Programming and Coding
Programming and coding tips, help and solutions...
1,890 topics in this forum
-
meaning of instruction call $+5 in IDA Disassembly
by abhijit mohanta- 1 follower
- 3 replies
- 21.6k views
I found in IDA Disassembly an instruction CALL $+5 Can anybody tell me the meaning of this.
-
- 1 reply
- 3.7k views
Hi, I'm analyzing a licensing process of a program and I came across those functions (bellow) I found that it is using SHA-1, zlib decompression, upx for internal module, and not sure about RSA zlib and upx functions I've already recognize them, but SHA-1 and RSA (?) are still under question. Here are a part of function before the data is actually decrypted. The Functie_RoR_cu_shl8 looks like SHA-1, and the cycle is feeding the digest (?). I need to know if I understood this function correctly and if somebody recognize the Spider_Unknown_Function? If you can help me understand better this peace of code. Thanks. All those inline algorithms looks like Crypto++ library or Bo…
-
pinned
by Fenix- 2 replies
- 12.4k views
hi all i am really a newbey in this section But can someone give me a program who can Unpack a .exe Programs Thanks you: Niki Izvorski
-
Change class name onmouseover
by kuma.lk- 0 replies
- 3.4k views
I'm trying to find a way to use Javascript to find elements with a specific class, dynamically change the class onmouseover, and return the element to its original class onmouseout. Obviously there are a ton of scripts out there that have this kind of functionality, but I need something that I can put into an external javascript, without having to add anything to the markup. I've tried to hack something out, but unfortunately don't know enough about javascript to make it work. Any ideas? Thanks, _______________________________________________________________________________
-
PEDiminisher unpacker
by bigboss-62- 0 replies
- 7.7k views
Hello friends, i'm proud to bring you my unpacker for PEDiminisher v0.1 from Teraphy. Why do i say "Complete decryptor" ? - PeDiminisher Unpacker (Direct approch) from DESPERATE is failing with original PED, my unpacker is working. - Generic unpackers and PeDiminisher Unpacker (Debug approach) from DESPERATE are working with PED, but you can't remove "extra" sections from PED if "Encrypt resources" and "Exclude Icons" were checked. In default, PED creates a ".teraphy" unpacking section in packed file. In case "Encrypt resources" and "Exclude Icons" were checked, PED creates an extra section named ".icon", where it duplicates icon contents from resource to this new ".icon…
-
Stone PE-Encryptor decryptor
by bigboss-62- 1 reply
- 6.5k views
Another day, another decrypter... i'm proud to bring you my decryptor for Stone PE-Encryptor. It has supports for Stone PE-Encryptor v1.0 and v1.13. If someone have a copy of another version, don't hesitate to send me it... I will include support... As usual, decryptor source in masm and cryptors sources in tasm are included for interested ones... Any comments, opinions on source code, bug reports or others are welcome... See you soon ... Laurent aka BIGBOSS from COPs StonesPEEncryptor_v1.00.zip StonesPEEncryptor_v1.13.zip CPS!UnStnPEE_v1.0.zip
-
Help with a nfo autoscroll
by Neuro- 3 replies
- 4.3k views
Hi guys , i came across this forum and i'm really glad about it! Hello to everybody , great community here. If i posted in the wrong section ,i'm really sorry for that.. I have a question. I would like to know where i can get a "nfo Auto-scroll" or how to make one... i attached the file for example. To terminate it press "Esc" Thanks in advance for your reply. Neuro. nfo Auto-scroll.rar
-
PCShrink unpacker
by bigboss-62- 2 replies
- 6.4k views
