Collaborative RCE Tool Library - Data Extraction Tools (including sub-categories)

Tool Updated: OfficeMalScanner

2010-06-17T09:51:08Z

Listed in categories: Code Ripping Tools, Data Search and Extraction Tools

Most recent version:
v0.51

Most recent release date:
February 5, 2010

Description:
OfficeMalScanner v0.51 is a Ms Office forensic tool to scan for malicious traces, like shellcode heuristics, PE-files or embedded OLE streams. Found files are being extracted to disk. It supports disassembly and hexview as well as an easy brute force mode to detect encrypted files. Next to this, an office file is being scanned for VB-macro code and if found, it will be extracted for further analysis. The "inflate" feature extracts Ms Office 2007 documents into a directory and marks potentially malicious files. Also included in this package is a tool called MalHost-Setup, some kind of MS Office runtime emulation environment to debug shellcode in malicious documents in realtime.

Tool Added: Pdf-parser

2009-11-05T01:26:57Z

Listed in categories: Data Extraction Tools

Most recent version:
0.3.1

Most recent release date:
May 13, 2009

Description:
This tool will parse a PDF document to identify the fundamental elements used in the analyzed file. It will not render a PDF document. The code of the parser is quick-and-dirty, I’m not recommending this as text book case for PDF parsers, but it gets the job done.

The stats option display statistics of the objects found in the PDF document. Use this to identify PDF documents with unusual/unexpected objects, or to classify PDF documents. For example, I generated statistics for 2 malicious PDF files, and although they were very different in content and size, the statistics were identical, proving that they used the same attack vector and shared the same origin.

The search option searches for a string in indirect objects (not inside the stream of indirect objects). The search is not case-sensitive, and is susceptible to the obfuscation techniques I documented (as I’ve yet to encounter these obfuscation techniques in the wild, I decided no to resort to canonicalization).

filter option applies the filter(s) to the stream. For the moment, only FlateDecode is supported (e.g. zlib decompression).

The raw option makes pdf-parser output raw data (e.g. not the printable Python representation).

objects outputs the data of the indirect object which ID was specified. This ID is not version dependent. If more than one object have the same ID (disregarding the version), all these objects will be outputted.

reference allows you to select all objects referencing the specified indirect object. This ID is not version dependent.

type alows you to select all objects of a given type. The type is a Name and as such is case-sensitive and must start with a slash-character (/).

Tool Updated: PowerGREP

2009-07-18T22:36:22Z

Listed in categories: Data Search and Extraction Tools, Regular Expression Tools, Source Code Search Tools, String Finders

Most recent version:
3.5.2

Most recent release date:
March 11, 2009

Description:
PowerGREP is a very powerful Windows grep tool. Quickly search through large numbers of files on your PC or network, including text and binary files, compressed archives, MS Word documents, Excel spreadsheets and PDF files, etc. Find the information you want with powerful text patterns (regular expressions) specifying the form of what you want, instead of literal text. Search and replace with one or many regular expressions to comprehensively maintain web sites, source code, reports, etc. Extract statistics and knowledge from logs files and large data sets.

Tool Updated: Universal Extractor

2009-03-16T17:36:34Z

Listed in categories: Data Extraction Tools

Most recent version:
1.6

Most recent release date:
October 17, 2008

Description:
Universal Extractor is a program do to exactly what it says: extract files from any type of archive, whether it's a simple zip file, an installation program, or even a Windows Installer (.msi) package. This is still a work in progress (see details below), but so far it's proven quite useful and I feel others can also benefit from it.

I should stress that this application is not intended to be a general purpose archiving program. It will never replace WinRAR, 7-Zip, etc. What it will do is allow you to extract files from virtually any type of archive, regardless of source, compression method, etc. The original motivation behind this project was that I wanted an easy, convenient way to extract files from installation packages, such as Inno Setup or Windows Installer packages, without pulling up a command line every time. In the process I got a little carried away and ended up throwing in support for every kind of archive format I possibly could find.

Tool Updated: InnoCry

2008-10-08T19:56:11Z

Listed in categories: Installer Extraction Tools

Most recent version:
1.2.7

Most recent release date:
January 14, 2008

Description:
InnoCry is a tool that removes the password from <NON-ArchFour> password protected setups, created with InnoSetup.

Usage:
1. Start the target installation.
2. Start InnoCry and push the "patch" button.
3. Proceed with the installation by pressing the "Next" button.

