind to support output for display in va ***Developer:*** Angus Johnson
***Description:*** Resource Hacker is a resource editor for 32bit and 64bit Windows applications. It's both a resource compiler aand a decompiler, enabling viewing and editing resources in executables.
-### Scylla -***Web:*** https://github.com/NtQuery/Scylla
-***Developer:*** The NtQuery team
-***Description:*** Great tool for the purpose of rebuilding an Import Table. This is an alternative to ImpRec.
- ### ShowString ***Web:*** Unknown
***Developer:*** figugegl
@@ -372,54 +357,89 @@ It is the first and only program of its kind to support output for display in va ***Developer:*** Sysinternals
***Description:*** Search for ANSI and Unicode strings in binary images.
-### Threadtear -***Web:*** https://github.com/GraxCode/threadtear
-***Developer:*** GraxCode
-***Description:*** Threadtear is a multifunctional deobfuscation tool for java. Android application support is coming soon (Currently working on a dalvik to java converter). Suitable for easier code analysis without worrying too much about obfuscation.
- ### VirusTotal Uploader ***Web:*** https://github.com/SamuelTulach/VirusTotalUploader
***Developer:*** Samuel Tulach
***Description:*** VirusTotal file uploader
-### XOpCodeCalc -***Web:*** https://github.com/horsicq/XOpcodeCalc
-***Developer:*** Hors
-***Description:*** This tool is an x86/64 Opcode calculator. The program works on macOS, Linux and Windows.
-### x64dbg Plugin Manager -***Web:*** https://github.com/horsicq/x64dbg-Plugin-Manager
-***Developer:*** Hors
-***Description:*** Plugin manager for x64dbg.
- -### GetSymbol -***Web:*** https://github.com/dbgsymbol/getsymbol
-***Developer:*** @Paul091_
-***Description:*** Simple tool to download debugging symbols from Microsoft, Google, Mozilla and Citrix symbol servers for reverse engineers compatible with Windows 8.1, 10 and 11.
- -### DLest -***Web:*** https://github.com/DarkCoderSc/DLest
-***Developer:*** DarkCoderSc (Jean-Pierre LESUEUR)
-***Description:*** This powerful Microsoft Windows application is specifically designed to assist developers and malware analysts with the analysis and manipulation of exported functions in Portable Executable (PE) files, particularly DLLs. With DLest, you can easily enumerate exported functions using a variety of methods, including drag and drop, opening a folder, or recursively scanning a folder with regular expression filtering to only include PE files with specific export function names.
- - -## Patcher +## Reverse ### AT4RE Patcher ***Web:*** https://www.at4re.net/f/thread-54.html
***Developer:*** Agmcz & Sn!per X
***Description:*** Patch generator. Currently the most complete and best that can be used.
+### CryptoTester +***Web:*** https://github.com/Demonslay335/CryptoTester
+***Developer:*** Michael Gillespie
+***Description:*** A utility for playing with cryptography, geared towards ransomware analysis.
+ ### dUP ***Web:*** https://web.archive.org/web/20120327143407/http://diablo2oo2.cjb.net:80/
***Developer:*** diablo2oo2
***Description:*** dUP 2 is a freeware patch generator which can build a small standalone patcher executable for microsoft windows systems.
+### DLest +***Web:*** https://github.com/DarkCoderSc/DLest
+***Developer:*** DarkCoderSc (Jean-Pierre LESUEUR)
+***Description:*** This powerful Microsoft Windows application is specifically designed to assist developers and malware analysts with the analysis and manipulation of exported functions in Portable Executable (PE) files, particularly DLLs. With DLest, you can easily enumerate exported functions using a variety of methods, including drag and drop, opening a folder, or recursively scanning a folder with regular expression filtering to only include PE files with specific export function names.
+ +### ExtremeDumper +***Web:*** https://github.com/wwh1004/ExtremeDumper
+***Developer:*** wwh1004
+***Description:*** .NET Assembly Dumper
+ +### GetSymbol +***Web:*** https://github.com/dbgsymbol/getsymbol
+***Developer:*** @Paul091_
+***Description:*** Simple tool to download debugging symbols from Microsoft, Google, Mozilla and Citrix symbol servers for reverse engineers compatible with Windows 8.1, 10 and 11.
