From Collaborative RCE Tool Library

Jump to: navigation, search

Patch Packaging Tools


Tool name: dUP
Rating: 5.0 (2 votes)
Author: diablo2oo2                        
Website: https://web.archive.org/web/20121227223736/http://diablo2oo2.di.funpic.de/dup.html
Current version: 2.26.1
Last updated: December 21, 2012
Direct D/L link: Locally archived copy
License type: Free
Description: diablo2oo2's Universal Patcher - [dUP]

Probably the most capable patcher/loader creator out there...

Some recent version history

[2.26.1]
-bugfix in [text patch] module
-bugfix: plugins did not work with "/silent" paramenter
-bugfix: patching used files did not work with "/silent" paramenter

[2.26]
-added large file support for search & replace module
-patchercode now is stored in a DLL
-updated BeaEngine.dll (4.1 rev 172)
-fixed: backup files for [attached file] module
-added new filetime plugin
-added new log message plugin
-added new backup switch plugin
-added new find next file plugin
-fixed: patcher with plugins now can be packed
-new option to run patcher after creation
-new query option in [file check] module: check for write access
-show jump destination of [event] module in patchdata list
-fixed crash when open dUP2 project with large filename
-auto backup unsaved projects
-improved save system
-minor fixes

[2.25]
-bugfix: open files in sharemode
-new disassembler engine: BeaEngine
-improved search & replace comparison
-plugin dlls are loaded now on patcher startup
-updated plugin development kit
-added option to turn off backup by default

[2.24]
-improved compatibility for windows 2000
-usage of reg.exe instead of regedit.exe for registry patching
-added regular expressions (PCRE) support to [Text Patch] module
-added regular expressions (PCRE) support to [Registry Check] module
-added new plugin "Check Windows Version"

[2.23]
-fixed music playback bug
-fixed bug: open *.dUP2 files with dup2.exe
-fixed bug: crash when option "do not check original bytes" is enabled
-fixed bug: commandline parameter "/startupworkdir" did not work
-any bytepattern format will be accepted when it is pasted
-added plugin support
-added ASLR support
-added DLL patching support for the loader

[2.22]
-added console output for patcher
-fixed bug in "silent" mode
-fixed bug when using "multi-wildcard-mode"
-new option to fix the CheckSum in PE Header after patching
-more detailed patchlog
-removed "xmstrip"
-added console command (/setvar) for setting %dup2_cmd_var%
-new logo (thank you kr8Vity!)
-new menu structure

[2.21]
-new option to keep original file time and date
-new option to disable the WOW64 File System Redirector (for 64 Bit Patching)
-new option to import multiple file attachments
-new: tooltip for bytepattern shows now also the ASCII text of the bytepattern
-bugfix: inline patching should now also work on windows 7
-bugfix: improved inline patching method
-text patch: single wildcards (?) will not be cut out any longer at end and begin of the 'Find Text'
-added new "Registry Check" module
-improved access to 64 Bit registry (small bugfix)
-improved menu structure of dup2 gui (adding patchdata is now easier)
-bugfix: crash when open project

[2.20]
-added wildcard support for textpatch module
-windowresize bugs fixed
-minimize patcherwindow with rightmouseclick
-added new "Event" module for patcher. Now you can programm your patcher!
-added new "File Check" module for patcher
-bugfixes in textpatch module
-bugfix: executing attached files
-bugfix: problem with nested environment variables
-bugfix: tooltips will be shown without flicker effect on windows 7
-bugfix: increased pattersize limit for search & replace compare module
-fix: remove quotation marks from paths when reading fom registry

[2.19]
-new "Text-Patch" module !
-bugfix in s&r compare module
-other bugfixes from v2.18
-added linkcursor in patcherwindow
-registry editor now can import v5 reg files
-faster scrolltext engine
-better scrolltext font management
-new function: import long hexpatterns in offset-patch-dialog
-fixed loader_installer bug
-added support for relative paths (subfolders) for the targetfiles
-search & replace comments bugfix
-loader: registrypatcher bugfix
-added new internal environment variable: %dup2_last_path%
-skincontrols now can have transparent backgroundcolor (FFFFFFFF)
-now you can execute multiple search&replace loaders from same directory

