From Collaborative RCE Tool Library
File System Diff Tools
| Tool name: | Beyond Compare |
| ||
|---|---|---|---|---|
| Author: | Scooter Software | |||
| Website: | http://www.scootersoftware.com | |||
| Current version: | 2.5.1 | |||
| Last updated: | August 30, 2007 | |||
| Direct D/L link: | N/A | |||
| License type: | Shareware | |||
| Description: | A very good text/code diffing tool. Also a good binary diffing tool if using the plugin for this from the author's website. | |||
| Also listed in: | Binary Diff Tools, Image Diff Tools, Text Diff Tools | |||
| More details: | Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry) | |||
| Tool name: | All-Seeing Eye |
| ||
|---|---|---|---|---|
| Author: | Fortego Security | |||
| Website: | http://www.fortego.com/en/ase.html | |||
| Current version: | 0.7.1 | |||
| Last updated: | 2007 | |||
| Direct D/L link: | http://www.fortego.com/resources/ase071.zip | |||
| License type: | Free | |||
| Description: | Tool for automated diff-style checking of many sensitive system areas that malware and other programs often try to modify silently. Like Tripwire on speed. | |||
| Also listed in: | Install Monitoring Tools, Registry Monitoring Tools, System Diff Tools | |||
| More details: | Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry) | |||
| Tool name: | Compare VMware Snapshots |
| ||
|---|---|---|---|---|
| Author: | ZaiRoN | |||
| Website: | http://zairon.wordpress.com/2007/08/31/find-out-hidden-files-comparing-vmwares-snapshots/ | |||
| Current version: | 1.0 | |||
| Last updated: | September 19, 2007 | |||
| Direct D/L link: | Locally archived copy | |||
| License type: | Free | |||
| Description: | Nowadays there’s a big use of virtualization; tools like VMware, VirtualPC and others are daily used. There are some differencies between the original and the virtualized environment, but to study a malware under a protected blackbox it’s very comfortable. You can study their behaviour without any problems. Just today, while I was running a malware, I got this foolish idea: can I identify hidden files using VMware’s snapshots? Under VMware you can save the current state of a virtual machine taking a snapshot of the running guest system. The snapshot is stored somewhere in the guest’s OS folder, it simply needs some files. I’m interestered in one file only, the one containing the guest’s memory. The memory is saved inside a file with .vmem extension. The idea is to take two snapshots (a virgin and an infected system), and then compare the two files. The main problem is that a single snapshot needs a large amounts of bytes, around 260 Mb on my system. Comparing the snapshots using an hex editor is madness. I decided to write a simple application able to compare two files string to string. Why only strings? Well, how can I identify an hidden file simply looking at a “memory dump”? The answer is simple: the only thing able to reveal a trace is a string containing the name of the hidden file, nothing more. So, I extract all the strings from the virgin snapshot and then I compare them with all the strings from the infected snapshot. Yes, it’s a foolish idea but it helps me to pass a boring afternoon. The most important part of the program is the internal “search engine”. To speed up the program you have to search for specific strings. To view the results in a quick way I simply search for strings with extension “.sys”, “.dll” or just “.exe”. That’s because these are the file extensions of the files that are always hidden. You can improve the search engine adding some more rules (i.e. string must have “system32″ or “windows” inside) but the result won’t change: you can always see some interesting strings. I tried the program running two malwares: Lager and Nailuj. Lager malware hides a file named taskdir.exe and Nailuj hides videoati0.sys/dll/exe. In both cases, I can see some strings referring to the hidden files. The string is somewhere in the memory, I’m not interested in its position but in the string itself: it exists! There are some good tools out there able to show hidden files but sometimes they fail. When they fail you can try with this approach. | |||
| Also listed in: | (Not listed in any other category) | |||
| More details: | Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry) | |||
Feed containing all updates and additions for this category.
Feed containing all updates and additions for this category, including sub-categories.
