Leaderboard

A collection of tutorials aimed particularly for newbie reverse engineers. 01. Olly + assembler + patching a basic reverseme 02. Keyfiling the reverseme + assembler 03. Basic nag removal + header problems 04. Basic + aesthetic patching 05. Comparing on changes in cond jumps, animate over/in, breakpoints 06. "The plain stupid patching method", searching for textstrings 07. Intermediate level patching, Kanal in PEiD 08. Debugging with W32Dasm, RVA, VA and offset, using LordPE as a hexeditor 09. Explaining the Visual Basic concept, introduction to SmartCheck and configuration 10. Continued reversing techniques in VB, use of decompilers and a basic anti-anti-trick 11. Intermediate patching using Olly's "pane window" 12. Guiding a program by multiple patching. 13. The use of API's in software, avoiding doublechecking tricks 14. More difficult schemes and an introduction to inline patching 15. How to study behaviour in the code, continued inlining using a pointer 16. Reversing using resources 17. Insights and practice in basic (self)keygenning 18. Diversion code, encryption/decryption, selfmodifying code and polymorphism 19. Debugger detected and anti-anti-techniques 20. Packers and protectors : an introduction 21. Imports rebuilding 22. API Redirection 23. Stolen bytes 24. Patching at runtime using loaders from lena151 original 25. Continued patching at runtime & unpacking armadillo standard protection 26. Machine specific loaders, unpacking & debugging armadillo 27. tElock + advanced patching 28. Bypassing & killing server checks 29. Killing & inlining a more difficult server check 30. SFX, Run Trace & more advanced string searching 31. Delphi in Olly & DeDe 32. Author tricks, HIEW & approaches in inline patching 33. The FPU, integrity checks & loader versus patcher 34. Reversing techniques in packed software & a S&R loader for ASProtect 35. Inlining inside polymorphic code 36. Keygenning 37. In-depth unpacking & anti-anti-debugging a combination packer / protector 38. Unpacking continued & debugger detection by DLL's and TLS 39. Inlining a blowfish scheme in a packed & CRC protected dll + unpacking Asprotect SKE 2.2 40. Obfuscation and algorithm hiding

hey guys i create a program for serial sniff by vb6 esc features : check crc(automatic) unicode string small size background music bypass packers and ..... sorry for my english (im persian) enjoy it

