Reverse Engineering Blog

VB Decompiler Pro v8.3 RETAIL INCL_KEYGEN+PATCH-FFF

What's new in this version:
- Calling VTable properties and methods from some form to any other
form now can be decompiled. For example if you change in Form1
property of object in Form2 - it can be correctly decompiled (Native Code)
- Parameters of object method/property is now typicle. If object
have parameters as boolean or single - it will be decompiled correctly:
single as float variable, boolean as True/False) (Native Code)
- Decompile declaration of all types of array. Multifield arrays and
arrays of object (array of Form or commandButton for example) also
supported (Native Code)
- Decompile __vbaVar2Vec, __vbaAryMove msvbvm functions
- Italian language translation
- Parsing control array index in events
- Parsing function return value (P-Code)
- Help files (English and Russian) is updated. New topics writen:
Opening file, Working with database, Saving the list of procedures,
Jump to address, The main window, Viewing of code, Decompilation from offset,
Language selection, Plugins
- Language files changed
- BugFix: Correctly calculate count of parameters in public sub's
- BugFix: Procedure analyzer and optimazer now correctly process second parameter in For command
- BugFix: Correctly process some types of VarType integer and long (Native Code)
- BugFix: Correctly detect end of some non-standard procedures in source mode (Native Code)

Download: Multiupload - Depositfiles - WUpload

Read More!

VMProtect Ultimate v2.06 Incl. key

VMProtect is to protect next-generation software. Protected parts of code are executed on a virtual machine, which greatly complicates the analysis and breaking the protected program. Built-in disassembler and a MAP file will allow you to quickly select the necessary parts of code to protect against hacking.

Ultimate can provide maximum protection for your application. Supports work with serial numbers, black list, virtualization and mutation of the code, protection against debugging and more.

VMProtect helps protect the software from analysis and cracking. The basis of protection is the execution of program code sections in a virtual machine. Architecture of virtual machines is radically different from conventional processors, which renders meaningless most of the tools used by hackers.

VMProtect is a comprehensive solution for protecting software. In addition to the immediate protection package, VMProtect allows you to generate and check serial numbers, limiting their duration, to limit the period of free updates and much more.

Why VMProtect?
Here are five reasons to choose VMProtect to protect your software:
Virtualization package - is the next step in the field of software protection from analysis. Most security systems encrypt the executable code and decode it when you start the program. VMProtect never deciphered the code. In the process of protecting VMProtect translates program code into code that runs on a virtual processor. A set of commands that the processor does not like the command processor x86 or x64, and changes with each protection program.
Support all file formats - VMProtect allows you to protect executable files (EXE, SCR), dynamic library (DLL, OCX, BPL) and driver (SYS).
64-bit platforms - VMProtect can protect both 32-bit and 64-bit executable files, libraries and drivers.
Support line Windows - protected files VMProtect, can run on all versions of Windows, from Windows 95.

It supports 32 and 64-bit operating systems, there is a problem with DEP and UAC.
Integrated solution for protection - VMProtect allows you to generate and check serial numbers. Rooms can be generated either manually or automatically (Web-generators). Serial numbers may be limited by the time of action, may limit the period of free updates that can be attached to the equipment. Also VMProtect can make physically impossible to execute code in the absence of serial numbers.

Support for Compilers: Delphi, Borland C Builder, Visual C / C + +, Visual Basic (native), Virtual Pascal

Supported Formats (x32 and x64): EXE, DLL, BPL, OCX, SYS

Download Now

Read More!

VMProtect Ultimate 2.06 Retail Incl. Key

We’ve just released version 2.06 of VMProtect. The most important feature is the merging license manager into the main VMProtect executable. The detailed list of changes follows:

New features

Added support of MinGW map files
Added support of JCLDEBUG library
Scripts: new method Clear in TPEDirectory
Scripts: new properties InputSize and OutputSize in TVMProcedure
Ultimate: Two new API functions in SDK: VMProtectBeginVirtualizationLockByKey and VMProtectBeginUltraLockByKey
Read More!

~ 100% FUD Protection Solution Provider ~

Features:

Clone File, Bind with File, Icon Changing (plus many common icons also included)

All AV's BYPASS ON RUNTIME + SCANTIME

Custom active process injection, Increase file size by Add extra bytes(mb)

In this version we used two best encryptions (RC4, TripleDES)

Stub Details:

First stub = Free (incl. with crypter)
Every time when you need stub update it will cost you 10$

Note: 1month stub protection

PRICE:

Crypter = 40$ (Incl. 1st stub)

Stub = 10$ (Every time you need)

Payment Options:

At this time we only accept Moneybookers, Western Union

Discount of 20$ If you pay through Moneybookers

INSTANT DOWNLOAD - NO WAITING!

Through bank payment? Contact me on:

Read More!

VMProtect Ultimate v2.04.6 Retail

VB Decompiler Pro v7.9 Incl.Keygen

VB Decompiler - Decompiler is the program (EXE, DLL, OCX), written in Visual Basic 5.0 and 6.0 and disassembler programs written in any language. NET technology. As you know, programs developed in Visual Basic, can be compiled or interpreted p-code, or executable native code. Since p-code represents a high-level team, then there is a real opportunity to recover from this source code (although the names of variables and some functions will not be able to recover). VB Decompiler restores the source code from the pseudocode as close as possible to the original, so it is with some work really bring to the compiled. VB Decompiler also decompiled all forms and UserControl'y located in the file. In general, VB Decompiler - is an ideal tool for analyzing programs and is ideal in case of loss of source codes and the need to partially restore the project.