Hello guys, As promised, i'm proud to bring you my unpacker for PCShrink. It has supports for PCShrink (v0.29, v0.45, v0.71) and VGShrink (v0.14). If someone have a copy of another version of PCShrink, don't hesitate to send me it... I will include support in my unpacker... As usual, unpacker source in masm and packers sources in tasm are included for interested ones... (Note: PC Shrink v0.71 source code is a custom one from myself) Any comments, opinions on source code, bug reports or others are welcome... See you soon ... Laurent aka BIGBOSS from COPs VGShrink_v0.14.zip PCShrink_v0.29.zip PCShrink_v0.45.zip PCShrink_v0.71.zip CPS!UnPCShrink_v1.0.zip
-
VGShrink unpacker
by bigboss-62- 4 replies
- 26.1k views
Hello dudes, After some decrypters, i'm proud to bring you my first unpacker for VGShrink v0.14. VGShrink is a shrinker from Virogen, and it will become PCShrink later. This unpacker currently supports VGShrink v0.14. If someone have a copy of another version of VGShrink, don't hesitate to send me it... I will include support in my unpacker... As usual, unpacker source in masm and packer source in tasm are included for interested ones... If you found some bugs, don't blame me... It's my first unpacker... Any comments, opinions on source code, bug reports or others are welcome... See you soon ... Laurent aka BIGBOSS from COPs CPS!UnVGShrink_v0.14.zip VGShrink_v0.14.zip
-
[Request] Edit Bytes
by GameOver- 11 replies
- 4.4k views
Hi, I'm GameOver and I have just registered to this website (So go easy on me, please ) I am currently developing a patching application for some software.. I know the bytes that I need to change in order to turn the program from a trial into the full version. Basically I need some VB code (or help me write some VB code) that changes the hex from 00 01 02 03 04 FF to 04 04 04 04 04 03 Any help? Visual Basic Version = 10.0.26001.1 .Net Version = 4.3 Beta
-
DeviceIoControl IOCTL codes.
by Gushe- 1 reply
- 13.7k views
Delphi didn't seem to have these predefined, so I had to calculate it myself. Since it can be pretty tough finding the right values (even with Google) I thought I'd just calculate them all and share the list with you. They are for use with the DeviceIoControl() API. I have found the code used to calculate the values on internet and only had to find the right parameter values, thus not too much credit should go to me. This function being: function CTL_CODE(DeviceType, FunctionNo, Method, Access: Integer): Integer; begin Result := (DeviceType shl 16) or (Access shl 14) or (FunctionNo shl 2) or (Method); end; As for Method and Access, these are the values used for them: …
-
Microsoft Fox Pro 9
by deepzero- 3 replies
- 4k views
Hi, i need to understand this line of foxpro 9.0 code: serial = VAL(SYS(2007, ALLT(STR(THISFORM.TEXT1.VALUE)))) * 2 1) it takes the string from text1 :STR(THISFORM.TEXT1.VALUE) 2) it removes all spaces using ALLT 3) it generates the crc of the string withput spaces 4) and multiplys it by 2 msdn about the sys(2007, xxx) function: http://msdn.microsoft.com/en-us/library/csfkkhcy%28VS.80%29.aspx and the val() function: http://msdn.microsoft.com/en-us/library/csfkkhcy%28VS.80%29.aspx an example: text1.value = "1 234" -> remove spaces: "1234" -> calc crc32b (??) 596A3B55 -> take first numbers: 596 -> mul by two: 1192 But what crc is used? And wha…
-
- 1 reply
- 3.1k views
I could help pass the Visual Basic code to assembler or schedule a field of stars similar in assembler http://www.mediafire.com/file/mvu3hmwwmxq/screensaver-estrellas.zipthanks screensaver-estrellas.zip Proyecto1.rar
-
Ollydbg Attach
by Scale- 4 replies
- 13.1k views
If i attach to a process and make it crash then close it in olly, restart the program and attach again all threads will be suspended and won't resume. The only way to get a succesfull attach is to restart olly everytime, Is this just me? Thanks!
-
How To Change ClassName ?
by Sh4DoVV- 0 replies
- 2.6k views
Hi Friends How To Change ClassName Of A Process ? How To Hook GetClassNameA That Returned ClassName Of Explorer.exe ? Please Help Me
-
Hiding processesin Vista/ Win 7
by cyb3rl0rd1867- 0 replies
- 2.6k views
Does anybody know how to hide a process in Vista and windows 7? I've seen countless tuts on 9x and xp but nobody seems to know how to do it with those two os's!