============================ AT4RE Power Loader v0.1 (Release Date: 26/03/2025) ============================ [+] Console interface [+] Loader Coded in C++ with CRT (big Size: 85 KB when compressed about 190 KB uncompressed). [+] Supports patching single or multiple Relative Virtual Addresses (RVAs). Root Folder Contents: [+] ATPL.EXE (AT4RE Power Loader) [+] Version History.txt ============================ AT4RE Power Loader v0.2 (Release Date: 16/04/2025) ============================ The most powerful loader against strong and hard protectors. It also works with medium-level protectors, packers, compressors, and even unprotected executable files. Main Features: [+] GUI Coded in Borland Delphi 7 [+] From the GUI, you can browse to select the target file (maximum filename length is 255 characters). [+] You can also copy and paste the file name into the input field. [+] Choose between x32 and x64 loader versions. [+] Loader data can be entered only in the format shown in filed or in the screenshot. [+] Set a base timeout in milliseconds (Minimum: 00, Maximum: 9999 — i.e., 9.99 seconds). [+] Set 1-byte opcodes in the Opcode field using HEX characters (Opcode is the Original First Byte of RVA1). [+] Configure Opcode Timeout in milliseconds (Minimum: 00, Maximum: 9999 — i.e., 9.99 seconds). [+] Set the Loader Timer Delay in microseconds (Min: 00, Max: 9,999,999 — i.e., 9.99 seconds). [+] Configure the loader to start as Administrator. [+] Directly pack the loader with UPX. [+] Generate Loader.exe [+] Save or open projects for future use from File menu. [+] Set the GUI to "most on top" from the View menu. [+] Access the official website, report bugs, and find more information via about in the Help menu. Loader Details: [+] Coded in C++ using the Windows Pure API. [+] Loader size is 10 KB uncompressed, and 5 KB when compressed. [+] Supports Windows 7, 8, 10, and 11 (both x32 and x64). Features include: [+] Anti-ASLR [+] Anti-Anti-Debug [+] Anti-CRC Check [+] Automatically detects the base address. [+] Detects when the protector unpacks code into memory. [+] Can apply temporary patches after a specified delay in microseconds (Patch and restor original bytes). [+] Can apply permanent patches only with 00 Flag [+] Supports patching single or multiple Relative Virtual Addresses (RVAs). [+] Capable of patching up to 2048 bytes. [+] Can run as Administrator or Normal user mode. Root Folder Contents: [+] Project folder (Save or open projects for future use) [+] UPX folder (includes upx32.exe and upx64.exe) [+] ATPL.EXE (AT4RE Power Loader) [+] Version History.txt ============================ AT4RE Power Loader v0.3 (Release Date: 10/05/2025) ============================ The most powerful loader against strong and hard protectors. It also works with medium-level protectors, packers, compressors, and even unprotected executable files. Main Features: [+] Added Support Patching DLLs (Only DLLs Loaded by Target.exe). [+] Added Drag Drop Feature: For .EXE, .REG, .ICO Files. [+] Added Insert Loader Data feature (For Respect the Correct Format). [+] Added Registry Keys Manager (Max size: 1 KB / 1024 characters). [+] Added Delete Files feature (Max size: 1 KB / 1024 characters). [+] Added Icon Changer. [+] Added New Project option from File menu (Clears all fields). [+] Added Commands Shortcut Ctrl+N, Ctrl+O, Ctrl+S in File menu. [+] Added Contact Us section from Help menu. [+] Updated About from Help menu from box to a form. [+] Updated display fonts for Loader Data, Registry, and Files. [-] Removed "My Target run as admin". Loader Details: [+] Size is now 17 KB uncompressed, 7 KB when compressed. [+] Loader now Support Patching DLLs (Only DLLs Loaded by Target.exe). [+] Loader can now add or delete registry keys. [+] Loader can delete files. [+] Automatically requests Run as Administrator when needed (e.g.,Target need administrator privilege, modifying registry or deleting files from protected folders). [+] Icon support added. Root Folder Contents: [+] Icons folder (includes 5 icons). [+] Lib folder (includes bass.dll). [+] Project folder (Save or open projects for future use). [+] ResH folder (includes ResHacker.exe). [+] UPX folder (includes upx32.exe and upx64.exe). [+] ATPL.EXE (AT4RE Power Loader). [+] Version History.txt ============================ AT4RE Power Loader v0.4 (Release Date: 16/05/2025) ============================ The most powerful loader against strong and hard protectors. It also works with medium-level protectors, packers, compressors, and even unprotected executable files. Main Features: [+] Added Import menu. [+] Added Support .1337 patch files exported by x64dbg. [+] Set Opcode automatically when Load .1337 file. [+] Added OpenDialog when Double Click on: - Target Name field. - Loader Data field. - Registry field. - Custom icon field. Loader Details: [+] Fixed bug with registry feature. [+] Default icon changed. [+] Compressed Loader with Default icon 8 KB. Root Folder Contents: [+] Icons folder (includes 5 icons). [+] Lib folder (includes bass.dll). [+] Project folder (Save or open projects for future use). [+] ResH folder (includes ResHacker.exe). [+] UPX folder (includes upx32.exe and upx64.exe). [+] ATPL.EXE (AT4RE Power Loader). [+] Version History.txt

I want to release a new tutorial about the popular theme Themida - WinLicense. So I see there seems to be still some open questions mostly if my older unpack script does not work anymore and the unpacked files to, etc. So this time I decided to create a little video series on how to unpack and deal with a newer protected Themida target manually where my older public script does fail. A friend of mine did protect unpackme's for this and in the tutorial you will see all steps from A-Z to get this unpackme successfully manually unpacked but this is only one example how you can do it, of course. So the tutorial [videos + text tutorial] is very long and has a run-time of more than three hours and of course it will be necessary that you also read the text parts I made at the same time if possible but if you are already a advanced user then you will have it easier than a newbie. So I hope that you have enough patience to work through the whole tutorial. So the main attention I set on all things which happen after normal unpacking so the unpack process is the simplest part and all what comes after is the most interesting part and how to deal with all problems that happen. It's more or less like a live unpack session. I also wrote some small basic little helper scripts which you can also use for other targets to get valuable information if you need. Short summation: Unpacking Exception analysing VM analysing with UV plugin AntiDump's find & fixing & redirecting "after fix method" Testing on other OS My Special Thanks goes to Lostin who made this unpackme and others + OS's tests. (I want to send a thank you to Deathway again for creating this very handy and helpfully UV plugin). So this is all I have to say about the tutorial so far, just watch and read and then try it by yourself. Oh! and by the way I record ten videos and not only one. If something does not work or you have any problems with this tutorial, etc. then ask in the support topic only. Don't send me tons of PM's, OK! Thank you in advance. PS: Oh! and before someone has again something to complain because of my tutorial style [goes to quickly or is bad or whatever] then I just want to say, maybe you're right so normally I don't like to create and write tutorials. This is really not my thing so keep this in your mind.