Supported InnoSetup Engines:
-InnoSetup version 1.3.26
-InnoSetup version 2.0.19
-InnoSetup version 3.0.7
-Version 4.x
-Version 5.x up to ver. 5.2.2

Note: The very first version of InnoSetup is 16 bit and no support for it will be ever added.

-Support for <install-us> password protected software packages.

Known limitations:
1.InnoCry works only on NT based Windows versions (Win9x /ME - not supported).
2.InnoCry has no support for ArcFour encrypted setup packages.
3.InnoCry can patch only one InnoSetup installation, when more than one installation is started at the same time.

Authors:
koranto - coding and code optimization
proletsearch - cracking and coding
tobi - GFX

*With ideas at the very beginning helped a very good reverser: cnbragon/iPB with his article about InnoSetup. So big thanks also to him!*

*****************************
InnoCry v1.2.7 Public release
*****************************

14-January-2008

- Added experimental support for custom InnoSetup dll modules
- Optimized support for advanced custom InnoSetup password scripts
- Added "Enabler" option, that can be used by disabled control items like a disabled <Next> button (in combination with Method 1)

*****************************
InnoCry v1.2.6 Public release
*****************************

04-January-2008

- Added support for standard custom InnoSetup password scripts
- Added support for advanced custom InnoSetup password scripts
- Because of the larger GUI and for the convenience of the user, InnoCry will start above the target installation.
- Brand new gfx design by tobi

*****************************
InnoCry v1.2.5 Public release
*****************************

30-December-2007

- Fixed ARCFOUR detection for the latest InnoSetup engine (ver. 5.2.2)

Tool Added: PDF Streams Inflater

2008-09-29T18:00:09Z

Listed in categories: Data Extraction Tools

Most recent version:

Most recent release date:
September 24, 2008

Description:
I've made this tool because PDF exploits (JavaScript inside PDF) are mostly hidden inside compressed streams.
It will find and decompress zlib compressed streams. A new file per stream found will be created, where every such file will contain the decompressed stream content.

Hope you will find it useful.

I've made it in 3 hours (inclusive doing a research about streams in PDF files), so it may have some glitches and bugs. Please report your findings and/or suggestions.

I have tested it on PDF files created by a couple of tools as there are some differences in created files between tools (different EOL, EOL after token identifier etc.)

Tool Added: ArCHMage

2008-03-27T12:49:43Z

Listed in categories: Help File Decompilers

Most recent version:
0.1.9

Most recent release date:
July 7, 2007

Description:
arCHMage is an extensible reader and decompiler for files in the CHM format. This is the format used by Microsoft HTML Help, and is also known as Compiled HTML.

arCHMage is written in the Python programming language and uses PyCHM - python bindings for CHMLib from GnoCHM project.

Originally this utility was written by Eugeny Korekin, but since 2005 it has been maintained and developed by Basil Shubin.

Features
* Extracting CHM content
* Dumping HTML data from CHM file as plain text (using external tools)
* Running as standalone http-server
* Extension for Apache Web Server - mod_chm

Tool Updated: Chm Decompiler

2008-03-27T12:44:37Z

Listed in categories: Help File Decompilers

Most recent version:
3.50

Most recent release date:
February 25, 2008

Description:
ChmDecompiler is a decompiler for .CHM file. With ChmDecompiler, you can convert any .CHM files to .htm easily, and you can extract any/all source files from the .CHM, even the .HHP project file can be recreated perfectly! All Alias and Map definitions will be recovered, too.

Features:
* Decompile a CHM Html help file or CHM ebook quickly and easily.
* Recover the .HHP project file perfectly.
* Extract Alias and Map files from the CHM file.
* Decompile all MS CHM files / CHM ebooks in batch processing.
* Extract a/any files from a chm file or chm ebook.
* Convert any chm files to html freely.
* Manage CHM Html help file like a zip file.
* An excellent CHM file viewer or CHM file reader.
* Integration with Windows shell.
* Multilanguage support, the interface of the program can be changed to Croatian, Danish, Deutsch, Dutch, English, French, Italian, Korean, Norwegian, Polish, Portuguese, Russian, Simplified Chinese, Slovenian, Spanish, Swedish, Traditional Chinese.
* Built-in chm files decompiler with batch processing.
* Easy-to-use interface.

