Collaborative RCE Tool Library - Resource Editors (including sub-categories)

Tool Updated: PE Explorer

2010-03-04T18:40:33Z

Listed in categories: Disassemblers, PE Executable Editors, Resource Editors

Most recent version:
1.99 R6 (silent update)

Most recent release date:
October 14, 2009

Description:
PE Explorer provides powerful tools for disassembly and inspection of unknown binaries, modifying the properties of executable files and customizing and translating their resources. Use this product to do reverse engineering, analyze the procedures and libraries an executable uses.

Features include:

* Working with PE files - exe, dll, sys, drv, bpl, dpl, cpl, ocx and more.
* The ability to open a broken or packed file in Safe mode.
* Support for custom plug-ins to perform any startup processing.
* Collecting the full information contained in the file header.
* Checksum computing and modification.
* Review and editing Data Directories.
* Review of all the sections and info about their location and size.
* Review of contents of section as Raw Data - up to 16 view windows.
* Extracting and deleting sections.
* Section header recalculation.
* Section Editor to modify and repair the damaged section headers.
* Resource Editor to view and modify almost any kind of resources.
* Saving changes to disk as a new file image.
* Full info on exported and imported functions. Review of contents of the base relocation table.
* Quick Function Syntax Lookup. Syntax Description Editor.
* Source code and package information analyzer. Dependency Scanner.
* Built-in Disassembler.
* Customize GUI elements of your favorite Windows programs
* Special support for Delphi applications
* Automatic UPX and Upack unpacking

See multiple screenshots at: http://www.heaventools.com/scrshots.htm

Tool Updated: Stud PE

2010-03-04T18:36:21Z

Listed in categories: Import Editors, PE Executable Editors, Resource Editors

Most recent version:
2.6.0.5

Most recent release date:
October 31, 2009

Description:
Stud_PE The Portable Executables Viewer/Editor (32/64 bit PE files)

Features:
* View/edit PE basic Header information (DOS also):
- Header structures to hexeditor;
* View/edit Section Table:
- Add new section;
* View/edit Directory Table:
- Import/Export Table viewer;
- Import adder;
- Resource viewer/editor (save/replace ico/cur/bmp);
PE Scanner (PEiD sig database):
- 400 packers/protectors/compilers;
* Task viewer/dumper/killer;
* PEHeader/Binary file compare;
* RVA to RAW to RVA;
* Drag'nDrop shell menu integration;
* Basic HexEditor;
* Process region dumper/viewer;

Tool Updated: CodeDoctor

2009-11-12T16:24:49Z

Listed in categories: Deobfuscation Tools, IDA Extensions, OllyDbg Extensions, Resource Editors, Unpacking Tools

Most recent version:
0.90

Most recent release date:
November 12, 2009

Description:
<nowiki>CodeDoctor is a plugin for Olly and IDA.

History:
11.11.2009 - 0.90 - initial public release

________________________________________________________________________________
Functions:

1) Deobfuscate

Select instructions in disasm window and execute this command. It will try
to clear the code from junk instructions.

Example:

Original:
00874372 57 PUSH EDI
00874373 BF 352AAF6A MOV EDI,6AAF2A35
00874378 81E7 0D152A41 AND EDI,412A150D
0087437E 81F7 01002A40 XOR EDI,402A0001
00874384 01FB ADD EBX,EDI
00874386 5F POP EDI

Deobfuscated:
00874372 83C3 04 ADD EBX,4

________________________________________________________

2) Deobfuscate - Single Step

This works like previous command, but does one transformation at a time
_______________________________________________________

3) Move NOPs to bottom

Converts this:

00874396 50 PUSH EAX
00874397 90 NOP
00874398 90 NOP
00874399 52 PUSH EDX
0087439A BA 3F976B00 MOV EDX,somesoft.006B973F

to this:

00874396 50 PUSH EAX
00874397 52 PUSH EDX
00874398 BA 3F976B00 MOV EDX,somesoft.006B973F
0087439D 90 NOP
0087439E 90 NOP

Limitations: it breaks all jumps and calls pointing inwards
________________________________________________________

4) Undo / Redo

Undo or Redo last operation (from one of the above functions)

________________________________________________________

5) Retrieve Jumpy function

This will statically parse instructions and follow all jumps. This is useful
for situations, when program jumps here and there and here and there... When
it encounters some instruction, that can't be followed, it stop and copies
all parsed instruction to an allocated place in memory.

Use settings to set some parameters:
Step over calls - if set, it will step over calls, otherwise it will follow them
Step over jccs - dtto, but for Jccs
Deobfuscate - it will deobfuscate instruction, when it encounters Jcc, RET,
JMP reg/exp, CALL reg/exp; useful for multi-branch

Example:

Original:
00874389 /EB 05 JMP SHORT somesoft.00874390
0087438B

Tool Updated: Explorer Suite

2009-08-19T15:45:19Z

Listed in categories: .NET Executable Editors, .NET Resource Editors, .NET Signature Removers, .NET Tools, Dependency Analyzer Tools, Exe Analyzers, Executable CRC Calculators, Hex Editors, Import Editors, Memory Dumpers, PE Executable Editors, Process Dumpers, Protection Identifiers, Resource Editors

Most recent version:
III

Most recent release date:
August 19, 2009

Description:
A freeware suite of tools including a PE editor called CFF Explorer and a process viewer. The PE editor has full support for PE32/64. Special fields description and modification (.NET supported), utilities, rebuilder, hex editor, import adder, signature scanner, signature manager, extension support, scripting, disassembler, dependency walker etc. First PE editor with support for .NET internal structures. Resource Editor (Windows Vista icons supported) capable of handling .NET manifest resources. The suite is available for x86, x64 and Itanium.