DriverMonitor Enhanced Edition (Alpha) Enhance - 1 - Support for file dragging operations has been implemented, allowing direct setting of the path for the corresponding driver file. - 2 - Drag-and-drop operation compatible with administrator mode has been implemented. - 3 - Folder directory redirection in 64-bit environment has been disabled. Modified by boot @ tuts4you Date July 6, 2026

IDA Palette (or its project name: ifred) is a plugin which provides fast search on IDA Pro's commands/menu items or searches through its strings output! This plugin provides 2 keyboard shortcuts: Ctrl + P : Searched through IDA's commands Ctrl + Shift +P : Searched through IDA's string output

So this is my first upload - I hope I am doing this right. I have included all the protections in the screenshots being used. Good luck

The Hex-Rays Decompiler plugin for better code navigation in RE process. CodeXplorer automates code REconstruction of C++ applications or modern malware like Stuxnet, Flame, Equation, Animal Farm ... Features: Automatic type REconstruction for C++ objects. To be able to reconstruct a type using HexRaysCodeXplorer one needs to select the variable holding pointer to the instance of position independed code or to an object and by right-button mouse click select from the context menu «REconstruct Type» option. Virtual function table identification - automatically identifies references to virtual function tables during type reconstruction. When a reference to a virtual function table is identified the plugin generates a corresponding C-structure. As shown below during reconstructing struct_local_data_storage two virtual function tables were identified and, as a result, two corresponding structures were generated: struct_local_data_storage_VTABLE_0 and struct_local_data_storage_VTABLE_4. C-tree graph visualization – a special tree-like structure representing a decompiled routine in citem_t terms (hexrays.hpp). Useful feature for understanding how the decompiler works. The highlighted graph node corresponds to the current cursor position in the HexRays Pseudocode window Ctree Item View – show ctree representation for highlighted element Extract Types to File – dump all types information (include reconstructed types) into file. Navigation through virtual function calls in HexRays Pseudocode window. After representing C++ objects by C-structures this feature make possible navigation by mouse clicking to the virtual function calls as structure fields Jump to Disasm - small feature for navigate to assembly code into "IDA View window" from current Pseudocode line position. It is help to find a place in assembly code associated with decompiled line. Object Explorer – useful interface for navigation through virtual tables (VTBL) structures. Object Explorer outputs VTBL information into IDA custom view window. The output window is shown by choosing «Object Explorer» option in right-button mouse click context menu Support auto parsing RTTI objects This plugin is recompiled by disauto UPDATE 29.10.2024 Recompiled for IDA Pro v9.0 Windows x86_64

