Collaborative RCE Tool Library - Installer Tools (including sub-categories)

Tool Updated: MyAut2Exe

2009-07-19T05:02:05Z

Listed in categories: Installer Decompilers

Most recent version:
2.07

Most recent release date:
July 18, 2009

Description:
AutoIT Script Decompiler

Tool Updated: InnoCry

2008-10-08T19:56:11Z

Listed in categories: Installer Extraction Tools

Most recent version:
1.2.7

Most recent release date:
January 14, 2008

Description:
InnoCry is a tool that removes the password from <NON-ArchFour> password protected setups, created with InnoSetup.

Usage:
1. Start the target installation.
2. Start InnoCry and push the "patch" button.
3. Proceed with the installation by pressing the "Next" button.

Supported InnoSetup Engines:
-InnoSetup version 1.3.26
-InnoSetup version 2.0.19
-InnoSetup version 3.0.7
-Version 4.x
-Version 5.x up to ver. 5.2.2

Note: The very first version of InnoSetup is 16 bit and no support for it will be ever added.

-Support for <install-us> password protected software packages.

Known limitations:
1.InnoCry works only on NT based Windows versions (Win9x /ME - not supported).
2.InnoCry has no support for ArcFour encrypted setup packages.
3.InnoCry can patch only one InnoSetup installation, when more than one installation is started at the same time.

Authors:
koranto - coding and code optimization
proletsearch - cracking and coding
tobi - GFX

*With ideas at the very beginning helped a very good reverser: cnbragon/iPB with his article about InnoSetup. So big thanks also to him!*

*****************************
InnoCry v1.2.7 Public release
*****************************

14-January-2008

- Added experimental support for custom InnoSetup dll modules
- Optimized support for advanced custom InnoSetup password scripts
- Added "Enabler" option, that can be used by disabled control items like a disabled <Next> button (in combination with Method 1)

*****************************
InnoCry v1.2.6 Public release
*****************************

04-January-2008

- Added support for standard custom InnoSetup password scripts
- Added support for advanced custom InnoSetup password scripts
- Because of the larger GUI and for the convenience of the user, InnoCry will start above the target installation.
- Brand new gfx design by tobi

*****************************
InnoCry v1.2.5 Public release
*****************************

30-December-2007

- Fixed ARCFOUR detection for the latest InnoSetup engine (ver. 5.2.2)

Tool Updated: All-Seeing Eye

2008-04-28T10:58:55Z

Listed in categories: File System Diff Tools, Install Monitoring Tools, Registry Monitoring Tools, System Diff Tools

Most recent version:
0.7.1

Most recent release date:
2007

Description:
Tool for automated diff-style checking of many sensitive system areas that malware and other programs often try to modify silently. Like Tripwire on speed.

Tool Updated: Orca

2008-01-15T10:14:17Z

Listed in categories: Installer Decompilers, Installer Extraction Tools

Most recent version:

Most recent release date:

Description:
Orca is a database table editor for creating and editing Windows Installer packages and merge modules. The tool provides a graphical interface for validation, highlighting the particular entries where validation errors or warnings occur.

This tool is only available in the Windows SDK Components for Windows Installer Developers. It is provided as an Orca.msi file. After installing the Windows SDK Components for Windows Installer Developers, double click Orca.msi to install the Orca.exe file.

Tool Added: InstallShield (by one exe-file) Unpacker

2008-01-06T11:23:26Z

Listed in categories: Installer Extraction Tools

Most recent version:
0.99

Most recent release date:
April 6, 2004

Description:
This tool unpacks two of three known forms of InstallShield Self-Extracting .EXE-files (like 3DMark03.exe).

First form is All-in-One. All files are stored one by one in IS-exe-container like this:
___________
data1.hdr
data1.cab
data2.cab
engine32.cab
layout.bin
setup.exe
setup.ini
setup.boot
~~~~~~~~~~~~

Second form is All-in-CAB. All files are stored in simple
Microsoft Cabinet File (*.cab) in IS-exe.

Third form is too hard for me to understand, but it's a All-in-MSI (with some files to run *.msi like setup.ini and so on). There are a litte bit of encryption (or compression?) in exe-file. But after you run IS-exe-file you can see in WinDir's Temp folder unpacked *.Msi-file (Microsoft Installer) and you can dig it on your own ;)

Tool Updated: SysAnalyzer

2008-01-05T13:56:31Z

Listed in categories: API Monitoring Tools, Disk Monitoring Tools, File Monitoring Tools, Install Monitoring Tools, Memory Dumpers, Network Monitoring Tools, Registry Monitoring Tools

Most recent version:

Most recent release date:
January 19, 2007

Description:
SysAnalyzer is an automated malcode run time analysis application that monitors various aspects of system and process states. SysAnalyzer was designed to enable analysts to quickly build a comprehensive report as to the actions a binary takes on a system. SysAnalyzer can automatically monitor and compare:

* Running Processes
* Open Ports
* Loaded Drivers
* Injected Libraries
* Key Registry Changes
* APIs called by a target process
* File Modifications
* HTTP, IRC, and DNS traffic

SysAnalyzer also comes with a ProcessAnalyzer tool which can perform the following tasks:

* Create a memory dump of target process
* parse memory dump for strings
* parse strings output for exe, reg, and url references
* scan memory dump for known exploit signatures

Full GPL source for SysAnalyzer is included in the installation package.

Tool Added: Winalysis

2007-11-08T15:24:09Z

Listed in categories: Install Monitoring Tools, System Diff Tools

Most recent version:
3.1

Most recent release date:
January 13, 2006

Description:
Winalysis is a software application that can help you manage change on computers running Windows. The program can:

Make compressed Snapshots of local and remote computer configurations. Test for changes from snapshots at any time.

Monitor for changes to files, the registry, users, groups, security policies, services, shares, scheduled jobs, the system environment and more.

Monitor remote computers from a central location. There is no need to install Winalysis on the remote machines.

Restore files and/or the registry from compressed snapshots with the ability to undo a restore at any time.