[2.18]
-replaced WinExec API by ShellExecute for Windows Vista
-bugfix in Dialog for editing S&R Pattern Occurrence
-added check for skin button IDs
-improved window resizing engine
-added option "trim to path" for Registry Paths
-loader can save now targetfilepath to inifile when its not in same folder
-added TitchySID player for .sid file playback
-added new option for attached files: overwrite existing file
-added support for disabled patch button skin
-added multilanguage support
-fixed bug with tooltip width. long hexpatterns are displayed now in multiple lines
-compiled with new MASM v10
-bugfix when executing attached files
-bugfix for resource (skin) updater
-strings for patcher.exe can be modifed now inside a skin

[2.17]
-improved dup2 plugin for ollydbg v1.10
-long comments for search&replace patchdata now possible
-new v2m player (vista compatible) from http://magic.shabgard.org
-use targetfile information from s&r dialog in CheckOccurrence Dialog
-added function "back to releaseinfo" in patcher logbox
-bug fixed on vista systems with music playback
-"patch" button will be disabled after patching
-some fixes in projectconverter (for old v1.x dup projects)
-changed handling with unresolved environment variables
-original bytes not saved to compiled patcher when
"dont't check original bytes" option is enabled
-fixed bug when saving columnswidth of listviews
-new for Attached File: delete file after execute
-new for Attached File: wait for process
-added support for PECompact (optional commandline settings)
-manifest in resource is now avaible by default
-patcher: last used filepath will be stored inside %dup2_last_file% environment variable
-removed the ugly "flicker"-effect on bitmap buttons
-improved dumping (open projects from patcher.exe)
-advanced registry patching (usage of placeholders)
-changes in bitmapbutton code (please only use new
button names: BTN_PATCH_OVER ...)
-added fade in/out effect for patcher
-problem with the patchers topmost windows fixed
-removed option from settings dialog: dup file association
-important bugfix in loadercode (patching of protected memory)
-added option for registry patches: resolve environment variables
-fixed bug for musicplayback with bassmod.dll
-added textscroller feature
-fill patchinfdialog with default info only when new project is created
-and many more...
Also listed in: Loader Generators, Memory Patchers, Patcher Generators
More details: Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry)



Tool name: Memory Hacking Software
Rating: 5.0 (2 votes)
Author: L. Spiro                        
Website: http://www.memoryhacking.com
Current version: 6.1
Last updated: December 5, 2009
Direct D/L link: http://memoryhacking.com/MemHack/MHS6.1.rar
License type: Free
Description: Highly advanced software for memory search/analysis and trainer creation. Recommended!

MHS 6.1 (bundle):
Bundle includes MHS.exe, MHS Help.chm, zlib1.dll, and ChangeLog.txt.


Features:
* Fastest Searching
-- Data-Type Search
-- Pointer Search
-- String Search (ASCII, Unicode, Hex Bytes, Wildcard, Regular Expressions)
-- Group Search (Includes Pattern Matching)
-- Expression Search (Extremely Flexible)
-- Script Search (The Ultimate in Custom Searching)

* Debugger
-- Very Stable
-- Customizable Breakpoints

* Disassembler

* Code Filter
-- Easiest Way to Find Functions

* Auto-Hack

* Auto-Assembler
-- 90% Same Language/Syntax as in Cheat Engine

* DLL Injector
-- Injects any DLL into the Target Process
-- Uninject Later, Automatically or Manually
-- Remotely Call ANY Functions in the Injected DLL(s), Regardless of Calling Convention, Return Type, or Number of Parameters

* Integrated Script Language
-- IDE/Compiler Built-In
-- Syntax Matches C; No Learning Curve
-- Compiled for Fast Execution
-- Full API
-- Includes Features Specially for Hacking

* Real-Time Hex Editor
-- Fully Featured Real-Time Hex Editor for Both RAM and Files
-- Allows Browsing of Kernel RAM

* Kernel Driver
-- Allows Bypassing Anti-Cheat Systems
-- Allows Reading/Writing of Kernel RAM

* Converter

* RAM Watcher

* Memory Allocator
-- Allocates Memory in the Target Process
Also listed in: Code Coverage Tools, Memory Data Tracing Tools, Memory Search Tools, Trainer Generators
More details: Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry)



Tool name: PEBundle
Rating: 5.0 (1 vote)
Author: Jeremy Collake / Bitsum Technologies                        
Website: http://www.bitsum.com/pebundle_order.php
Current version: 3.20
Last updated: July 18, 2009
Direct D/L link: Locally archived copy
License type: Shareware
Description: One of the most advanced EXE/DLL/arbitrary file bundlers ever, especially known for its ability to load bundled DLLs bundled to an EXE directly from memory, without dropping '''anything''' to disk (by way of its own custom implemented PE loader).