+ +### ImpREC (with plugins) +***Web:*** Unknown
+***Developer:*** MackT/uCF
+***Description:*** ImpRec is a very handy tool that can be used to repair/reconstruct the import table for packed programs.
+ +### Keygener Assistant +***Web:*** https://www.at4re.net/f/thread-47.html
+***Developer:*** Mr Paradox & dj-siba
+***Description:*** Convert, analyze, encrypt and process characters to and from an abundance of encodings and formats with this fully-featured calculator and processor.
+ +### Process Dump +***Web:*** http://split-code.com/processdump.html
+***Developer:*** Split-Code
+***Description:*** Process Dump is a Windows reverse-engineering tool to dump malware memory components back to disk for analysis. It uses an aggressive import reconstruction approach to make analysis easier, and supports 32 and 64 bit modules.
+ +### Scylla +***Web:*** https://github.com/NtQuery/Scylla
+***Developer:*** The NtQuery team
+***Description:*** Great tool for the purpose of rebuilding an Import Table. This is an alternative to ImpRec.
+ +### Threadtear +***Web:*** https://github.com/GraxCode/threadtear
+***Developer:*** GraxCode
+***Description:*** Threadtear is a multifunctional deobfuscation tool for java. Android application support is coming soon (Currently working on a dalvik to java converter). Suitable for easier code analysis without worrying too much about obfuscation.
+ ### uPPP ***Web:*** https://forum.tuts4you.com/forum/120-uppp/
***Developer:*** Ufo-Pu55y
***Description:*** Another patch generator. Requires .NET Runtime 2.0 for the GUI.
+### WinAPI Search +***Web:*** https://dennisbabkin.com/winapisearch/
+***Developer:*** Dennis Babkin
+***Description:*** WinAPI Search app was designed primarily for Windows developers, researchers and malware reverse engineers. Its original goal was to provide a utility to search for Win32 functions by name, but this app later grew to include additional functionality.
+ +### x64dbg Plugin Manager +***Web:*** https://github.com/horsicq/x64dbg-Plugin-Manager
+***Developer:*** Hors
+***Description:*** Plugin manager for x64dbg.
+ +### XOpCodeCalc +***Web:*** https://github.com/horsicq/XOpcodeCalc
+***Developer:*** Hors
+***Description:*** This tool is an x86/64 Opcode calculator. The program works on macOS, Linux and Windows.
+ ## Rootkits Detector diff --git a/bin/updater/tools.ini b/bin/updater/tools.ini index fad8e7d..0ffbd17 100644 --- a/bin/updater/tools.ini +++ b/bin/updater/tools.ini @@ -279,13 +279,6 @@ from = web local_version = 2.54 re_version =

]*>Strings v(.*?)

-[XOpcodeCalc] -folder = ..\..\toolkit\Other\XOpcodeCalc -url = horsicq/XOpcodeCalc -from = github -local_version = 0.05 -re_download = xopcodecalc_win64_portable_(?:\S+).zip - [Resource Hacker] folder = ..\..\toolkit\Other\Resource Hacker url = http://www.angusj.com/resourcehacker/ @@ -336,21 +329,6 @@ from = web local_version = 4.4.8 re_version = AstroGrep_v(.*?)_portable.zip -[Process-Dump] -folder = ..\..\toolkit\Other\Process-Dump -url = http://split-code.com/processdump.html -update_url = http://split-code.com/files/pd_latest.zip -from = web -local_version = 2.1 -re_version = Download: pd.exe v(.*?) for Windows 32 and 64 bit - -[Scylla] -folder = ..\..\toolkit\Other\Scylla -url = NtQuery/Scylla -from = github -local_version = v0.9.8 -re_download = Scylla_v(?:\S+).rar - [VirusTotalUploader] folder = ..\..