The idea for this project was to provide a means of publication for interesting articles. Not everyone likes to write tutorials, and not everyone feels that the information they have is enough to constitute a publication of any sort.We all run across interesting protections, new methods of debugger detection, and inventive coding techniques.We just wanted to provide the community with somewhere to distribute interesting, sometimes random, reversing information. While the title of this ezine says ARTeam, we prefer to think that we are acting as a conduit. We really hope that you find this project interesting, and we really want this to be a community project. So if you have an idea for an article, or just something fascinating you want to share, let us know and hopefully we will see a ezine #. It soon became apparent that the scope of this project went well beyond what we had predicted. A big thanks goes out to all the contributors. Without you this would be a blank page. We also need to thank everyone who has viewed, refined and commented on the production of this ezine. Hopefully we have been able to provide the reversing community something interesting. The reversing community has been very dynamic in the past few years. We've seen a ring GUI debugger grow in startling popularity. We've seen protection authors dig deeper into the OS in an effort to deter crackers. Unique protections have provided months of analysis for reversers. New inventive tools have been developed in the re-versing community in an effort to effectively analyze and understand software protection. And ironically we see some of these tools move back to ring0. None of these changes and achievements would have been possible without the amazing and talented reversers that take the time to share their knowledge and teach others. No matter what team you belong to, what level you reverse at, what language you speak, you all make up the same community. A group of people who constantly strive for discovery. None of us are content with accepting things "as they are" we need to know why. We are the scientists of software. We dig deeper than the average user, we see code where everyone else see flashy presentation. We learn this code so well that we can rewrite it, manipulate it, and even improve on it. Since these are my thoughts, I just want to thank every single member of the reversing community. I couldn't even begin to name every single person who has provided a contribution. We are all spread out among many boards, many teams, even many countries. But I like to think that we all share a certain camaraderie. Please enjoy the information included among these pages, we had some talented people give us some great sub-missions.

Anti Debug Anti Tamper Delegate Proxy Resource Protect String Virtualization ControlFlow And Mutation Code Virtualization Renamer

A Windows tool for identifying and analyzing potential DLL sideloading opportunities in Portable Executable files. SideFinder is a Windows GUI application designed to streamline the discovery and analysis of DLL sideloading opportunities in Portable Executable files. It combines static PE inspection, candidate classification, dynamic monitoring, and supporting workflows in a single interface for security research and authorized testing. Features: Parses x86 and x64 PE files, including regular, delayed, bound imports, and exported functions. Identifies and ranks potential DLL sideloading candidates using contextual scoring and classification. Reviews relevant binary properties such as Authenticode signatures, CFG, CET, subsystem, architecture, and LoadLibrary usage. Resolves DLL search paths, KnownDLLs, missing libraries, and DLLs already present alongside the target application. Runs dynamic analysis to observe DLL loads and cross-reference runtime behavior with static findings. Scans complete directories and summarizes candidates across multiple executables and libraries. Optionally enriches results with the community-maintained HijackLibs dataset. Generates ready-to-use proxy or sideload DLLs with customizable payload options, including MessageBox, Shellcode Runner, and custom-code presets. Provides one-click sideload testing with a harmless MessageBox payload to confirm whether a candidate works. Exports analysis results and keeps an activity log for later review. Read the full article at redteamer.es and explore the project on SideFinder.

Goal : Find valid username & serial Compiler : C++ Platform : x64-Windows Packed : No Specification : Internal private obfuscation Rule : don't patch binary Note : there is no asymmetric encryption , so you can find it.

This is a complete archive (site rip) of all files on Tuts 4 You as of July 2011 except for the malware samples - you will need to download these directly from Tuts 4 You. I have created the torrent as directories and files rather than one archive which gives you the option to download files individually or in categories. The entire collection is 3.69 GB of which some sections may be of little interest to some but you have the option of downloading what you want. This collection will be updated annually so please check at the following link for the official and up-to-date torrent file. Base 32 Hash-ID magnet:?xt=urn:btih:slpgvubkpp4dyhxbaxpmogludkgmw7wi Base 16 Hash-ID magnet:?xt=urn:btih:92DE6AD02A7BF83C1EE105DEC719741A8CCB7EC8 Please remember to seed the torrent and help share the knowledge within the reversing community. I hope this satisfies the leechers, thank you! File/ Directory Listing Tuts 4 You - Collection 2011.md5

This (completely!) free version of IDA offers a privilege opportunity to see IDA in action. This light but powerful tool can quickly analyze the binary code samples and users can save and look closer at the analysis results. What’s included in the pack? Analyze both 32-bit and 64-bit applications Cloud-based x64 decompiler Local x86/x64 debugger included Support x86/x64 processors Save your analysis results Perpetual license The freeware version of IDA v7.6 comes with the following limitations: no commercial use is allowed lacks all features introduced in IDA > v7.6 cloud-based decompiler lacks certain advanced commands lacks support for many processors, file formats, etc… comes without technical support

Various Cartoon Diablo Universal Patcher Skins Cartoon_Diablo_Universal_Patcher_Skin_Shrinked.7z