Sadly, PEBundle was discontinued (possibly partly brought back again though, see below) when the core technology was purchased by Thinstall, and you can find more info about it in this forum thread:

http://www.bitsum.com/smf/index.php?topic=84.0

There is some confusion regarding if the business deal with Thinstall was later revised or nullified, which can be partly implied by the following thread (I've also read more explicit info regarding this somewhere else, which I cannot find at the moment), where the last post by the author is made a good while '''after''' the discontinuation message in the above thread:

http://www.bitsum.com/smf/index.php?topic=3.0

Because of the uncertain state/future of this product, I've uploaded the trial version from the website mentioned above (which is btw not linked from the rest of the website, only "invisibly" remaining there, indexed by google).


Official info from the product website:

PEBundle is a revolutionary tool that allows for DLLs or other files to be "bundled" with an executable, therefore removing the requirement to distribute the bundled files separately from the application. With two operational modes, one that uses advanced techniques to resolve dependencies on a bundled DLL in memory, and another that writes the bundled file(s) to disk, PEBundle is a great tool to optimize software distributions.

PEBundle Features:

* Effective static linking of a dynamic link library.

* Makes applications and the bundled modules more difficult to reverse engineer and/or tamper with.

* Helps to hide and protect the bundled modules.

* Bundling of modules the application is dependent on allows for the application to be distributed as a single executable that is capable of installing modules it needs on the fly.

* Reduces Dynamic Link Library version problems, a.k.a. “DLL Hell”. This problem is described by Microsoft in MSDN and they actually recommend that applications have their own copies of DLLs so that they will not cause version problems when they overwrite the system copy of the module.

* Supports bundling of scripts to their respective interpreters and auto-launching.

* Works with PECompact, so that your applications and all the modules may be compressed significantly. The write-to-disk module does have internal support for compression of the bundled modules.

* Full support for Windows 95/98/Me/NT/2k/XP. The advanced bundle does hook and support wide character, Unicode, APIs.


OVERVIEW OF IN-MEMORY BUNDLING BY PEBUNDLE:

This mode, called the "Advanced Bundle" in the GUI, allows dynamic link libraries to be bundled with an executable and have all references to those modules resolved at runtime to the appropriate memory addresses without ever writing the dynamic link libraries to disk*. The dependencies are resolved through the use of API hooks by the PEBundle loader, which is attached to the application.


OVERVIEW OF "WRITE-TO-DISK" BUNDLING:

In this mode, PEBundle simply uncompressed and extracts the modules to disk at runtime. This mode supports the bundling of any type of file.

The modules may be extracted to a location the user specifies at the time of bundle, and can optionally only be extracted if the module or a newer version of it does not already exist.
Also listed in: DLL Bundling Tools
More details: Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry)



Tool name: Serial Sniffer Creator
Rating: 5.0 (1 vote)
Author: MouradPr/AT4RE                        
Website: http://www.at4re.com
Current version: 2.0
Last updated: July 24, 2008
Direct D/L link: Locally archived copy
License type: Free
Description: Serial Sniffer Creator is a Cracking Tool to help you make a serial sniffer for any program and you can use it also as a Loader Creator.
===
[What new in this version 2.0 ]
1 - New wonderfull skin => thanks to RobenHoodArab <=.
2 - Browse button to choose your target.
3 - Scroller Text.
4 - Color button to choose the scroller text color.
5 - Patch memory that allow you to patch target addresses in memory.
6 - Save Dialog to save the sniffer file to the specified location.
7 - Only receiving HEX values from user.
8 - Default button to write a default How To Use text.
9 - Generating the Sniffer.exe file when starting the program and delete it when closing it.
10 - Update the Sniffer.exe file (New Skin - EditBox for Software Name - EditBox for How to use - Scroller Text).
11 - Support xm music files.
12 - you can now modify the default skin by modifying the skin.ss file with any ResEditor.
13 - Many Bugs Fixed.
===
Also listed in: Loader Generators
More details: Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry)



