Collaborative RCE Tool Library - Patch Packaging Tools (including sub-categories)

Tool Updated: THYloadergen

2010-05-30T18:58:57Z

Listed in categories: Code Injection Tools, Loader Generators, Memory Patchers, Patch Packaging Tools, Patcher Generators

Most recent version:
0.6

Most recent release date:
March 6, 2010

Description:
features:
* memory patch packed targets (except process redirected ones, like armadillo debugblocker)
* patch:VA (patch at a virtual address)
* patch:SnR (patch by search&replace)
* hookAPI (specify an API call that is executed after target is fully unpacked. hit count can be specified)
* hookVA (specify a VA that is executed after target is fully unpacked. hit count can be specified)
* wnd (specify a window that is created after target is fully unpacked)
* inject a dll into the process to have the possibility to include more complex stuff than the patching provided. (no live injecting, as this is a loader)
* optional splash screen at startup (pic can be specified, aswell as the transparency)

veyl/THY, MAR/2010

Tool Updated: Whoknows NET patcher

2010-03-27T00:28:18Z

Listed in categories: .NET Patcher Generators

Most recent version:
0.7

Most recent release date:
January 2, 2010

Description:
The purpose of this utility is to make something like dUP for NET assemblies.
also patches the target and resign it to user machine.
Also you can save and load Projects.

Tool Updated: Memory Hacking Software

2009-08-14T20:32:08Z

Listed in categories: Code Coverage Tools, Memory Data Tracing Tools, Memory Search Tools, Trainer Generators

Most recent version:
5.009

Most recent release date:
August 14, 2009

Description:
Highly advanced software for memory search/analysis and trainer creation. Recommended!

MHS 5.005 (bundle):
Bundle includes MHS.exe, zlib1.dll, MHS Help.chm, and ChangeLog.txt.

Features:
* Fastest Searching
-- Data-Type Search
-- Pointer Search
-- String Search (ASCII, Unicode, Hex Bytes, Wildcard, Regular Expressions)
-- Group Search (Includes Pattern Matching)
-- Expression Search (Extremely Flexible)
-- Script Search (The Ultimate in Custom Searching)

* Debugger
-- Very Stable
-- Customizable Breakpoints

* Disassembler

* Code Filter
-- Easiest Way to Find Functions

* Auto-Hack

* Auto-Assembler
-- 90% Same Language/Syntax as in Cheat Engine

* DLL Injector
-- Injects any DLL into the Target Process
-- Uninject Later, Automatically or Manually
-- Remotely Call ANY Functions in the Injected DLL(s), Regardless of Calling Convention, Return Type, or Number of Parameters

* Integrated Script Language
-- IDE/Compiler Built-In
-- Syntax Matches C; No Learning Curve
-- Compiled for Fast Execution
-- Full API
-- Includes Features Specially for Hacking

* Real-Time Hex Editor
-- Fully Featured Real-Time Hex Editor for Both RAM and Files
-- Allows Browsing of Kernel RAM

* Kernel Driver
-- Allows Bypassing Anti-Cheat Systems
-- Allows Reading/Writing of Kernel RAM

* Converter

* RAM Watcher

* Memory Allocator
-- Allocates Memory in the Target Process

Tool Updated: PEBundle

2009-07-19T05:05:31Z

Listed in categories: DLL Bundling Tools

Most recent version:
3.20

Most recent release date:
July 18, 2009

Description:
One of the most advanced EXE/DLL/arbitrary file bundlers ever, especially known for its ability to load bundled DLLs bundled to an EXE directly from memory, without dropping '''anything''' to disk (by way of its own custom implemented PE loader).

Sadly, PEBundle was discontinued (possibly partly brought back again though, see below) when the core technology was purchased by Thinstall, and you can find more info about it in this forum thread:

http://www.bitsum.com/smf/index.php?topic=84.0

There is some confusion regarding if the business deal with Thinstall was later revised or nullified, which can be partly implied by the following thread (I've also read more explicit info regarding this somewhere else, which I cannot find at the moment), where the last post by the author is made a good while '''after''' the discontinuation message in the above thread:

http://www.bitsum.com/smf/index.php?topic=3.0

Because of the uncertain state/future of this product, I've uploaded the trial version from the website mentioned above (which is btw not linked from the rest of the website, only "invisibly" remaining there, indexed by google).

Official info from the product website:

PEBundle is a revolutionary tool that allows for DLLs or other files to be "bundled" with an executable, therefore removing the requirement to distribute the bundled files separately from the application. With two operational modes, one that uses advanced techniques to resolve dependencies on a bundled DLL in memory, and another that writes the bundled file(s) to disk, PEBundle is a great tool to optimize software distributions.