Tool Updated: Orca

2008-01-15T10:14:17Z

Listed in categories: Installer Decompilers, Installer Extraction Tools

Most recent version:

Most recent release date:

Description:
Orca is a database table editor for creating and editing Windows Installer packages and merge modules. The tool provides a graphical interface for validation, highlighting the particular entries where validation errors or warnings occur.

This tool is only available in the Windows SDK Components for Windows Installer Developers. It is provided as an Orca.msi file. After installing the Windows SDK Components for Windows Installer Developers, double click Orca.msi to install the Orca.exe file.

Tool Added: TMG Ripper Studio

2008-01-10T21:16:26Z

Listed in categories: Code Ripping Tools

Most recent version:
0.03

Most recent release date:
2005

Description:
This is a tool for converting a small part of a program into assemblycode that you could paste into your own sources. The program takes either a fileoffset or a virtual address as input and starts to disassemble from that point. When a conditional jump is reached, it branches and follow both directions. It also follows unconditional jumps and traces calls.

Tool Added: InstallShield (by one exe-file) Unpacker

2008-01-06T11:23:26Z

Listed in categories: Installer Extraction Tools

Most recent version:
0.99

Most recent release date:
April 6, 2004

Description:
This tool unpacks two of three known forms of InstallShield Self-Extracting .EXE-files (like 3DMark03.exe).

