一个非常好用的查壳工具

___________________________________________________________________________ ExeInfo PE ver. 0.0.2.7 by A.S.L ( c ) 2006.03 - 2010.0x freeware version for Windows XP Windows 32 PE executable file checker , compilators, exe packers .... with solve hint for unpack / internal exe tools / rippers ___________________________________________________________________________ Internal Tools Menu : --------------------- - overlay remover - generate new file without overlay data - save overlay as external file - EP Corrector ( for Delphi / C++ 5/6 ) - generate many exe file with Entry Point - EP Corrector ( for Delphi v.5 ) Runtime - correct EP - XoR permutator (xor,or,shl..) - create one file with xor data ( 255x2000 bytes ) - Section splitter - save exe sections as files & exe header - 8 / 16 bit string finder - enter 8 bit string = searching 16 bit strings & 8 bit ( F7 key ) - REGistry call finder + CLSID - find registry call & regedit.exe strings - overlay xor uncrypter - uncrypt one byte crypted exe in ovl. - External exe file runner - ( from exeinfopeRUN.cfg ) - txt user file list to run - External exe detector runner - from shell registry : Fast Scaner , CFF Explorer , Bit Detector , Quick Unpack .... - Add fake signer Visual Basic for UPX - You can add VBasic v5/6 signature to exe file packed with upx.exe File Menu : -------------------- + Rename file + Copy file As.. *.bak + Execute - create executable process ( exe ) + Execute - windows ext. associate ( dll ,zip ... ) + Delete file ( ALt+Del) - work in multiscan mode + Run multifile scanner mode ( Directory scan ) + - view global log file ( c:\Raport-exeinfo-log.txt ) - delete global log file ( no confirm ) Rippers Menu : -------------------- - www address searcher inside exe - work on any file - ExE inside ExE ( Win32 Pe windows executable) - work on any file Archives ripper : - Zip archives inside ExE www.winzip.com - work on any file - Rar archives inside ExE www.rarlab.com - work on any file - 7z archives inside ExE www.7-zip.org - work on any file - CAB MS archives inside ExE (for MSI installers ) - work on any file - SWF flash Adobe animation files ( internal length fixer for non exe files ) - ICO nonstandard icon ripper Graphics ripper submenu : BMP , PNG , JPG ( JFIF only !!! Exif - not supported ) , GIF ( static pic. only ) - ( All in one ) - for lazy boys ( without 'www address' ) keys : F1 key - keyboard help F2 key - Multiple file scanner for *.exe files F3 key - external view ( hiewdemo.exe or hiew32.exe ) path directory F4 key - external test ( peid.exe ) path directory F5 key - external test RDG Packer Detector ( I read location from Win registry ) F6 key - external test DiE.exe Detect it Easy ( I read location from Win registry - shell integration req.) F7 key - 8 / 16 bit String finder F9 key - UPX.exe pack ( lzma mode ) from path directory F10 key - UPX.exe unpack Alt+S - ZOOM Window x2 ! Ctrl - Run external exe detectors - Fast Scanner, CFF Explorer , Quick Unpack ... - required shell integration !!! Alt+Delete - delete file "+" ,"-" - Numeric KEY = adjust transparent Form Non executable file detection : Image file - jpg , png , mng ,gif (87/89) , bmp , tiff Sound file - mp3 (ID3/noID) ,wma , ogg , .mid , .xm , .mod Video file - avi (divx/xvid + info ) , wmv , mpg , 3GP , mov , mp4/m4v , .RM Archive file - 7zip ,zip ,rar , gzip , bzip other : chm (Microsoft HTML Help), msi , pdf , xml , fws , cws , php , html , hlp , mdb , lnk ,reg , rtf. Overlay detector : 01. zip archives 02. cab archives 03. SWF Flash object ( packed & unpacked format ) 04. Executable PE file 05. 