Tool name: THYloadergen
Rating: 5.0 (1 vote)
Author: veyl/THY                        
Website: N/A
Current version: 0.6
Last updated: March 6, 2010
Direct D/L link: Locally archived copy
License type: creditware
Description: features:
* memory patch packed targets (except process redirected ones, like armadillo debugblocker)
* patch:VA (patch at a virtual address)
* patch:SnR (patch by search&replace)
* hookAPI (specify an API call that is executed after target is fully unpacked. hit count can be specified)
* hookVA (specify a VA that is executed after target is fully unpacked. hit count can be specified)
* wnd (specify a window that is created after target is fully unpacked)
* inject a dll into the process to have the possibility to include more complex stuff than the patching provided. (no live injecting, as this is a loader)
* optional splash screen at startup (pic can be specified, aswell as the transparency)


veyl/THY, MAR/2010
Also listed in: Code Injection Tools, Loader Generators, Memory Patchers, Patcher Generators
More details: Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry)



Tool name: The aPE
Rating: 5.0 (1 vote)
Author: ap0x                        
Website: http://ap0x.jezgra.net/patchers.html
Current version: 0.1.2.21 beta
Last updated:
Direct D/L link: Locally archived copy
License type: Free
Description: The aPE is a patcher program that can be used to patch packed/protected executable files. This is done by code insertion in packer/protector code so that the program can be patched normaly without the unpacking of the packed file. This means that you can now make smaller patches for packed executables. There is no more need for distribution of larger unpacked files... The aPE can patch tham while they are still packed!

:: Which packers are supported?
The complete list of the supported packers and their options can be found here. Curently there are 91 supported packers, and every packer has it`s own patching procedure. There is also a generic inline patching method that can patch many packers/crypters/protectors.

!ExE Pack 1.x
32Lite 0.3a
[G!X]`s Protector 1.2
ACProtect/UltraProtect 1.3x - 2.x
Alex Protector 1.0 beta2
ARM Protector 0.1
ASPack 1.x - 2.x
ASProtect 1.x - 2.x
BJFNT 1.3
CodeCrypt 0.15x - 0.16x
DEF 1.0
dePack
dot Fake Signer 3.x
Enigma 1.x
EP Protector 0.3
EXE32Pack 1.4x
exeFog 1.2
EXEStealth 2.7x
eXPressor 1.2.x - 1.3.x - 1.4.x
EZip 1.0
FSG 1.xx & 2.0
GHF Protector (pack) 0.1
HidePE 2.1
HidePX 1.4
hmimysPacker 1.x
JDPack 1.x
JDProtect 0.9
KByS Packer 0.2x
Krypton 0.4 & 0.5
LameCrypt 1.0
MEW 1.x
NeoLite 2.0
NoodleCrypt 2.0
nSPack 2.x - 3.x
NWCC
ORiEN 2.12
PackItBitch
PackMan 0.0.0.1
PC PE Encryptor alpha
PC Shrink 0.71
PE Diminisher 0.1
PE Lock NT 2.04
PE Pack 1.0
PEBundle 2.0x - 3.x
PECompact 1.3x - 1.8x & 2.x
PELock 1.x
PEncrypt 4.0
PESHiELD 0.25
PESpin 1.x
PEStubOEP 1.6
PeTite 1.x - 2.x
PeX 0.99
PKLite32 1.x
PolyCrypt PE 2.1.5
Polyene 0.01
PUNiSHER 1.5
Re-Crypt 0.15 & 0.714
SDProtector 1.x
ShrinkWarp 1.4
Simple UPX-Scrambler
SimplePack
SLVc0deProtector 1.11
SmokesCrypt 1.2
Software Compress 1.2 (lite)
SPEC b3
SPLayer 0.08
StealthPE 2.1
Stone`s PE Encryptor 2.0
SVKP 1.x
tELock 0.4x - 0.92
UG Chruncher 0.x
UPolyX 0.4 & 0.5
UPX 0.8x - 1.9x
UPX Inkvizitor
UPX Protector 1.0x
UPX-Scrambler RC 1.x
UPXCrypt
UPXFreak 0.1
UPXLock 1.0nPack 1.x
UPXRedir
UPXScramb 2.x
UPXShit 0.06 & 0.0.1
VirogenCrypt 0.75
VProtect
Winkript 1.0
WinUPack 0.2x - 0.3x
WWPack32 1.x
yC 1.x
yP 1.0.2 & 1.03.2
Also listed in: PE Executable Editors, Patcher Generators
More details: Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry)