VB Decompiler is decompiler for programs (EXE, DLL or OCX) written in Visual Basic 5.0 and 6.0 and disassembler for programs written on. NET technology. As you know, programs in Visual Basic can be compiled into interpreted p-code or into native code. . NET assembly always compiled to just in time compilable IL code. Since p-code consists of high-level commands, there is a real possibility to decompile it into the source code (of course, the names of variables and some functions will not be decompiled). VB Decompiler restores source code from p-code as much as possible precisely. And after some modifications you may try to compile generated code.

If a program was compiled into the native code, restoring full source code from machine instructions is not possible. But VB decompiler can help to analyze the program even in this situation as well. It contains a powerful disassembler and emulator. This powerfull engine try to decode most assembler instructions to most likely VB commands. Of course, it fails on some optimizations of assembler code and sometimes generate not correct instructions. But at this time this is a best way to analyze native code applications.

Features:
Universal unpacking for packed applications (supported UPX, NSPack and more other popular EXE packers)
Decompiling forms (frm and frx) and usercontrols (ctl) object files
Fully p-code decompiling (with parsing opcodes to standart vb instructions, with decompile GUID objects)
"2 p-code decompiling modes (with stack parsing or without stack parsing)
Disassembling native code procedures
Disassembling native code procedures with String References and API Calls
Partially decompiling native code (using code emulation engine)
Syntax coloring in decompiled code
String reference list and search engine
Fast decompiling speed
Obfuscator for VB5 / 6 programs
Patcher for VB5 / 6 programs
Save decompiled data to single DB file
Disassembling. NET programs
Save procedures list to MAP file, IDC script or to HIEW Names file

Features:
"Universal unpacking packed applications (UPX, NSPack and many other famous EXE packers)
"Decompilation forms (frm and frx) and usercontrol'ov (ctl)
Full decompile p-code into the source-like code (including decompile GUID objects)
"3 mode decompilation p-code (in the processing stack, without processing and function of the analyzer procedures followed by the simplification and improvement of its code readability)
"Disassembling native code (using powerful Pentium Pro disassembler)
"Syntax Highlighting in the decompiled code
"Partial decompile Native Code'ovyh structures
"Indexing the rows found in the decompiled code and features quick search strings
"High-speed decompiling
Obfuscator for VB5 / 6 programs
"Possibility of a patch for VB5 / 6 programs
"Saving the decompiled result in database
"Disassembling. NET code
"Saving the procedure name in the MAP file, IDC script or file HIEW Names

OS: Windows 95/98/ME/2k/XP/2003/Vista/2008
Interface: English

Download Now

Read More!

AnalyzeThis+ 0.24

I made some improvements to AnalyzeThis mainly to analyze a memory section which originally reports "this section is not associated with any module".
....
Sometimes (especially when dealing with packers) you may need to run OllyDbg's code analysis function, only to find it's not available to you because the EIP is currently outside the code segment as defined by the PE header. AnalyzeThis! is an OllyDbg plugin to allow OllyDbg's analysis function to operate outside of the marked code segment, by telling OllyDbg the current segment *is* the code segment.

Caveats: OllyDbg can only store one analysis table, so if you analyze a new segment, it will remove any existing analysis that has been done.

Source code has not been included; not because I don't want to release it at this time, but because I can't find it offhand. If you really need it, email me and I'll look harder for it.

Download: http://www.megaupload.com/?d=6WFPOMED Read More!

StrongOD 0.2.9.561

This will be a seperate download of StrongOD as of version 0.2.4.350 because - as strange as it sounds - the developer has protected it!

This plugin will now require a key for it to run and be used. You can obtain a valid key by emailing: StrongOD©safengine.com

Download: http://www.megaupload.com/?d=XWGTG9BB Read More!

VMProtect 1.7 - 2.0 (Unpacking) by LCF-AT

As I promised here comes the next movie tutorial and a updated script which now also supports VMProtect 2.0. As always you can see in the movie how to use it correctly. My unpack target which I have selected was the VMProtect 2.0 Ultimate itself [Demo] version. I also declare you how to rebuild the OEP in this target. Moreover you will see a second show movie about the VMProtect 2.0.1.2 itself which I also unpacked. This version has some more features than the Ultimate version.

So I fixed also some small bugs in the script and added some more functions. So read all messages which you get with attention before you press a button. For VMP 1.8 - 2.0 you can choose the API TRACER to get all needed addresses, dwords,api´s, module infos into a new file. The trace process can take a longer time if you work with a low system so for this problem I have added the possibility that you can always cancel the current process. Just stop the script if you want... if you then restart Olly and the script then it will work further from the last stop.

Some words to the "PE Header Fixing". This you will need for example for the VMProtect 2.0.1.2 itself so till now it was the only target which I have found which used this protection but I added the fix function also now in the new script. Just use it if you need it.It can also prevent some "File corrupted!...." messages. If you get still this message after fixing the PE then your target can also use some CRC checks.

Download: http://www.megaupload.com/?d=XBQYAZF6 Read More!