7zip archives 06. RAR archives 07. MSI/DOC/XLS - Plugins like a Peid.exe ( 70 % compatible ) ------------------------- Multiscaner use - command line : - Exeinfope *.sys ( show all .sys files ) - Exeinfope *.* /s ( Show All PE files and sent to log file ( s = silent mode no GUI ! -> !ExEinfo-Multiscan.log ) Exeinfope *.exe /s ------------------------- *ACM - anti cheat mechanism ( anti fake sign ) _______________________________________________________________________ www site : www.exeinfo.xwp.pl Mirror : www.exeinfo.cjb.net _______________________________________________________________________ ExeInfo detection list : ---------------------------------------------- 001. RealArcade Wrapper ( Microsoft Visual C++ ) 50% detection not all versions 002. Borland Delphi ( 2.0 - 7.0 ) 003. Microsoft Visual C++ ver. 5.0 ~ 6.0 ( exe ) 004. Microsoft Visual C++ ver. 7.x ( exe ,dll) 005. PEtite 2.x -> Ian Luck 006. UPX exe 0.89.6 - 1.02 / 1.05 - 1.93B -> Markus & Laszlo 007. UPX dll file - 1.93Beta -> Markus & Laszlo 008. Aspack v2.12 -> Alexey Solodovnikov 009. EXECryptor v.2.3.1-6 ( www.strongbit.com ) 010. Morphine ver.2.7b ( plugin Peid.exe ) 011. AC protect 2.0 by RIScO Software Inc. ( www.ultraprotect.com ) 012. ASprotect 2.1 reg ( www.aspack.com/asprotect.htm ) only exe files DLL files detect as ASpack :) 013. AHTeam EP Protector ver.0.3 priv 014. WinUpack 0.39 final by Dwing ( http://dwing.51.net ) :-(( 015. Software Compress ver. 1.2 Lite - www.bgsopt.com 016. PEcompact ver.2.78a - 3.02 - www.bitsum.com 017. nsPack ver.2.3 unreg - by North Star - www.nsdsn.com 018. nsPack ver.3.0 - 4.1 reg - by North Star - www.nsdsn.com 019. Mole Box 2.5.7 by Teggo. - www.molebox.com 020. Microsoft Visual C++ ver. 8 ( ??? ) 021. EXE Guarder 1.8 - 2.1 (2006/2008 unreg) www.exeicon.com/exeguarder 022. EXE Wrapper ver. 2.3-2.5 ( www.533soft.com/exewrapper ) - how to remove password 023. Exe password protector 1.0.5.100 (protect/unprotect) 024. TASM / MASM 025. MS Visual Basic 5.0-6.0 dll 026. MS Visual Basic 5.0-6.0 exe 027. Armadillo 4.4x ~ 4.62..5.0~7.0 32bit - www.siliconrealms.com (60e8) 028. Enigma protector v1.1x - www.enigma.izmuroma.ru � Sukhov Vladimir 2004-2006 029. SVK-Protector v1.32 demo - Pavol Cerven - www.anticracking.sk 030. Generic check : ASprotect 1.? old version ( www.aspack.com/asprotect.htm ) exe only 031. Generic check - AC protect 1.? by RIScO Software Inc. ( www.ultraprotect.com ) 032. Packman v1.0 Brandon LaCombe ( http://packman.cjb.net ) 033. modified exe , EP code = Borland Delphi ( 2.0 - 7.0 ) 034. ExeStealth V2.76 www.webtoolmaster.com 035. FSG v2.0 F[ast] S[mall] G[ood] - www.xtreeme.prv.pl 036. Generic check - Aspack v2.1x -> Alexey Solodovnikov 037. Aspack v2.12b? -> Alexey Solodovnikov 038. Program protector v2.1unreg ( exe password - DECODE PASS ! ) - www.blumentals.net 039. Obsidium v1.3 software protection system (demo) - www.obsidium.de 040. ARMprotector v0.1 by SMOKE 2004 041. ARMprotector v0.3 by SMOKE 2004 042. SDProtector Profesional Edition v1.12 ( 2003 ) - www.sdprotector.com 043. Themida 1.0 -1.3? - Adv.Win.Software Protection System (c) 2004-2005 Oreans Technologies - www.oreans.com 044. yodas Protector v1.03.3 - http://yodap.has.it 2004-2006 045. yoda's Crypter v1.3 - Ashkbiz Danehkar 2004-2005 046. PE-Pack v0.99 (c) 1998 by ANAKiN 047. WATCOM C/C++ 1988-1995 048. Microsoft CAB SFX module 049. Generic check : Microsoft Visual C++ vx.x 050. UPX -> Markus