PEBundle Features:

* Effective static linking of a dynamic link library.

* Makes applications and the bundled modules more difficult to reverse engineer and/or tamper with.

* Helps to hide and protect the bundled modules.

* Bundling of modules the application is dependent on allows for the application to be distributed as a single executable that is capable of installing modules it needs on the fly.

* Reduces Dynamic Link Library version problems, a.k.a. “DLL Hell”. This problem is described by Microsoft in MSDN and they actually recommend that applications have their own copies of DLLs so that they will not cause version problems when they overwrite the system copy of the module.

* Supports bundling of scripts to their respective interpreters and auto-launching.

* Works with PECompact, so that your applications and all the modules may be compressed significantly. The write-to-disk module does have internal support for compression of the bundled modules.

* Full support for Windows 95/98/Me/NT/2k/XP. The advanced bundle does hook and support wide character, Unicode, APIs.

OVERVIEW OF IN-MEMORY BUNDLING BY PEBUNDLE:

This mode, called the "Advanced Bundle" in the GUI, allows dynamic link libraries to be bundled with an executable and have all references to those modules resolved at runtime to the appropriate memory addresses without ever writing the dynamic link libraries to disk*. The dependencies are resolved through the use of API hooks by the PEBundle loader, which is attached to the application.

OVERVIEW OF "WRITE-TO-DISK" BUNDLING:

In this mode, PEBundle simply uncompressed and extracts the modules to disk at runtime. This mode supports the bundling of any type of file.

The modules may be extracted to a location the user specifies at the time of bundle, and can optionally only be extracted if the module or a newer version of it does not already exist.

Tool Updated: DUP

2009-07-19T05:04:24Z

Listed in categories: Loader Generators, Patcher Generators

Most recent version:
2.19 DC0506

Most recent release date:
July 18, 2009

Description:
diablo2oo2's Universal Patcher - [dUP]

Probably the most capable patcher/loader creator out there...

Some recent version history
[2.19 (Final release ever?)]
-new "Text-Patch" module !
-bugfix in s&r compare module
-other bugfixes from v2.18
-added linkcursor in patcherwindow
-registry editor now can import v5 reg files
-faster scrolltext engine
-better scrolltext font management
-new function: import long hexpatterns in offset-patch-dialog
-fixed loader_installer bug
-added support for relative paths (subfolders) for the targetfiles
-search & replace comments bugfix
-loader: registrypatcher bugfix
-added new internal environment variable: %dup2_last_path%
-skincontrols now can have transparent backgroundcolor (FFFFFFFF)
-now you can execute multiple search&replace loaders from same directory

[2.18]
-replaced WinExec API by ShellExecute for Windows Vista
-bugfix in Dialog for editing S&R Pattern Occurrence
-added check for skin button IDs
-improved window resizing engine
-added option "trim to path" for Registry Paths
-loader can save now targetfilepath to inifile when its not in same folder
-added TitchySID player for .sid file playback
-added new option for attached files: overwrite existing file
-added support for disabled patch button skin
-added multilanguage support
-fixed bug with tooltip width. long hexpatterns are displayed now in multiple lines
-compiled with new MASM v10
-bugfix when executing attached files
-bugfix for resource (skin) updater
-strings for patcher.exe can be modifed now inside a skin

[2.17]
-improved dup2 plugin for ollydbg v1.10
-long comments for search&replace patchdata now possible
-new v2m player (vista compatible) from http://magic.shabgard.org
-use targetfile information from s&r dialog in CheckOccurrence Dialog
-added function "back to releaseinfo" in patcher logbox
-bug fixed on vista systems with music playback
-"patch" button will be disabled after patching
-some fixes in projectconverter (for old v1.x dup projects)
-changed handling with unresolved environment variables
-original bytes not saved to compiled patcher when
"dont't check original bytes" option is enabled
-fixed bug when saving columnswidth of listviews
-new for Attached File: delete file after execute
-new for Attached File: wait for process
-added support for PECompact (optional commandline settings)
-manifest in resource is now avaible by default
-patcher: last used filepath will be stored inside %dup2_last_file% environment variable
-removed the ugly "flicker"-effect on bitmap buttons
-improved dumping (open projects from patcher.exe)
-advanced registry patching (usage of placeholders)
-changes in bitmapbutton code (please only use new
button names: BTN_PATCH_OVER ...)
-added fade in/out effect for patcher
-problem with the patchers topmost windows fixed
-removed option from settings dialog: dup file association
-important bugfix in loadercode (patching of protected memory)
-added option for registry patches: resolve environment variables
-fixed bug for musicplayback with bassmod.dll
-added textscroller feature
-fill patchinfdialog with default info only when new project is created
-and many more...

