Detect It Easy(查壳工具) v3.07一款专业查壳工具.rar

!EPack|packer|!EP(EXE Pack) !eprot|protector|!EProt "_!_!_!_|protector|Krypton .!ep|packer|!EP(EXE Pack) .00cfg|compiler|Control Flow Guard (CFG) section (added by newer versions of Visual Studio) .AAWEBS|compiler|Section used by Amiti Antivirus DLLs webspam.dll and webspamwow64.dll .ASPack|packer|Aspack .BCPack|protector|Backdoor PE Compress Protector .BSS|compiler|Uninitialized Data Section .ByDwing|packer|(Win)Upack .CLR_UEF|compiler|.CLR Unhandled Exception Handler section .CRT|compiler|Initialized Data Section (C RunTime) .CRT|compiler|mingw/cygwin .DATA|compiler|Data Section .DalKiT|protector|DalKrypt .De-vir |packer|NoodleCrypt .FISHPEP|packer|Fish PE Packer .FishPE|protector|FishPE Shield .HOODLUM|pe tool|HOODLUM .Kaos12|protector|KaOs PE-DLL eXecutable Undetecter .Kaos2 |protector|KaOs PE-DLL eXecutable Undetecter .LARP|protector|lARP64 .MPRESS1|packer|MPRESS .MPRESS2|packer|MPRESS .MaskPE|packer|MaskPE .Ncryo |packer|NoodleCrypt .Np|packer|TTP Pack .PEDATA|packer|Fish PE Packer .RLPack|packer|RLPack .RPCrypt|protector|RPCrypt .Razor|demo|Razor .Stone|protector|Stone's PE Encryptor .TTP|protector|TTprotect .Themida|protector|Themida .UPX0|packer|UPX .UPX1|packer|UPX .UPX2|packer|UPX .Upack|packer|(Win)Upack .WISE|installer|Wise .WWP32|packer|WWPack32 .WWPACK|packer|WWPACK .aBc |protector|ABC Cryptor .adata|packer|Aspack .adata|protector|ASProtect .adata|protector|Armadillo .alex|protector|Alex Protector .alloy32|protector|Alloy .apiset|compiler|a section present inside the apisetschema.dll .arch|compiler|Alpha-architecture section .aspack|packer|Aspack .autoload_text|compiler|cygwin/gcc; the Cygwin DLL uses a section to avoid copying certain data on fork. .avc|protector|AverCryptor .bedrock|packer|bambam .bindat|compiler|Binary data (also used by one of the downware installers based on LUA) .boom|builder|The Boomerang List Builder (config+exe xored with a single byte key 0x77) .bootdat|compiler|Section that can be found inside Visual Studio files; contains palette entries .boot|protector|Themida/Winlicense .bss|compiler|Uninitialized Data Section .buildid|compiler|gcc/cygwin; Contains debug information (if overlaps with debug directory) .ccg|protector|PE-Armor .ccg|packer|CCG Packer (Chinese Packer) .ccp3p|protector|CrypToCrack Pe Protector .charmve|tool|Added by the PIN tool .code|compiler|Code Section .complua|compiler|Most likely compiled LUA (also used by one of the downware installers based on LUA) .cormeta|compiler|.CLR Metadata Section .crtemui|demo| .cygheap|compiler|mingw/cygwin DEBUG .cygwin_dll_common|compiler|cygwin section containing flags representing Cygwin’s capabilities; refer to cygwin.sc and wincap.cc inside Cygwin run-time .data1|compiler|Data Section .data2|compiler|Data Section .data3|compiler|Data Section .data_cygwin_nocopy|compiler|cygwin .data|compiler|Data Section .debug$F|compiler|Debug info Section (Visual C++ version < 7.0) .debug$F|compiler|mingw/cygwin .debug$P|compiler|Debug info Section (Visual C++ debug information/compiler/precompiled information) .debug$S|compiler|Debug info Section (Visual C++ debug information/compiler/precompiled information) .debug$S|compiler|mingw/cygwin .debug$T|compiler|Debug info Section (Visual C++ debug information/compiler/precompiled information) .debug$T|compiler|mingw/cygwin .debug_abbrev|compiler|mingw/cygwin DEBUG .debug_aranges|compiler|mingw/cygwin DEBUG .debug_frame|compiler|mingw/cygwin DEBUG .debug_info|compiler|mingw/cygwin DEBUG .debug_line|compiler|mingw/cygwin DEBUG .debug_loc|compiler|mingw/cygwin DEBUG .debug_macinfo|compiler|mingw/cygwin DEBUG .debug_pubnames|compiler|mingw/cygwin DEBUG .debug_ranges|compiler|mingw/cygwin DEBUG .debug_str|compiler|mingw/cygwin DEBUG .debug|compiler|Debug info Section .decode|packer|MEW10 .delete|demo| .depack|packer|dePack .didata|compiler|Delay Import Section .didat|compiler|Delay