Hey everyone, I put together a small challenge for anyone interested in reversing .NET protections. This one is packed using .NET Reactor v7.5.9.1 with some pretty aggressive settings, along with a bit of custom anti-tamper logic on top. Your goal is to unpack the application and recover a clean, working assembly. Protections Enabled NecroBit String Encryption Obfuscation Anti ILDASM Hide Method Calls Code Virtualization Anti Tampering Anti Debug Merge Enums Control Flow Obfuscation (Level 9) Additional Protections Custom runtime anti-debug Anti-injection checks Integrity verification A background watchdog thread 🎯 Objectives 1. Primary: Unpack the application and produce a clean assembly that runs without errors 2. Bonus: Recover the correct password (completely optional)

Hi, First of all i have to say " this is not my project and some friend ask me to upload challenge here " Compiler : .NET Protection : [+] Binary Obfuscation [+] Code Virtualization [+] Anti-Debugging / Anti-Tampering [+] Maybe some other protection Rule : Patch file to accept any password or find real password ( both accepted ) i will appreciate if you write something about you have done Hint : Run & Analyze file inside VM or isolated environment becuase of file isn't mine so i'm not responsible for anything Regards

A "Crack Me" challenge created by lord "Voksi" , a well known person in the "warez" scene. And no, this challenge is not uploaded by "Voksi" himself, it's uploaded via a proxy which is myself, an old friend of "Voksi" . GOAL: Obtain the Correct key Greetings to MasterBootRecord, Voksi, FJLJ, And also a few others, you know who you are ❤️

File protected by .NET Reactor v7.3 having /Code Virtualization/ enabled. By nature the application using /Dependency Injection/, the 3rd party files embedded to main exe (see shot2). Find registration combination and reply it with the success message!

I want you guys who are capable of unvirtualizing and unpacking them to upload the final ones. These files are just the same part of the codes virtualized which are 2 lines of the original mfc source codes. So if you can unvirtualize them and unpack them, please upload the final ones. Any other protections are excluded absolutely. Give it a try and improve your skills. Best Regards. sean.

The Entry Point is virtualized. 2 Parts of the codes are also virtualized. [Your Mission] Just unpack this file and make it run well without any errors or termination. No devirtualiztion are necessary.

Today I release an unpacker script for Enigma Protector. Maybe you know that I created another unpacker script for Enigma in the past which no-longer works for protected Enigma files greater than 3.70+ and this is the reason why I wrote a new script, Enigma Alternativ Unpacker 1.0. So what is new in this script? This script will unpack your Enigma protected files and dump the used outer virtual machine. This means you do not need to use the DV / Enigma plugin which is used in my other script. Of course the virtual machine will be still virtualized but your unpacked files will work. It is not the best solution but for the moment it is a good "alternativ" and a working solution. Features of the script: ( 1.) Unpacking of ENIGMA 1.90 - 3.130+ ( 2.) RegSheme Bypass & HWID Changer ( 3.) Enigma CheckUp Killer ( 4.) VirtualMemory Dumper 1.90 - 3.x+ & SC Fixer M1 ( 5.) UIF Tool Necessary Sometimes! ( 6.) Enigma Intern Export & VM Scan + Log ( 7.) Improved Import Emulation Fixer ( 8.) Supports Exe & Dll Files [dll at EP!] This new script again covers almost all the protection features of Enigma Protector like my other script but it has been improved and I have added some extra things that you will see when you get to use it. I have created four video tutorials for you where you can see what you have to do in some of the different situations you may experience. Be sure that you "watch the videos" before you use the script to prevent some unnecessary questions where you can already find the answers if you watch them and then read my added text files. I also made an UnpackMe set with six different protected files (watch videos how to unpack all of them). If something does not work for you or if you get any trouble or have any questions then just post a reply on the topic (linked above) to get an answer.

Life is Strange skin template for AT4RE Patcher Feel free to use this skin...