\toolkit\Other\VirusTotalUploader url = SamuelTulach/VirusTotalUploader @@ -374,35 +352,6 @@ from = web local_version = 0.2.1.0 re_version = RawCap (.*?) \(new\) -[Threadtear] -folder = ..\..\toolkit\Other\Threadtear -url = GraxCode/threadtear -from = github -local_version = 3.0.1 -re_download = threadtear-gui-(?:\S+)-all.jar -post_unpack = scripts\Threadtear.bat - -[x64dbgPluginManager] -folder = ..\..\toolkit\Other\x64dbgPluginManager -url = horsicq/x64dbg-Plugin-Manager -from = github -local_version = 0.05 -re_download = x64plgmnr_win32_portable_(?:\S+).zip - -[GetSymbol] -folder = ..\..\toolkit\Other\GetSymbol -url = dbgsymbol/getsymbol -from = github -local_version = v2.0.1 -re_download = GetSymbol.exe - -[DLest] -folder = ..\..\toolkit\Other\DLest -url = DarkCoderSc/DLest -from = github -local_version = 1-0 -re_download = DLest(?:\S+).zip - [RunAsDate] folder = ..\..\toolkit\Other\RunAsDate url = https://www.nirsoft.net/utils/run_as_date.html @@ -411,19 +360,70 @@ from = web local_version = 1.41 re_version = v(\d+\.\d+) +[DLest] +folder = ..\..\toolkit\Reverse\DLest +url = DarkCoderSc/DLest +from = github +local_version = 1-0 +re_download = DLest(?:\S+).zip + [ExtremeDumper] -folder = ..\..\toolkit\Other\ExtremeDumper +folder = ..\..\toolkit\Reverse\ExtremeDumper url = wwh1004/ExtremeDumper from = github local_version = v4.0.0.1 re_download = ExtremeDumper.zip +[GetSymbol] +folder = ..\..\toolkit\Reverse\GetSymbol +url = dbgsymbol/getsymbol +from = github +local_version = v2.0.1 +re_download = GetSymbol.exe + +[Process-Dump] +folder = ..\..\toolkit\Reverse\Process-Dump +url = http://split-code.com/processdump.html +update_url = http://split-code.com/files/pd_latest.zip +from = web +local_version = 2.1 +re_version = Download: pd.exe v(.*?) for Windows 32 and 64 bit + +[Scylla] +folder = ..\..\toolkit\Reverse\Scylla +url = NtQuery/Scylla +from = github +local_version = v0.9.8 +re_download = Scylla_v(?:\S+).rar + +[Threadtear] +folder = ..\..\toolkit\Reverse\Threadtear +url = GraxCode/threadtear +from = github +local_version = 3.0.1 +re_download = threadtear-gui-(?:\S+)-all.jar +post_unpack = scripts\Threadtear.bat + [WinAPI Search] -folder = ..\..\toolkit\Other\WinAPI Search +folder = ..\..\toolkit\Reverse\WinAPI Search update_url = https://dennisbabkin.com/php/downloads/WinApiSearch.zip from = http local_version = 1774347792 +[x64dbgPluginManager] +folder = ..\..\toolkit\Reverse\x64dbgPluginManager +url = horsicq/x64dbg-Plugin-Manager +from = github +local_version = 0.05 +re_download = x64plgmnr_win32_portable_(?:\S+).zip + +[XOpcodeCalc] +folder = ..\..\toolkit\Other\XOpcodeCalc +url = horsicq/XOpcodeCalc +from = github +local_version = 0.05 +re_download = xopcodecalc_win64_portable_(?:\S+).zip + [Windows Kernel Explorer] folder = ..\..\toolkit\Rootkits Detector\Windows Kernel Explorer url = https://github.com/AxtMueller/Windows-Kernel-Explorer diff --git a/extras/oldies/toolkit/Other/ImpREC/ImpREC - 1.7e.7z b/extras/oldies/toolkit/Reverse/ImpREC/ImpREC - 1.7e.7z similarity index 100% rename from extras/oldies/toolkit/Other/ImpREC/ImpREC - 1.7e.7z rename to extras/oldies/toolkit/Reverse/ImpREC/ImpREC - 1.7e.7z diff --git a/extras/oldies/toolkit/Other/ImpREC/ImpREC - 1.7f.7z b/extras/oldies/toolkit/Reverse/ImpREC/ImpREC - 1.7f.7z similarity index 100% rename from extras/oldies/toolkit/Other/ImpREC/ImpREC - 1.7f.7z rename to extras/oldies/toolkit/Reverse/ImpREC/ImpREC - 1.7f.7z