First form is All-in-One. All files are stored one by one in IS-exe-container like this:
___________
data1.hdr
data1.cab
data2.cab
engine32.cab
layout.bin
setup.exe
setup.ini
setup.boot
~~~~~~~~~~~~

Second form is All-in-CAB. All files are stored in simple
Microsoft Cabinet File (*.cab) in IS-exe.

Third form is too hard for me to understand, but it's a All-in-MSI (with some files to run *.msi like setup.ini and so on). There are a litte bit of encryption (or compression?) in exe-file. But after you run IS-exe-file you can see in WinDir's Temp folder unpacked *.Msi-file (Microsoft Installer) and you can dig it on your own ;)

Tool Updated: IZArc

2007-12-30T14:43:24Z

Listed in categories: Compressed Archive Tools, Disc Image Tools

Most recent version:
3.81

Most recent release date:
June 14, 2007

Description:
IZArc is the ultimate freeware archive utility supporting many archive formats like: 7-ZIP, A, ACE, ARC, ARJ, B64, BH, BIN, BZ2, BZA, C2D, CAB, CDI, CPIO, DEB, ENC, GCA, GZ, GZA, HA, IMG, ISO, JAR, LHA, LIB, LZH, MDF, MBF, MIM, NRG, PAK, PDI, PK3, RAR, RPM, TAR, TAZ, TBZ, TGZ, TZ, UUE, WAR, XXE, YZ1, Z, ZIP, ZOO. With a modern easy-to-use interface, IZArc provides support for most compressed and encoded files, as well as access to many powerful features and tools. It allows you to drag and drop files from and to Windows Explorer, create and extract archives directly in Windows Explorer, create multiple archives spanning disks, creating self-extracting archives, repair damaged zip archives, converting from one archive type to another, view and write comments and many more. IZArc has also built-in multilanguage support.

With IZArc you can open CD image files like ISO, BIN, CDI and NRG. It is also possible to convert such files from one type to another (BIN to ISO, NRG to ISO).

If you need to send large files to your colleagues, friends or customers who may not have archiving tool you can easily create self-extracting archive that can be extracted by simple double click.

IZArc can be configured to run your preferred Anti-Virus scanner when you open any archives.

IZArc supports 256-bit AES encryption to secure your data.

IZArc is integrated in Windows so you can perform all archiving operations by using right-click menus in Windows Explorer.

If you have broken archives IZArc can help you to repair them with ease.

IZArc is 100% virus free and it doesn't contain any spyware or adware.

IZArc is the most complete archive utility available today.

Tool Updated: WinRAR

2007-12-30T14:40:22Z

Listed in categories: Compressed Archive Tools

Most recent version:
3.71

Most recent release date:
September 21, 2007

Description:
In addition to the common ZIP/RAR functionality, WinRAR can extract CAB files, which is helpful for extracting files from many installer packages.

Tool Updated: PowerArchiver Command Line

2007-12-30T14:39:29Z

Listed in categories: Compressed Archive Tools

Most recent version:
4.0

Most recent release date:

Description:
PACL is an advanced command line archiving utility for Windows console environments. It fully supports a variety of the most popular compressed file formats, including: ZIP, CAB, JAR, TAR, TAR.GZ, TAR.BZ2, yENC, Base64, CAB SFX and many others. PACL also includes 5 different encryption methods.

PACL was designed to be a versatile, reliable and scriptable application that can be used in many different configurations and scenarios.

Tool Updated: Power Archiver

2007-12-30T14:38:36Z

Listed in categories: Compressed Archive Tools

Most recent version:
2007

Most recent release date:

Description:
PowerArchiver has been downloaded by tens of millions of users worldwide. PowerArchiver 2007 offers hundreds of features, yet remains easy to use, small and fast. Novice users will find a familiar interface complete with tutorial and detailed help, while more experienced users can take advantage of full Explorer integration, multiple encryption methods and advanced compression algorithms.

Here is a brief list of some of the key features found in PowerArchiver, but we recommend downloading an evaluation copy to realize its full potential. View the full feature list for more.

Full Windows Vista Support

PowerArchiver 2007 includes full support for Microsoft's newest operating system, Windows Vista. User Account Control and new Vista dialog windows such as New, Open and Save are supported.

You do not need to worry about compatibility problems with PowerArchiver if you are using or considering upgrading to Vista - we have done extensive testing to ensure everything works perfectly.
New, Modern User Interface

Modern User Interface A completely revamped user interface in PowerArchiver 2007 makes it easier to access the wealth of features that PowerArchiver has. This task-based interface utilizes the same "Ribbon" design found in Microsoft Office 2007, and ensures you qick access to the most used features while not hidding others under layers of menus.

For those that desire the older look, PowerArchiver's Classic interface is still available.
Superior ZIP Support

ZIP Support PowerArchiver offers superior ZIP format support compared to other archivers. Here are the highlights:

* Support for unlimited file size and unlimited number of files in ZIP archives
* Support for advanced Deflate64 method providing higher compression ratios
* ZIP AES support (both PkZip 5.1 and WZ 9.0 standards supported)
* Fast and strong compression and decompression
* Multiple disk spanning, with support for unlimited span sizes

7-Zip Compression

7-Zip is an advanced compression format featured in PowerArchiver 2007. It is an open source format, providing an open architecture and high compression ratio. 7-Zip outperforms ZIP, ACE and even RAR in many tests. However, 7-Zip's greatest strength is that it is not controlled by any organization or individual, but by an open source LGPL project to which anyone can contribute. More information on 7-Zip and its superior compression can be found at 7-Zip.org.

PowerArchiver 2007 introduces a new Transparent Update feature for 7-Zip archives, which allows you to quickly add or remove files even if the archive is "Solid."
