From Collaborative RCE Tool Library

Jump to: navigation, search

Memory Search Tools


Tool name: Codetective Analysis Tool
Rating: 5.0 (1 vote)
Author: Francisco Gama Tabanez Ribeiro                        
Website: https://github.com/blackthorne/Codetective
Current version: 0.8.2
Last updated: September 20, 2014
Direct D/L link: N/A
License type: GPL
Description: Sometimes we run into hashes and other artefacts and can't figure out where did they come from and how they were generated. This tool is able to recognise the output format of many different algorithms in many different possible encodings for analysis purposes. It also infers the levels of certainty for each finding based on traces of its representation .

This may be useful e.g. when you are testing systems from a security perspective and are able to grab a password file with hashed contents maybe from an exposed backup file or by dumping memory. This may also be useful as a part of a fingerprinting process or simply to verify valid implementations of different algorithms. You may also try running this tool against network traffic captures or large source code repositories to look out for interesting stuff.

You can either use a generic version or as a plugin for the Volatility framework. The usage is similar.
Currently supports:
web-cookie
mssql2000
md5
URL
md4
phone number
credit cards
mssql2005
lm hash
ntlm hash
MySQL4+
MySQL323
base64
SAM(*:ntlm)
SAM(lm:*)
SAM(lm:ntlm)
RipeMD320
sha1
sha224
sha256
sha384
sha512
whirpool
CRC
des-salt-unix
sha256-salt-django
sha256-django
sha384-salt-django
sha384-django
sha256-salt-unix
sha512-salt-unix
apr1-salt-unix
md5-salt-unix
md5-wordpress
md5-phpBB3
md5-joomla2
md5-salt-joomla2
md5-joomla1
md5-salt-joomla1
blowfish-salt-unix
uuid
Also listed in: Crypto Libraries, Data Extraction Tools, Data Search and Extraction Tools, Dongle Analysis Tools, Dongle Crypto Solver Tools, Memory Data Tracing Tools, String Finders
More details: Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry)



Tool name: Memory Hacking Software
Rating: 5.0 (2 votes)
Author: L. Spiro                        
Website: http://www.memoryhacking.com
Current version: 6.1
Last updated: December 5, 2009
Direct D/L link: http://memoryhacking.com/MemHack/MHS6.1.rar
License type: Free
Description: Highly advanced software for memory search/analysis and trainer creation. Recommended!

MHS 6.1 (bundle):
Bundle includes MHS.exe, MHS Help.chm, zlib1.dll, and ChangeLog.txt.


Features:
* Fastest Searching
-- Data-Type Search
-- Pointer Search
-- String Search (ASCII, Unicode, Hex Bytes, Wildcard, Regular Expressions)
-- Group Search (Includes Pattern Matching)
-- Expression Search (Extremely Flexible)
-- Script Search (The Ultimate in Custom Searching)

* Debugger
-- Very Stable
-- Customizable Breakpoints

* Disassembler

* Code Filter
-- Easiest Way to Find Functions

* Auto-Hack

* Auto-Assembler
-- 90% Same Language/Syntax as in Cheat Engine

* DLL Injector
-- Injects any DLL into the Target Process
-- Uninject Later, Automatically or Manually
-- Remotely Call ANY Functions in the Injected DLL(s), Regardless of Calling Convention, Return Type, or Number of Parameters

* Integrated Script Language
-- IDE/Compiler Built-In
-- Syntax Matches C; No Learning Curve
-- Compiled for Fast Execution
-- Full API
-- Includes Features Specially for Hacking

* Real-Time Hex Editor
-- Fully Featured Real-Time Hex Editor for Both RAM and Files
-- Allows Browsing of Kernel RAM

* Kernel Driver
-- Allows Bypassing Anti-Cheat Systems
-- Allows Reading/Writing of Kernel RAM

* Converter

* RAM Watcher

* Memory Allocator
-- Allocates Memory in the Target Process
Also listed in: Code Coverage Tools, Memory Data Tracing Tools, Trainer Generators
More details: Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry)



Tool name: WinHex
Rating: 4.5 (2 votes)
Author: Stefan Fleischmann                        
Website: http://www.x-ways.net/winhex
Current version: 15.6
Last updated: March 1, 2010
Direct D/L link: http://www.x-ways.net/winhex.zip
License type: Shareware
Description: WinHex is in its core a universal hexadecimal editor, particularly helpful in the realm of computer forensics, data recovery, low-level data processing, and IT security. An advanced tool for everyday and emergency use: inspect and edit all kinds of files, recover deleted files or lost data from hard drives with corrupt file systems or from digital camera cards. Features include (depending on the license type):