After a longer time I created a new SnD - version 2.2 - by request from our board member DMichael. Normally I still do not like to use Olly 2 version [many basic features missing / changed etc] but anyway... I have taken some time to create all patches in OllyDbg 2.01h like in my older version + some little more checks etc. So now you can use this version with Windows 8 [testing done by DMichael - thanks again] without any problems. If there are any problems with ASLR (for example) then you will get a message with info about the problem and what to do. I also changed the look a little, maybe you like it as I do. All is ready to go and is setup by me [.ini file like I prefer] so that you can start directly after unpacking the .rar file. Some information can be read in the info text file. Have fun with the new 2.2 version [odbg201h] and post some feedback on the board if you like it or if there is any problem. Modifications: Added PEB Hide patch Added ZWQIP patch Changed OllyDBG names Changed CPU Added SnD patch section where you can see my patches Added some new resources Added manifest for XP style [just rename manifest if you get problem to use it on other OS etc] Added quick origin pop if you press the "C" button Added Win7 | Win8 support only with static original base of SnD 2.2 Added quick self check of loaded SnD 2.2 base. If not original or a problems comes at startup then you get info message Setup of SnD .ini file + color-scheme So all was again patched like in my older SnD 2.0 / 2.1 versions plus some more checks and different patching ways of the intern ZWQIP API. Testing by me on XP SP3. Testing by DMichael on Windows 8. Thanks again. Info: If you want to use int3 breakpoints instead of HWBPs [Debugging Options] then do not set a HWBP on ZWQIP API before you did stop at TLS or EP. Don't set the HWBP at systemBP. Int3 + HWBP on ZWQIP before TLS or EP = No API patch! Int3 + No HWBP on ZWQIP before TLS or EP = Ok HWBP + HWBP = All ok no problems. Just keep this info in your mind if you wanna change the option. Info: So I also insert the original Olly version which you will also need to read all plugins so that you don't need to change the OllyDBG.exe to SND.exe name in the plugins itself.

This file is protected using DNGuard HVM 3.9.6.2 Protections used : HVM Jit Challenge is to unpack and post details of methods used.

UPX Packing Unpacking

Hi all, This is a protected with the RETAIL edition... Mutation / Virtualization w/ the built in VMProtect license system. There are 2 enter serial dialogs, once you solve the 1st, drives you to 2nd, when a valid serial entered exporting a file... If a valid serial entered on 1st form, is saved to license.diz file.

PACE/Ilok is mostly loved by the audio industry, and since we crackers don't care too much about hardcore audio apps PACE is not well documented. But this protection is actually quite decent and fun to reverse, it is not especially hard but enough to stop most mediocre crackers. However one aspect could be especially hard for the less determined. That is the driver TPkd.sys, it has some nice features that can stop you dead in your tracks. In this paper I will discuss in my opinion the best aspect of this driver, resolving the int3 stolen calls.

Welcome back! A lot of people asked me after they've read my article about inserting a message box at program start of an exe file if it's possible/how to add a splash screen to a PE. Well, yes it is possible! You can inject (theoretically) everything you want to an exe file, it just depends of your reverse engineering skills! (of your time and of your perseverance. Actually I thought about doing this, so my first step was to think about what is necessary. So let's just think about all the steps.

IDAPython plugin for postprocessing of Hexrays Decompiler output.

Lighthouse is a powerful code coverage plugin for IDA Pro and Binary Ninja. As an extension of the leading disassemblers, this plugin enables one to interactively explore code coverage data in new and innovative ways when symbols or source may not be available for a given binary. This plugin is labeled only as a prototype & code resource for the community.

MicroAVX is an extension of the IDA Pro decompiler, adding partial support for a number of common instructions from Intel's Advanced Vector Extensions (AVX). This plugin demonstrates how the Hex-Rays microcode can be used to lift and decompile new or previously unsupported instructions. There are no plans further develop MicroAVX, or extend its coverage to the complete set of AVX instructions. This plugin is labeled only as a prototype & code resource for the community.

Prefix is a small function prefixing plugin for IDA Pro. The plugin augments IDA's function renaming capabilities by adding a handful of convenient prefixing actions to relevant right click menus.

Lucid is a developer-oriented IDA Pro plugin for exploring the Hex-Rays microcode. It was designed to provide a seamless, interactive experience for studying microcode transformations in the decompiler pipeline. This plugin is labeled only as a prototype & code resource for the community. Please note that it is a development aid, not a general purpose reverse engineering tool.

Only simple algorithms - for one name one key. Provide a valid pair of name and serial, or write a keygen. Good luck.