Import Section .dotfix|protector|DotFix Nice Protect .drectve|compiler|Directive section (temporary|demo|linker removes it after processing it .drectve|compiler|mingw/cygwin .dswlab|pe tool|VMUnpacker .dyamarC|protector|DYAMAR .dyamarD|protector|DYAMAR .ecode|compiler|Built with EPL .edata|compiler|Built with EPL .edata|compiler|Export Data Section .edata|compiler|mingw/cygwin .eh_frame|compiler|mingw/cygwin .eh_fram|compiler|gcc/cygwin; Exception Handler Frame section .endjunk|compiler|mingw/cygwin .enigma1|protector|Enigma Virtual Box .enigma2|protector|Enigma Virtual Box .ex_cod|protector|eXPressor .ex_rsc|protector|eXPressor .exc|demo| .export|compiler|Alternative Export Data Section .fasm|compiler|FASM flat Section .ficken|protector|PECRYPT32 .fini|compiler|mingw/cygwin .flat|compiler|FASM flat Section .g4kcod2|demo| .g4kcod3|demo| .g4kcod4|demo| .g4kcoda|demo| .g4kcodb|demo| .g4kcodc|demo| .g4kcodd|demo| .g4kcodf|demo| .g4kcodg|demo| .g4kcodh|demo| .g4kcodi|demo| .g4kcodj|demo| .g4kcodk|demo| .g4kcodl|demo| .g4kcodp|demo| .g4kcods|demo| .g4kcodw|demo| .g4kcodx|demo| .g4kcody|demo| .g4kcodz|demo| .g4kdat1|demo| .g4kdat2|demo| .g4kmuc1|demo| .g4kmuc2|demo| .g4kmuc3|demo| .g4kmuc4|demo| .g4kmuc5|demo| .gcc_except_table|compiler|mingw/cygwin .gcc_exc|compiler|mingw/cygwin .gentee|installer|Gentee Installer .gfids|compiler|section added by new Visual Studio (14.0) .giats|compiler|section added by new Visual Studio (14.0) .gljmp|compiler|section added by new Visual Studio (14.0) .glue_7t|compiler|ARMv7 core glue functions (thumb mode) .glue_7t|compiler|mingw/cygwin .glue_7|compiler|ARMv7 core glue functions (32-bit ARM mode) .glue_7|compiler|mingw/cygwin .guruX|protector|G!X Protector .icon|demo|possibly an icon resource .idata |protector|Xtreme-Protector .idata$2|compiler|mingw/cygwin .idata$3|compiler|mingw/cygwin .idata$4|compiler|mingw/cygwin .idata$5|compiler|mingw/cygwin .idata$6|compiler|mingw/cygwin .idata$7|compiler|mingw/cygwin .idata|compiler|Initialized Data Section (Borland) .idata|compiler|mingw/cygwin .idlsym|compiler|IDL Attributes (registered SEH) .impdata|compiler|Alternative Import data section .imports|protector|Themida/Winlicense .import|compiler|Alternative Import data section .imrsiv|tool|special section used for applications that can be loaded to OS desktop bands. .inq|protector|Inquartos Obfuscator .intro|demo| .itext|compiler|Code Section (Borland) .jdpack|packer|JDPack .jedata|compiler|Excelsior JET .jidata|compiler|Excelsior JET .loadcon|protector|Themida/Winlicense .load|demo| .mackt|tool|ImpRec-created section .mnbvcx1|loader|Most likely associated with Firseria PUP downloaders .mnbvcx2|loader|Most likely associated with Firseria PUP downloaders .mslrh|protector|MSLRH .mydata|demo| .n-coder|protector|N-Code .nPack|packer|nPack .nah|protector|Morphnah .naked1|packer|NakedPacker .naked2|packer|NakedPacker .ndata|installer|Nullsoft Installer section .neolite|packer|NeoLite .neolit|packer|NeoLite .nos|packer|NOS Installer .nsp0|packer|NsPack .nsp1|packer|NsPack .nsp2|packer|NsPack .orpc|compiler|Code section inside rpcrt4.dll .packed|packer|RLPack .packed|packer|Unknown Packer .pdata|compiler|Exception Handling Functions Section (PDATA records) .perplex|protector|ACProtect .perplex|protector|Perplex .petite|packer|Petite .pe|demo|possibly PE file .pinclie|tool|Added by the PIN tool .pklstb|demo| .profile|tool|NightHawk C2 framework (by MDSec) .ps4|protector|StarForce .qtmetad|library|Qt .rdata|compiler|Read-only initialized Data Section (MS and Borland) .reacto|protector|.NET Reactor .relo2|demo| .reloc|compiler|Relocations Section .rlp|packer|RLP .rmnet|virus|Ramnit virus marker .rodata|compiler|Read-only Data Section .rsrc A|demo|Possibly variant of resource section .rsrc|compiler|Resource section .sCe!05|demo|Scienide group .sbss|compiler|GP-relative Uninitialized Data Section .scpack|packer|SC P