Tool Updated: Serial Sniffer Creator

2008-07-26T01:47:02Z

Listed in categories: Loader Generators

Most recent version:
2.0

Most recent release date:
July 24, 2008

Description:
Serial Sniffer Creator is a Cracking Tool to help you make a serial sniffer for any program and you can use it also as a Loader Creator.
===
[What new in this version 2.0 ]
1 - New wonderfull skin => thanks to RobenHoodArab <=.
2 - Browse button to choose your target.
3 - Scroller Text.
4 - Color button to choose the scroller text color.
5 - Patch memory that allow you to patch target addresses in memory.
6 - Save Dialog to save the sniffer file to the specified location.
7 - Only receiving HEX values from user.
8 - Default button to write a default How To Use text.
9 - Generating the Sniffer.exe file when starting the program and delete it when closing it.
10 - Update the Sniffer.exe file (New Skin - EditBox for Software Name - EditBox for How to use - Scroller Text).
11 - Support xm music files.
12 - you can now modify the default skin by modifying the skin.ss file with any ResEditor.
13 - Many Bugs Fixed.
===

Tool Updated: The aPE

2007-11-06T18:10:44Z

Listed in categories: PE Executable Editors, Patcher Generators

Most recent version:
0.1.2.21 beta

Most recent release date:

Description:
The aPE is a patcher program that can be used to patch packed/protected executable files. This is done by code insertion in packer/protector code so that the program can be patched normaly without the unpacking of the packed file. This means that you can now make smaller patches for packed executables. There is no more need for distribution of larger unpacked files... The aPE can patch tham while they are still packed!

:: Which packers are supported?
The complete list of the supported packers and their options can be found here. Curently there are 91 supported packers, and every packer has it`s own patching procedure. There is also a generic inline patching method that can patch many packers/crypters/protectors.

UPX 0.8x - 1.9x
HidePX 1.4
UPX-Scrambler RC 1.x
UPX Protector 1.0x
UPXShit 0.06 & 0.0.1
ASPack 1.x - 2.x
ACProtect/UltraProtect 1.3x - 2.x
EXE32Pack 1.4x
EXEStealth 2.7x
eXPressor 1.2.x - 1.3.x - 1.4.x
EZip 1.0
MEW 1.x
NeoLite 2.0
JDPack 1.x
JDProtect 0.9
nSPack 2.x - 3.x
NoodleCrypt 2.0
PEBundle 2.0x - 3.x
PECompact 1.3x - 1.8x & 2.x
WWPack32 1.x
WinUPack 0.2x - 0.3x
PeX 0.99
PC Shrink 0.71
Polyene 0.01
PeTite 1.x - 2.x
PE Pack 1.0
PKLite32 1.x
FSG 1.xx & 2.0
PackMan 0.0.0.1
yC 1.x
yP 1.0.2 & 1.03.2
Krypton 0.4 & 0.5
UPolyX 0.4 & 0.5
UPXRedir
UPXCrypt
32Lite 0.3a
Stone`s PE Encryptor 2.0
NWCC
CodeCrypt 0.15x - 0.16x
HidePE 2.1
StealthPE 2.1
PE Diminisher 0.1
ORiEN 2.12
Alex Protector 1.0 beta2
GHF Protector (pack) 0.1
SVKP 1.x
UG Chruncher 0.x
Software Compress 1.2 (lite)
SLVc0deProtector 1.11
PolyCrypt PE 2.1.5
PUNiSHER 1.5
ARM Protector 0.1
tELock 0.4x - 0.92
SPLayer 0.08
ShrinkWarp 1.4
PC PE Encryptor alpha
[G!X]`s Protector 1.2
!ExE Pack 1.x
LameCrypt 1.0
Winkript 1.0
Re-Crypt 0.15 & 0.714
PEncrypt 4.0
SPEC b3
DEF 1.0
EP Protector 0.3
SmokesCrypt 1.2
dot Fake Signer 3.x
PESHiELD 0.25
ASProtect 1.x - 2.x
SDProtector 1.x
Enigma 1.x
VirogenCrypt 0.75
PE Lock NT 2.04
UPX Inkvizitor
UPXFreak 0.1
dePack
PESpin 1.x
Simple UPX-Scrambler
BJFNT 1.3
PEStubOEP 1.6
KByS Packer 0.2x
VProtect
UPXLock 1.0nPack 1.x
PELock 1.x
UPXScramb 2.x
SimplePack
hmimysPacker 1.x
exeFog 1.2
PackItBitch

Tool Updated: Magic Trainer Creator

2007-10-19T20:57:54Z

Listed in categories: Memory Search Tools, Trainer Generators

Most recent version:
1.270

Most recent release date:

Description:
A good trainer creator tool.