Tool name: whoknows NET patcher
Rating: 5.0 (1 vote)
Author: whoknows                        
Website: http://portal.b-at-s.info/download.php?view.448
Current version: 0.7
Last updated: January 2, 2010
Direct D/L link: Locally archived copy
License type: Free
Description: The purpose of this utility is to make something like dUP for NET assemblies.
also patches the target and resign it to user machine.
Also you can save and load Projects.
Also listed in: .NET Patcher Generators
More details: Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry)



Tool name: JABi (Just Another Bin2inc)
Rating: 0.0 (0 votes)
Author: PsYcHoCoDe                        
Website: N/A
Current version: 0.0a
Last updated: April 20, 2012
Direct D/L link: Locally archived copy
License type: Freeware
Description: -> What's NEW in v.0.0a:
+ SYNTAX: the D programming language now supported :P
+ SYNTAX: Windows Registry Entry
+ Added: lil' bit better documented plugin sample and SDK...
+ Added: CRC32 internal function is now accessible for use in your plugins ;)
- Bugfix: tiny C syntax problem...
Enjoy! ;)

*** WHAT THE HELL iS THAT?!
-> JABi is a binary file to source include file generator. The 'syntaxes' are the supported output formats >:)

*** Why could i possibly need ANOTHER tool for this job?!
-> JABi is actually *REALLY FAST* and *TINY* (pure ASM code), totally commandline driven (to use it in your compilation scripts), has support for Pre/PostProcessing PLUGINS! and currently supports MASM/TASM/FASM, C, NASM, D language and Windows Registry Entry Syntaxes. I'm planning on expanding the 'supported syntax' list, depending on your feedback, of course, any suggestions are encouraged ;)

*** You said something about pre/postprocessing plugins -> now what the hell is that?!
-> These plugins are actually DLLs, so one could easily expand his JABi features :P Preprocessors receive control just before the actual dumping of the binary file to the memory, while postprocessors execute right after the dumping to memory! So basically, the coder has the full control over what is getting dumped and how it's gonna look in the end of the process >:) The only limit is the coder's imagination actually :P

*** That sound's nice, actually... So, how do I create a new *Processor?!
-> I've included a lil' SDK in the package. It's done in MASM32, but i'm ready to include user contributed SDK's in the package, any ports of the SDK will be appreciated. I just code mostly asm.

*** Are combined plugins a supported option?! (PREPROCESSOR+POSTPROCESSOR=Single Plugin)
-> Yep, they sure ARE supported. However, if you specify such a combined plugin only as a POSTPROCESSOR on the command line, it's PREPROCESSING phase WILL NOT BE executed, and vice versa. If one want's to use BOTH processor phases, he MUST supply BOTH PRE and POST parameter @ the command line the given plugin's name. Actually the plugin example, bundled with the SDK is such a combined processor ;)

*** I LiKE the tool! How could I assist in the further development?
-> You could send plugins you've developed, send samples of other syntaxes, that aren't currently supported by JABi, so i am able to further expand the list... I'm open to any kind of support and ideas on this tiny project.

PS: I believe there's need for a new category for this kind of tools (binary/source embedders maybe, just an idea), since they're must-have for anyone, who digs selfmodifying code, be it a software protectionist, reverse engineer or whatever. The problem comes, when one get's to need one of those, since there're plenty of 'solutions' in the field, but almost none of them is actually suitable for such coder's needs... :/ That was actually why I coded this one... I hope you'll like it...
Also listed in: Assemblers, Code Snippet Creators, Installer Tools, Needs New Category, Source Code Tools, Specific by Compiler, Tool Extensions
More details: Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry)



Tool name: Magic Trainer Creator
Rating: 3.0 (1 vote)
Author: Corsica Productions                        
Website: N/A
Current version: 1.270
Last updated:
Direct D/L link: Locally archived copy
License type: Free
Description: A good trainer creator tool.
Also listed in: Memory Search Tools, Trainer Generators
More details: Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry)


RSS feed Feed containing all updates and additions for this category.

RSS feed Feed containing all updates and additions for this category, including sub-categories.


Subcategories

There are 4 subcategories to this category.





Views
Category Navigation Tree
   Needs New Category  (3)