InstallShield PackageForTheWeb Password Cracker
(C)thewd@hotmail.com
------------------------------------------------------------------------------
Usage: ISpftw <pftw executable> [/longPassword] [/ignoreLength] [/dumpHeaders]
<pftw executable>
target installation that has been distributed using PackageForTheWeb
[/longPassword] (PFTW v2.03+)
used to attempt recovery of long passwords (28-54 characters)
(requires a certain knowledge about the files contained within the cabinet)
e.g. cabinet contains test.txt, test1.txt, test2.txt and test3.txt files
a) Number Of Files : 4
b) Filenames Length : 45
c) Size Of First File : 4
d) Number Of Chunks : 1
e) Is Compressed? : Yes
Notes
=====
a) the number of files within the cabinet
b) the total length of all the filenames (including directories), i.e.
\test.txt
\1\test1.txt
\2\test2.txt
\3\test3.txt
= 9 + 12 + 12 + 12
= 45
c) the uncompressed size of the first file in the cabinet (in bytes)
d) the number of data chunks used (depends on the size of the files)
i.e. once a certain number of bytes have been compressed a new data
chuck is created, but this value isn't fixed (depends on source)
e) whether the cabinet data has been compressed (usually yes)
Even if you don't know all the required information, by looking at the
password recovered you may be able to guess the incorrect characters
[/ignoreLength] (PFTW v2.03+)
ignores the password length determined by this utility, because certain
character combinations in the password can return the wrong value
[/dumpHeaders] (PFTW v2.03+)
dumps the encrypted and decrypted packagefortheweb file headers.
Can be used to analyse the length and validity of the password and to
determine which characters are invalid
------------------------------------------------------------------------------
Note: Supports InstallShield PackageForTheWeb v1.02 - v4.01
(v2.03+ doesn't guarantee passwords that are greater than 28 characters)
==============================================================================
Universal Import Fixer (UIF) v1.2 (FINAL) by: Magic_h2001
Use this tool for fixing Import Elimination, Directly Imports and
Shuffled, Disordered, Scattered Imports (Just for 32 bit processes).
So you can use this tool for changing IAT Base Address and Sorting IATs
in New (other) Address.
Tested on:
Armadillo
ASProtect
Enigma
ExeCryptor
eXPressor
PeSpin
RlPack
VMProtect
TheMida
WinLicense
and any protector with Import Elimination, Directly Imports and
Shuffled, Disordered, Scattered Imports.
Notes:
======
This tool is an Import Fixer (not Import Rebuilder ImpRec etc) and Just work
in memory of target process. dont tell me how to use this Tool...if you can
not use this Simple Tool plz DRAG IT TO THE RECYCLE BIN ok?
Always first use UIF then Dump target process.
UIF can fix actual APIs, dont use it for fixing Emulated/Redirected APIs to
protector's stub.you must use UIF After fixing Magic IAT jump
(or use any methods) to convert Emulated/Redirected APIs to Actual APIs.
Samples:
Armadillo : Import Elimination
ASProtect : Directly Imports
Enigma : Shuffled, Disordered, Scattered Imports
ExeCryptor : Scattered Imports in Protector Stub
eXPressor : Directly Imports
PeSpin : Directly, Shuffled, Disordered, Scattered Imports
RlPack : Shuffled, Disordered, Scattered Imports
VMProtect : Directly Imports
TheMida : Directly Imports
WinLicense : Directly Imports
How to use :
============
1.fill <Process ID> with target Process ID
2.fill <Code Start> with start address of code that you want to fix it.
if you fill it with ZERO, UIF will fill it automatically.
3.fill <Code End> with End address of code that you want to fix it.
if you fill it with ZERO, UIF will fill it automatically.
4.fill <New IAT VA> with address of Empty or unused area
(in Code section or Data section or any...) that IAT will repair to it.
if you fill it with ZERO, UIF will fill it automatically.
so you can fill <code Start> , <Code End> with a Dll address area, UIF will
detect it automatically.
for Fast Speed:
===============
-After Click on <Start> you can Minimize UIF to the taskbar.
-Just enter Code section start and end (.text section etc).
-Dont check "Fix Directly Imports" if you dont need to it.
History:
========
v1.2 FINAL update (2008.12.31):
===============================
+Code improved for better processing invalid ImageBase,ImageSize and invalid PE.
+Some small changes for more Compatibility/Stability.
-PSAPI library removed from UIF engine (shit library with many bugs).
v1.2 FINAL update (2008.06.15):
===============================
+Code Optimized again for better result.
+UIF.dll released (for using UIF in other applications).
Coded with pure Api,very fast and small size.
v1.2 FINAL update (2008.04.24):
===============================
+Fast Speed option added.
v1.2 FINAL (2008.04.19):
========================
+Now UIF can process Ring0 Hooked APIs (KAV,ZoneAlarm,... etc).
-Minor Bugs fixed.
v1.2 Stable (2008.04.04):
=========================
+Algorithm improved for Fast Speed.
-Option 'Main exe Exports' removed (now UIF can detect it automatically)
-Option 'Fix NtDll to Kernel32' removed (now UIF can detect it automatically)
-Minor Bugs fixed.
v1.0 Final+ (2008.03.21):
=========================
+Code Optimized for Fast Speed.
+Always OnTop Added.
+Tested again on many targets:
(TheMida,WinLicense,Armadillo,ASProtect,Enigma,eXPressor,PeSpin,...)
-Bug fixed in Fixing Directly Imports in Delphi,BCB,VC(MFC) Applications.
v1.0 Final update (2008.02.23):
===============================
+Algorithm improved for better fixing Directly imports.
+Show modules count and progress in StatusBar.
-GUI bug fixed on large fonts >=120 dpi.
v1.0 Final update (2008.01.15):
===============================
-Some small bugs fixed.
+Algorithm improved for very big IAT size.
+Auto fill improved for detecting dlls correctly.
v1.0 Public (2008.01.12):
=========================
First public release...
v1.0 Private (2005.02.23):
==========================
For personal use...
You can download last version of UIF from this link:
http://magic.shabgard.org/UIF.zip
magic_h2001@yahoo.com
http://magic.shabgard.org
==============================================================================
