From Collaborative RCE Tool Library

Jump to: navigation, search

CheckSum Fixer

Tool name: CheckSum Fixer
Rating: 0.0 (0 votes)
Author: Shub-Nigurrath                        
Website: http://arteam.accessroot.com
Current version: 1.0
Last updated: January 5, 2006
Direct D/L link: http://arteam.accessroot.com/releases.html?fid=12
License type: Free
Description: The PE files headers include a CheckSum field which is located into the
IMAGE_NT_HEADER->IMAGE_OPTIONAL_HEADER->CheckSum

This value is an overall checksum of the whole file, often not set and left to 0x0000 by most compilers and thus doesn't happens often to worry about it, but sometimes this value is used to check if there have been alterations in the executable file.
There is for example an API, MapFileAndCheckSum(), which calculates the real checksum of a PE file and reports also the value stored into the PE Header. It is then simple for simple protectors to detect alterations of a PE file, even of a single byte.

It's a simple technique that advanced protector doesn't use too often and you can of course intercept this API and modify it online or skip its call, but for example with PocketPC smartphones or system drivers this check is done by the operative system, so you simply have no choice to intercept this check and the only way is to fix the value stored in the PE file header.

This program simply does this conveniently. Already other tools have this functionality (LordPE for example), but I just wanted a fast program able to fix this checksum in a click (e.g. with LordPE you have to do at least 5, 6 clicks).

It is very handy with ring0 drivers which test this checksum value!
Related URLs: No related URLs have been submitted for this tool yet


Screenshot:
Screenshot of CheckSum Fixer


RSS feed Feed containing all updates for this tool.

You are welcome to add your own useful notes about this tool, for others to see!



If you find that any information for the tool above is missing, outdated or incorrect, please edit it!
(please also edit it if you think it fits well in some additional category, since this can also be controlled)


Views
Category Navigation Tree
   Code Coverage Tools  (13)
   Code Ripping Tools  (2)
   Helper Tools  (3)
   Hex Editors  (13)
   Memory Patchers  (7)
   Packers  (20)
   Profiler Tools  (11)
   String Finders  (10)
   Tool Hiding Tools  (7)
   Tracers  (22)
   Needs New Category  (3)