-
- 3 replies
- 2.9k views
Somebody would be able to help me to work with music XM in assembler preferential that it is with Winasm right now than when I create the executable you tell me that he is virus but solo if use it in a file RC but if I assemble templates from here somebody does not earmark me like virus can pleas help me? -------------------------------------------------------------------------------------------------------- alguien me podria ayudar a trabajar con musica XM en ensamblador de preferencia que sea con Winasm ya que cuando creo el ejecutable me dice que es virus pero solo si lo utilizo en un archivo RC pero si ensamblo templates de aqui no me marca como virus alguien me puede…
-
Free tech books
by Zool- 0 replies
- 6.4k views
Hi everyone I'm entirely not sure if this is the right forum for this, but I fealt like sharing it. www.freetechbooks.com is a website worth visiting, when looking for tech stuff manuals and books. Happy reading
-
DLL attached but how trick this...sometime Bug
by mariusfv- 0 replies
- 2.6k views
Hi Can someone please to help me with few indication ? I attach the .dll to target process(is an online conectable application) and is ok, the .dll make what is build to do but when i change servers connection sometime give me that errors: 1. cmp edx,dword ptr [ecx+2BCh] (often) 2. mov al,byte ptr [edi] (rarely) I find where the .dll(application) give BUG sometime by open mdmp file in Microsoft Visual studio ->F5->Break(MVS menu Debug->Windows->Call Stack. I try in Olly with JMP/JNZ, with that solutions the application not have errors but PROBLEM IS NOT DO WHAT MUST TO DO. Can someone give me another solution without JMP/JNZ in Olly because i…
-
[Solved] Packer Help
by steve10120- 7 replies
- 3.9k views
Hi. Ok so I'm making a packer, but, its not working on some files. For example, works fine on a Delphi hello world, but on HoundPE(also coded in Delphi) it doesn't. Get an exception then an empty message box. Checked and the file is being mapped correctly and imports definatly fixed. Attached are examples of working and non-working files. Any suggestions welcome. Thanks. Tests.rar
-
C keygenning
by thanos713- 4 replies
- 10.6k views
Can anyone tell me some basic functions to learn about C for keyggening? Sorry for my bad english, thanks, thanos713.
-
MASM BruteForce Keygen Template
by Coop- 3 replies
- 4.7k views
Hey guys, I am looking for a KG template (MASM) that would bruteforce a serial that is 15 characters long (0-9 chars only). The ripped code is 2.5megs as a text file and consists mostly of IMULs & IDIVs, etc. There is a total of 17 math checks done. During each check, the char manipulation is done on 13-15 characters from the serial as well as on chars from the username; these are done independantly and the if the results match then variable "Valid" is set. Subsequent checks also set/reset "Valid" accordingly... I realize I have to loop through the whole thing until all criteria are met so I am looking for the SPEEDIEST and MOST EFFICIENT way to do it. I intended…
-
ufMODWrapper v1.0
by whoknows- 1 reply
- 3.5k views
Finally play XM files, just with 28.5kb NET DLL file full credits fly to : UFO-Pu55y I just make the wrapper (check .vbproj for more) dn 98kb @: http://rapidshare.com/files/346235556/ufMODWrapper-whoknows.7z.html
-
BHO project compiling errors, c++
by alaphate- 2 replies
- 3.3k views
I'm leaning BHO programming with this tutorial. />http://www.codeproject.com/KB/shell/BHOinCPP.aspx I used VC6 to compile the project, and got the error: cannot convert from 'const struct _GUID' to 'unsigned long' from the line: const IID CClassFactory::SupportedIIDs[]={IID_IUnknown,IID_IClassFactory}; SupportedIIDs is an array (class member of CClassFactory) which is declared as: private: static const IID SupportedIIDs[2]; in SDK (Guiddef.h), IID is declared as: typedef GUID IID typedef struct _GUID { unsigned long Data1; unsigned short Data2; unsigned short Data3; unsigned char Data4[ 8 ]; } GUID; the attachment is the VC6 project. Thank you for hel…
-
How to use Driver file ( *.sys ) in Delphi ?
by Gladiator- 2 replies
- 4.2k views
Hello masters I have a problem with using drivers in delphi , how i can use a driver file with sys extension , is there any chance ? Thanks.