* Disk editor for hard disks, floppy disks, CD-ROM & DVD, ZIP, Smart Media, Compact Flash, ...
* Native support for FAT, NTFS, Ext2/3, ReiserFS, Reiser4, UFS, CDFS, UDF
* Built-in interpretation of RAID systems and dynamic disks
* Various data recovery techniques
* RAM editor, providing access to physical RAM and other processes' virtual memory
* Data interpreter, knowing 20 data types
* Editing data structures using templates (e.g. to repair partition table/boot sector)
* Concatenating and splitting files, unifying and dividing odd and even bytes/words
* Analyzing and comparing files
* Particularly flexible search and replace functions
* Disk cloning (under DOS with X-Ways Replica)
* Drive images & backups (optionally compressed or split into 650 MB archives)
* Programming interface (API) and scripting
* 256-bit AES encryption, checksums, CRC32, hashes (MD5, SHA-1, ...)
* Erase (wipe) confidential files securely, hard drive cleansing to protect your privacy
* Import all clipboard formats, incl. ASCII hex values
* Convert between binary, hex ASCII, Intel Hex, and Motorola S
* Character sets: ANSI ASCII, IBM ASCII, EBCDIC, (Unicode)
* Instant window switching. Printing. Random-number generator.
* Supports files >4 GB. Very fast. Easy to use. Extensive online help.
Also listed in: Binary Diff Tools, Hex Editors, Memory Dumpers, Memory Patchers
More details: Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry)



Tool name: Cheat 'O Matic
Rating: 1.0 (1 vote)
Author: Nick Shaffner                        
Website: http://www.geocities.com/TimesSquare/Dungeon/5633
Current version: 0.99a
Last updated: 1997
Direct D/L link: http://bunnzy.oldgamemusic.com/files/extras/apps/cheatomatic099.zip
License type: Freeware
Description: Cheat 'O Matic is an EXTREMELY easy to use UNIVERSAL cheating program designed to allow you to automatically cheat on ANY game (or other program) that will run on Windows '95, '98 and 'NT (including DOS, Windows 3.1, Windows '95, Windows '98 and Windows 'NT games) - as the game actually runs! Additionally, Cheat 'O Matic allows you to cheat on programs that don't have cheat codes, or in completely different ways that cheat codes may not exist for, and perhaps the game's programmers never intended
Also listed in: Memory Data Tracing Tools
More details: Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry)



Tool name: Cheat Engine
Rating: 0.0 (0 votes)
Author: Dark Byte/Eric Heijnen                        
Website: http://www.cheatengine.org
Current version: 6.4
Last updated: June 19, 2014
Direct D/L link: http://www.cheatengine.org/download/CheatEngine64_NoSetup.rar
License type: APL (Open Source)
Description: Cheat Engine, also known as CE, is an open source and free software, most commonly used for cheating in games using a hex memory searcher and editor to allow people to modify memory addresses. It is currently the most popular cheating software used today. CE has influenced a lot of online games (although it does not work on most any more), as it is open source and can be modified to their needs. This program resembles L. Spiro's MHS, Tsearch, and ArtMoney. It searches for values input by the user with a wide variety of options such as "Unknown Initial Value" and "Decreased Value" scans. Cheat Engine can also create standalone trainers which function on their own without Cheat Engine.

Cheat Engine can also view the disassembled memory of a process and make alterations to give the user advantages such as infinite health, time or ammunition. It also has some Direct3D manipulation tools, allowing you to see through walls, zoom in/out and with some advanced configuration allows Cheat Engine to move the mouse for you to get a certain texture into the center of the screen. This is commonly used to create Aimbots.
Also listed in: Memory Patchers
More details: Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry)



Tool name: Magic Trainer Creator
Rating: 3.0 (1 vote)
Author: Corsica Productions                        
Website: N/A
Current version: 1.270
Last updated:
Direct D/L link: Locally archived copy
License type: Free
Description: A good trainer creator tool.
Also listed in: Trainer Generators
More details: Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry)



Tool name: Process Heap Viewer
Rating: 0.0 (0 votes)
Author: Nagareshwar                        
Website: http://securityxploded.com/ProcHeapViewer.php
Current version: 2.2
Last updated: January 9, 2009
Direct D/L link: Locally archived copy
License type: Free
Description: This is the tool to enumerate process heaps on windows. It uses much better technique than slower Windows heap API functions which makes it faster and efficient. You can enumerate the heaps from normal Windows processes as well as system services. Its very useful tool for anyone involved in analyzing process heaps. Vulnerability researchers can use it as a side tool for discovering heap related vulnerabilities.

This is standalone tool and does not require any installation.

* Launch ProcHeapViewer by clicking on the binary file. It automatically loads all running processes including services.
* Select any process from the list. Then all the heap nodes for that process will be displayed.
* Now you can click on any of the heap nodes to display all the heap blocks within it.
* Next click on one of the heap block to view its content. You can store this data by clicking on the "save" button. To get back to the main screen, simply click on "close" button.
Also listed in: (Not listed in any other category)
More details: Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry)



Tool name: Tsearch
Rating: 0.0 (0 votes)
Author: Corsica Productions                        
Website: N/A
Current version: 1.6b
Last updated:
Direct D/L link: N/A
License type:
Description: A good memory searching tool, often used when creating trainers for games etc.
Also listed in: (Not listed in any other category)
More details: Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry)


RSS feed Feed containing all updates and additions for this category.

RSS feed Feed containing all updates and additions for this category, including sub-categories.





Views
Category Navigation Tree
   Needs New Category  (3)