http://www.woodmann.com/collaborative/tools/index.php/Special:FeedListing/OEP_Finders/feed?recursive=1&feed_type=atom 2009-11-21T11:40:03Z Update Notification Feed for Category: OEP Finders (and its sub-categories) MediaWiki 1.11.2 via dELTA feed generator http://www.woodmann.com/collaborative/tools/index.php/XTracer 2009-06-17T00:08:44Z

<P><B>Listed in categories:</B>&nbsp;<I><a href="http://www.woodmann.com/collaborative/tools/index.php/Category:OEP_Finders">OEP Finders</a>, <a href="http://www.woodmann.com/collaborative/tools/index.php/Category:Tracers">Tracers</a></I></P><p><b>Most recent version:</b><br /> <i>1.0</i> </p><p><b>Most recent release date:</b><br /> <i>May 25, 2009</i> </p><p><b>Description:</b><br /> <i>xtracer is TLB memory tracer. It tries to locate first break in code section of traced process using split TLB which is available in intel architecture.<br />This code can be used to locate OEP of traced process easily. Currently only 1st break is reported, but you may modify code to handle more breaks as that's not a problem at all if you go trough ring3 program which actually controls driver. You may expect to get very good and fast results no matter which protection you are tracing. Time needed to locate OEP is equal to the time needed to execute protection layer without debugger, nor any tracer.<br /><br />I hope that you will enjoy this fine release from ARTeam, as we only try to bring quality releases to the RCE community. Of course, full source is included for learning purposes (code and tool released under GPL 3.0).<br /><br />Code can be customized to handle various scenarios. Eg. add more breaks on code sections, hooking more some native calls to keep control of almost every allocated buffers, but that's up to the user to implement if he needs it.<br /><br />To use this code simply type:<br /><br />xtracer.exe &lt;applicaton to trace&gt;<br /><br />wait a little bit. Also note that you must have internet connection as code is using my SymbolFinder class to locate some symbols from ntoskrnl.exe which makes this code compatible with windows versions from win2k to Vista SP1.</i> </p>

http://www.woodmann.com/collaborative/tools/index.php/OepFinder 2008-01-06T01:12:40Z

<P><B>Listed in categories:</B>&nbsp;<I><a href="http://www.woodmann.com/collaborative/tools/index.php/Category:Non-Intrusive_Debuggers">Non-Intrusive Debuggers</a>, <a href="http://www.woodmann.com/collaborative/tools/index.php/Category:OEP_Finders">OEP Finders</a></I></P><p><b>Most recent version:</b><br /> <i>X.Y.Z</i> </p><p><b>Most recent release date:</b><br /> <i>March 10, 2006</i> </p><p><b>Description:</b><br /> <i>Generic Oep finder, uses PAGE_GUARD to locate good range. Supports debugging using win32 debug subsystem, and nonintrusive traceing.</i> </p>

http://www.woodmann.com/collaborative/tools/index.php/ASProtect_1.3x_-_2.xx_OEP_Finder_OllyScript 2007-10-20T21:07:00Z

<P><B>Listed in categories:</B>&nbsp;<I><a href="http://www.woodmann.com/collaborative/tools/index.php/Category:OEP_Finders">OEP Finders</a>, <a href="http://www.woodmann.com/collaborative/tools/index.php/Category:OllyScript_Scripts">OllyScript Scripts</a></I></P><p><b>Most recent version:</b><br /> <i>0.1</i> </p><p><b>Most recent release date:</b><br /> <i>September 26, 2006</i> </p><p><b>Description:</b><br /> <i>ASProtect 1.3x - 2.xx OEP Finder</i> </p>

http://www.woodmann.com/collaborative/tools/index.php/Armadillo_5.xx_OEP_Finder_OllyScript 2007-10-20T21:04:58Z

<P><B>Listed in categories:</B>&nbsp;<I><a href="http://www.woodmann.com/collaborative/tools/index.php/Category:OEP_Finders">OEP Finders</a>, <a href="http://www.woodmann.com/collaborative/tools/index.php/Category:OllyScript_Scripts">OllyScript Scripts</a></I></P><p><b>Most recent version:</b><br /> </p><p><b>Most recent release date:</b><br /> <i>September 20, 2007</i> </p><p><b>Description:</b><br /> <i>Armadillo 5.xx OEP Finder (Standard Protection + Debug Blocker)</i> </p>

http://www.woodmann.com/collaborative/tools/index.php/ACProtect_2.0_OEP_Finder_%2B_IAT_Repair_OllyScript 2007-10-20T21:02:25Z

<P><B>Listed in categories:</B>&nbsp;<I><a href="http://www.woodmann.com/collaborative/tools/index.php/Category:IAT_Restore_Tools">IAT Restore Tools</a>, <a href="http://www.woodmann.com/collaborative/tools/index.php/Category:OEP_Finders">OEP Finders</a>, <a href="http://www.woodmann.com/collaborative/tools/index.php/Category:OllyScript_Scripts">OllyScript Scripts</a></I></P><p><b>Most recent version:</b><br /> </p><p><b>Most recent release date:</b><br /> <i>February 10, 2007</i> </p><p><b>Description:</b><br /> <i>ACProtect 2.0 OEP Finder + IAT Repair</i> </p>