OllyDbg is a 32-bit assembler level analysing debugger for Microsoft® Windows®. Emphasis on binary code analysis makes it particularly useful in cases where source is unavailable. OllyDbg is a shareware, but you can download and use it for free. Special highlights are: Intuitive user interface, no cryptical commands Code analysis - traces registers, recognizes procedures, loops, API calls, switches, tables, constants and strings Directly loads and debugs DLLs Object file scanning - locates routines from object files and libraries Allows for user-defined labels, comments and function descriptions Understands debugging information in Borland® format Saves patches between sessions, writes them back to executable file and updates fixups Open architecture - many third-party plugins are available No installation - no trash in registry or system directories Debugs multithread applications Attaches to running programs Configurable disassembler, supports both MASM and IDEAL formats MMX, 3DNow! and SSE data types and instructions, including Athlon extensions Full UNICODE support Dynamically recognizes ASCII and UNICODE strings - also in Delphi format! Recognizes complex code constructs, like call to jump to procedure Decodes calls to more than 1900 standard API and 400 C functions Gives context-sensitive help on API functions from external help file Sets conditional, logging, memory and hardware breakpoints Traces program execution, logs arguments of known functions Shows fixups Dynamically traces stack frames Searches for imprecise commands and masked binary sequences Searches whole allocated memory Finds references to constant or address range Examines and modifies memory, sets breakpoints and pauses program on-the-fly Assembles commands into the shortest binary form Starts from the floppy disk and much, much more!

This is my version of OllyDBG. I removed all useless plugins and put my preferred ones, and also I set-up a good configuration. With it you should be able to load any protected file (Themida for example). Sometimes you have to change some options inside plugins (with Obsidium for example), but the current setting is good in 90% of cases. It has also a more advanced loaddll.exe that allows you to load dll's in different memory locations, so you can rebuild relocations in an easy way.

Sometimes crackme's or something you might be reversing will constantly bug you due to excessive usage of F7 & F8. It will be quite neat if you can see how the application is executing visually and set you breakpoints accordingly. I know stuff like offensivecomputing.net VERA exists but most of the time it crashes. Here is my attempt and I hope you find it useful.

A premier collection of articles compiled by Fly from the now defunct UnPack China forum dated in 2007. Note that most of the content contained in this compilation is in Chinese, you may need to use a translator to fully understand some of the information it contains.

RSA Tutorial 01 - Keygenning RSA RSA Tutorial 02 - Serial Fishing RSA RSA Tutorial 03 - How to Find RSA Primes

In my previous tutorial on HASP SL (6.41.95) I demonstrated how to easily find the OEP, dumping and rebuilding of the target application. The main goal of this tutorial is to do a little more in-depth analysis, how to manually bypass the anti-debug feature and finding out what version you are dealing with etc. Also this tutorial includes a flash-movie of the manual handy work described in this tutorial. Dodging the anti-debug, finding OEP, dumping and rebuilding. All done in about 2.5 minutes! Edit: This new version of HASP SL - A Deeper Dig features some new info on the encryption, anti-dumping and how to inline patch it.

I wrote this little hook-engine for a much bigger article. Sometimes it seems such a waste to write valuable code for large articles whose topic isn't directly related to the code. This often leads to the problem that the code won't be found by the people who are looking for it. Personally, I would've used Microsoft's Detour hook engine, but the free license only applies to x86 applications, and that seemed a little bit too restrictive to me. So, I decided to write my own engine in order to support x64 as well. I've never downloaded Detour nor have I ever seen its APIs, but from the general overview given by Microsoft it's easy to guess how it works. As I said, this is only a part of something bigger. It's not perfect, but it can easily become such. Since this is not a beginner's guide about hooking, I assume that the reader already possesses the necessary knowledge to understand the material. If you never heard about this subject, you'd better start with another article. There's plenty of guides out there, no need to repeat the same things here. As everybody knows there's only one easy and secure way to hook a Win32 API: to put an inconditional jump at the beginning of the code to redirect it to the hooked function. And by secure I just mean that our hook can't be bypassed. Of course, there are some other ways, but they're either complicated or insane or both. A proxy dll, for instance, might work in some cases, but it's rather insane for system dlls. Overwriting the IAT is unsecure for two reasons: a) The program might use GetProcAddress to retrieve the address of an API (and in that case we should handle this API as well). b) It's not always possible, there are many cases as for packed programs where the IAT gets built by the protection code and not by the Windows loader. Ok, I guess you're convinced. Let's just say that there's a reason why Microsoft uses the method presented in this article.

