ImpREC lite v11 Source Code(Share)

News:
—–
ImpREC is back to public. This version can now support Windows 95 (Thanks to EliCZ,
Unknown One and ZigD for testing).
It has also been redesigned to support more import rebuilding schemes (relative calls for
example). The plugin interface has changed completely (using filemapping) and now supports
the ‘Exact Call’ feature. This last one has been linked with the ‘Create New IAT’. It will
be useful for all mangled schemes which annihilate completely or partially the IAT. The
‘AutoTrace’ is more stable because it will not use the Tracer Level2 anymore. A built-in
coloured disassembler/hew-viewer will help you to watch the redirected code. Then you
should not need the ASProtect plugin because of no more updates but it still is there as
example. Please take a look at <History.txt> for all details.

I hope you will enjoy this version like i did to make it,
Regards,

MackT/uCF.

v1.6 FINAL (PUBLIC VERSION)
—————————

– Misc

– Finally fixed the bug in the check for adding section (Thanks to Christoph)

v1.6 beta *PRIVATE*
——————-
– Tracers
– Tracer Level3
– Added EIP Log
– Misc
– Finally, support relative calls rebuild (not with the loader yet)
– Added a disassembler window for redirected code
– Added colour to all known imports (Thanks to Jeff Schering)
– Added a hex viewer (built with the disassembler)
– Fixed blink in RichEdit control
– Checkbox “OpCodes” is enable/disable depending on “Hex View”
(Thanks to Muffin)

Continue Reading

VS 2012示例代码浏览器

安装地址:http://visualstudiogallery.msdn.microsoft.com/4934b087-e6cc-44dd-b992-a71f00a2a6df

亮点介绍

集成丰富的示例代码搜索

Visual Studio 示例代码浏览器和Visual Studio无缝集成。充分利用Visual Studio界面让你在开发过程中轻松搜索示例代码。譬如,当你在Visual Studio中编辑代码时,你可以选中一段API或代码段,敲击Alt+F1快捷键或右键选择Search Code Samples,便可针对所选择API搜索相关示例代码。

Continue Reading

Ollydbg/Immdbg Mem Viewer Source Code

开头先说句废话,有的时候软件更新后发现越更新越烂了,操,比如opera的这次更新。

这个东西是这篇文章中的源代码:http://www.h4ck.org.cn/2012/10/memviewer-1-0-for-ollydbg-v1-0-and-immunity-debugger-v1-8x/

代码地址:http://code.google.com/p/ollydbg-mem-viewer/

下载地址:http://code.google.com/p/ollydbg-mem-viewer/downloads/list

Continue Reading

IDA Pro 64bit 插件编译

今天偶尔打开一个64bit的ida数据库的时候提示什么加载插件失败。而问题的关键是自己并没有这几个64位的插件,只有32位的。其实问题也很容易就解决掉了,代码都是自己的,所以直接编译一个64位的插件就可以了。

1.配置管理器中新建一个配置,名称可以随便设置,只要能区分就可以了。

复制设置选择当前的解决方案配置。

Continue Reading

蛋疼的Visual Studio2012 驱动模板创建的工程竟然无法编译

其实安装Visual studio2012的一个主要原因就是原生态的驱动开发支持,但是却发现一件很蛋疼的事情。自带的模板创建的项目没办法编译,提示如下的错误:

出错的代码是如下的几行:

#ifdef SMP_ID
#define VER_SAMPLE_IDENTIFIER_STR SMP_ID
#endif

#ifndef VER_SAMPLE_IDENTIFIER
#define VER_SAMPLE_IDENTIFIER    "SAMPLE_IDENTIFIER"
#endif

#ifdef VER_SAMPLE_IDENTIFIER_STR
resname RCDATA
{
  VER_SAMPLE_IDENTIFIER,
  VER_SAMPLE_IDENTIFIER_STR
}
#endif
Continue Reading