Collaborative RCE Tool Library - CFF Explorer Extensions (including sub-categories)

Tool Added: Header Pack Script

Wed, 05 Mar 2008 01:56:33 GMT

Listed in categories: CFF Explorer Extensions

Most recent version:
1.0.0.1

Most recent release date:

Description:
This neat little script does the following:

-- packs the dos header + PE header + section headers
-- removes useless things like the Rich Signature
-- removes linker references inside the PE header
-- strips the debug information (if any) from the PE
-- if it's a .NET, removes Strong Name Signature
-- updates checksum

The header produced by this script comes, as I said, without DOS stub: I don't think it will be missing in 2008. The most efficient way to use this script is to execute it automatically after every linking. The PE header could be packed even more (for example one could reduce the data directory entries), but this goes beyond what I wanted to do: I just wanted my executables to be garbage clean.

Tool Added: PE Validator Script

Fri, 08 Feb 2008 10:35:59 GMT

Listed in categories: CFF Explorer Extensions

Most recent version:
1.0.0.1

Most recent release date:

Description:
A simple script for the CFF Explorer which detects some of the most common PE integrity problems. Some of the things checked by this script:

-- check CRC32 (useful for drivers)
-- check number of rva and sizes
-- check image size
-- check sections
-- check that EP is valid
-- check that EP is in code
-- check that the EP section is executable
-- check data directories RVAs
-- check whether the API IsDebuggerPresent is imported

Tool Added: QuickUnpack CFF Explorer Extension

Thu, 24 Jan 2008 11:46:31 GMT

Listed in categories: CFF Explorer Extensions

Most recent version:
1.0

Most recent release date:
January 24, 2008

Description:
Extension for CFF Explorer. This is an adaptation of the already released QuickUnpack DLL (http://www.woodmann.com/collaborative/tools/index.php/QuickUnpack_DLL), which is in turn based on the original QUnpack sources (by FEUERRADER of AHTeam).

Tool Added: Ultimate Aspacker Unpacker

Sun, 20 Jan 2008 17:17:07 GMT

Listed in categories: CFF Explorer Extensions

Most recent version:

Most recent release date:

Description:
The Ultimate Aspacker Unpacker is an Aspack 2.12 offline unpacker extension for the CFF Explorer which supports any kind of PE file.

Tool Updated: Resource Tweaker

Sun, 20 Jan 2008 16:42:13 GMT

Listed in categories: CFF Explorer Extensions

Most recent version:
1.0.0.1

Most recent release date:

Description:
Resource Tweaker is an extension for the CFF Explorer, which makes it possible for older resource editors such as Resource Hacker to edit PE64 files (you can edit all non-x86 PEs). Win32 resources haven't changed much (what changed are bitmaps, icons, cursors which can be edited with the CFF Explorer), although the PE format has. It doens't make much sense to reinvent the wheel, since, through this extension, you can keep using your favourite resource editor. This extension works 100%.