Hooking is the practice of re-directing the flow of a program causing it to execute a code-cave or function in an injected module in place of another piece of code. In this tutorial, I will cover a method of hooking known as IAT (Import Address Table) Hooking. IAT Hooking is a 4 step process (I assume you are able to manage to inject the attacking DLL on your own).

OllyICE patched to work with TheMida, this was made by the prestigious team SnD member EvOlUtIoN. This debugger took me a long time to find on the net and since most of the links that were on the net were dead it took me like around 3 weeks to find. I hope you guys enjoy. QUOTE BY EvOlUtIoN: So, by popular demand here is the debugger I normally use to "play" with programs protected with TheMida / WinLicense. My patch is very simple but it is good to remember that OllyICE was created for the first time since Hachno, a guru when it comes to Armadillo and unpacking in general. This version has basically 2 patches that differ from the normal OllyICE: One. We do not crash when you load a file protected 2. If you add a context menu creates an entry called "TheMida OllyDbg", so depending on the target, you can open a olly or another. In the plugin folder there are all those necessary, the most important are: 1. PHANTOM plugin 2. HideOD Without these you do not ever riusicrà to load a target with TheMida without being detected. In addition there are 2 scripts, neither Dumpa the VM but at least find the OEP and aaggiustano the IAT.

MIcr0b uppp skin by alfares

by alfares

by alfares | at4re

This is a Keygen and Keyfilemaker written in PureBasic 5, similar to this one. Unfortunaly the cpu usage is quite high and I had to make dirty hacks for not resetting gadget strings. This time I didn't use transparency and fading but again chiptune support After keygeneration the keyfile should be exported using "Export Key" and it will be saved in same dir as the keygen is. Hopefully it will help someone

OllyPortable is my portable version of OllyDbg extended with plugins and patches for a good looking and decently working debugger environment. Main features: - Good looking buttons (thanks to the author of Olly Shadow) - Full portability (OllyPath.dll, source is included) - Tested & working on both XP SP3 and Win7 x64 - Manifest to make olly look less Win98 - Useful plugins, sometimes with custom patches Plugin descriptions: - analyzeThis: Analyze code outside the code section of the debugged program. - Asm2Clipboard: Quickly copy ASM code (with labels) to the clipboard. - ClearUDD: Plugin to clear the UDD directory from within olly. - CmdBar: Command bar to quickly set breakpoints/registers etc. - DataRipper: Rip selected data in various formats. - HiddenThreads: Plugin that finds hidden threads. - ICanAttach2: Plugin that fixed anti-attach tricks. - ida_sigs: Plugin to import IDA signatures to the debugged file. - IDAFicator: Great plugin with many features, check the manual. - MnemonicHelp: Simply plugin that loads a help file for the selected mnemonic. - ModuleBCL: Import&Export labels, comments and breakpoints. - multiasm_odbg: Extremely useful plugin for writing code caves. - ODbgScript: Script OllyDbg (Patched by me) - ODBJscript: Script OllyDbg using javascript - oDump: Fixed version of OllyDump that bypasses anti-dump techniques. - OllyCopy: Great plugin to copy addresses, bytes and patterns to the clipboard. - OllyFlow: Generate an IDA graph from analyzed code. - OllyWow64_0.2: Compatibility plugin for WOW64 - RemoveCriticality: Plugin that fixes an exploit that could crash the system when debugging. - SehSpy: Show the SEH context before the reached exception. - SigMaker: Easily make patterns and signatures. - StollyStruct: Plugin that allows viewing memory in structure form (Patched by me) - StrongOD: Hide & Bugfix plugin (Patched by me) - TLSCatch: Plugin that sets a breakpoint on TLS callbacks (when found) - X_CRYPTO: Plugin to hash bytes or text inside olly. I also included the help files for ODbgScript, ODBJScript, Multiasm, Win32 API and x86 opcodes. The list of patches and source code used can be found in the 'Patches' directory. Enjoy, Mr. eXoDia