Multiple Formats Support Including ISO

PowerArchiver has native support for most popular compressed and encoded formats currently in use. All formats are fully integrated into PowerArchiver, so you can utilize all PowerArchiver tools with each of them.

* Read and write support for ZIP, 7-ZIP, CAB, LHA (LZH), TAR, GZIP, BZIP2, BH, XXE, UUE, yENC, and MIME (Base 64)
* Read and extract support for: RAR, ARJ, ARC, ACE, ZOO plus ISO, BIN, IMG and NRG disc image formats
* Brand new Plug-in System enables new formats and file types to be supported with a small download.

New Queue System (Add/Extract/Backup) and PowerArchiver Starter

An innovative Queue System has been added to PowerArchiver 2007. This is the first time such an option is available in compression utility, and it enables you to better organize your compression, extraction and backups, as well as schedule multiple jobs to be done sequentially without slowing down your system - as multiple compressions would do if run all at once. Another first for PowerArchiver.

PowerArchiver Starter is a brand new system tray application for managing your Queue and launching the most recently used archives and backups. PowerArchiver Starter has been written in an assembler-like language for minimum size and memory usage.
Unmatched Security

EncryptPowerArchiver comes with an unprecedented level of security features. Not only does it fully support the new ZIP AES standard, PowerArchiver also offers its proprietary PAE standard for additional security with five different encryption methods. For ease of use, the PowerArchiver Password Manager will save your frequently used passwords so you do not need to remember them.

* Full support for ZIP AES encryption, 128-bit/192-bit/256-bit (supports: PKZip 5.1 (full), Secure Zip 8.0 and WinZip 9.0 AE-1 & AE-2)
* PAE support - Encryption of files and archives using 5 different methods: Blowfish (128-bit), DES (64-bit), Triple DES (128-bit), AES 128-bit, and AES 256-bit

Automated Backups

Backup Security vulnerabilities have become a major problem in Windows, which means it is critical to backup and protect your important data. With PowerArchiver's built-in Backup Wizard, it is a breeze to backup your files.

By using a step-by-step wizard, you will be able to add files and folders, filter them based on your specifications, use 5 different compressions formats, add password protection, and even upload your backup to an FTP or SFTP (SSH) server directly!

To keep your backups secure from prying eyes, you can also encrypt the archives using ZIP AES encryption.
Guaranteed Compatibility and Explorer Integration

Explorer Integration PowerArchiver has pioneered advanced Shell Extensions that let you compress, extract and encrypt files using one click from within Windows Explorer -- without opening PowerArchiver.

Not only that, but PowerArchiver also offers an option to use an Explorer-like interface for browsing your hard drive for archives, which also supports shell integration.

PowerArchiver 2007 adds new Hybrid Shell Extensions, which puts less frequently used options in an easy to access submenu.
Compression Profiles

For ease of use, PowerArchiver has Compression Profiles that store frequently used compression settings. You can select a compression profile when performing operations in PowerArchiver and save considerable time.
Useful Tools

Multi-Extract PowerArchiver has the most advanced set of tools that you can use to manage your archives:

* Convert Tool - convert files among formats supported in PowerArchiver. It can convert thousands of files and folders at the same time.
* Encode Tool - encode/decode files in UU, XX, MIME and yENC formats.
* Repair Tool - repair broken ZIP archives with one simple operation.
* Write/Merge Multivolume Tools - split ZIP files into multivolumes, and also merge multivolumes into a single ZIP archive.
* Batch ZIP Tool - batch compress thousands of files into separate archives.
* Multi-Extract Tool - extract thousands of archives at the same time.
* SFX Tool - Create SFX files from ZIP, 7-Zip, CAB and PAE archives via the "Make SFX" feature or with the easy-to-use SFX Wizard.

Tool Updated: IZArc Command Line Add-On

2007-12-30T14:37:21Z

Listed in categories: Compressed Archive Tools

Most recent version:
v1.1 (Build 140)

Most recent release date:
January 22, 2007

Description:
The IZArc Command Line Add-On is set of advanced command line tools for Windows. They can be called from batch (.bat) files, embedded in scripting languages or executed from other applications.

Main Features

- Create ZIP, CAB, LHA, BH (BlakHole), JAR (JavaARchiver), TAR, TGZ (GZiped TAR) and TBZ (BZiped TAR) archives.
- Extract ZIP, RAR, ARJ, CAB, LHA(LZH), ARC, ACE, GZIP, BZIP2, TAR (TGZ, TBZ2), UUE, ZOO, JAR (JavaARchiver) archives.
- Strong 128-bit and 256-bit AES encryption (WinZip 9 compatible).
- Support BZip2 compression for ZIP archives (WinZip 9 compatible).
- Support large ZIP files (> 4GB).
- Test archive integrity.
- Display contents of archive.

Tool Updated: 7-Zip

2007-12-30T14:34:22Z

Listed in categories: Compressed Archive Tools

Most recent version:
4.57

Most recent release date:
December 6, 2007

Description:
7-Zip is open source software. Most of the source code is under the GNU LGPL license. The unRAR code is under a mixed license: GNU LGPL + unRAR restrictions.

You can use 7-Zip on any computer, including a computer in a commercial organization. You don't need to register or pay for 7-Zip. But you can make a donation to support further development of 7-Zip.

The main features of 7-Zip

* High compression ratio in new 7z format with LZMA compression
* Supported formats:
o Packing / unpacking: 7z, ZIP, GZIP, BZIP2 and TAR
o Unpacking only: RAR, CAB, ISO, ARJ, LZH, CHM, MSI, WIM, Z, CPIO, RPM, DEB and NSIS
* For ZIP and GZIP formats, 7-Zip provides a compression ratio that is 2-10 % better than the ratio provided by PKZip and WinZip
* Self-extracting capability for 7z format
* Integration with Windows Shell
* Powerful File Manager
* Powerful command line version
* Plugin for FAR Manager
* Localizations for 69 languages