Features:

* Process Viewer
* Windows Viewer
* PE and Memory Dumper
* Full support for PE32/64
* Special fields description and modification (.NET supported)
* PE Utilities
* PE Rebuilder (with Realigner, IT Binder, Reloc Remover, Strong Name Signature Remover, Image Base Changer)
* View and modification of .NET internal structures
* Resource Editor (full support for Windows Vista icons)
* Support in the Resource Editor for .NET resources (dumpable as well)
* Hex Editor
* Import Adder
* PE integrity checks
* Extension support
* Visual Studio Extensions Wizard
* Powerful scripting language
* Dependency Walker
* Quick Disassembler (x86, x64)
* Name Unmangler
* Extension support
* File Scanner
* Directory Scanner
* Deep Scan method
* Recursive Scan method
* Multiple results
* Report generation
* Signatures Manager
* Signatures Updater
* Signatures Collisions Checker
* Signatures Retriever

Tool Added: PunchIt

2008-10-02T15:06:39Z

Listed in categories: Code Injection Tools, GUI Manipulation Tools, Resource Editors

Most recent version:
1.1

Most recent release date:
October 2nd 2008

Description:
It is a program useful to automatically inject into ANY application your sound and music. The music will be played in background when the program runs as before.

The tool comes with a tutorial explaining how it works, trick and useful hints found coding it, and of its sources ..

Get the tutorial here:

http://arteam.accessroot.com/tutorials.html?fid=200

and the tool here

http://arteam.accessroot.com/releases.html?fid=25

Release notes of version 1.1
+ minor updates to improve stability
+ updated bass audio module v2.4.1
+ updated PECompact2 Student Build v2.94.1
+ (*new) Incorporates source Icon in distribution file (if exists)

I admit the Icon changing routine is a bit lame, but works even if it only takes
1st icon entry for MainIcon group of source executable.
I modded program so that PECompact2 doesn't compress resources allowing anyone
to change the Icon in the output file to whatever they would like using a 3rd party
tool (i.e. reshacker, Icon Exe changer, etc.)

Please test and report any probs. As is usually the case, if you choose a packed / protected
source executable, you may run into problems compressing and should choose the non compress
option. This is not a fault of the application, but a limitation imposed by compressor programs
such as PECompact2 (Student build) v1.94.1 (latest).

Tool Added: ResFixer

2008-08-01T00:21:30Z

Listed in categories: Resource Editors

Most recent version:
1.0 beta 1

Most recent release date:
2003

Description:
ResFixer v 1.0 beta 1 by seeQ

1. Introduction
*****************
This program resolves a situation when you want to remove unnecessary code from dumped exe, which after unwrapping is no longer needed. ResFixer - is a resource rebuilder which tries to restore the resource section (.rsrc). As you know many protectors/packers move some of resources (Icon, Icon Group, Version inf) to it's own section. In this case you can't remove protectors/packers section(s) after dumping.

2. Usage
*****************
Method 1 - Completely copies resources section from an entrance file, then finishes gluing the displaced resources and corrects resource tree.
Method 2 - Tries completely reconstruct section on the basis of a tree.

3. Tip's
*****************
1. In programs written on Delphi watch for TLS (native place rdata).
2. Do not forget that resources in file should lay directly from beginning of unique section with name ".rsrc", because differently programs can crash under some build's Win9x and resource viewer's.
3. It is also possible to remove Reloc's from EXE.

4. Bugs
*******************
The program does not check if the file is unpacked.

Tool Added: XN Resource Editor

2008-01-01T19:28:07Z

Listed in categories: Resource Editors

Most recent version:
3.0.0.1

Most recent release date:
December 17, 2005

Description:
XN Resource Editor is a free, powerful, fully featured resource editor and PE module explorer for Windows 98, Windows 2000 and Windows XP.

XNResourceEditor works with all resource files (.RES) and PE modules (.EXE, .DLL, etc.) but it has special knowledge of modules written in Delphi. It can display all the modules that comprise a Delphi program, and let you edit the properties of the components used on Delphi forms.

And unusually XNResourceEditor can modify PE modules - even if you use Windows 98!

Most recent version supports XP Manifest, Accelerator table and .RC files.

Tool Added: EXeScope

2008-01-01T19:24:33Z

Listed in categories: Resource Editors

Most recent version:
6.50

Most recent release date:
March 23, 2004

Description:
Do you want to customize an application? For example,

* to change font,
* to change menu,
* to change an arrangement of dialog,
* etc.,

But you think that it is impossible because you have not source files ?

eXeScope can analyze, display various information, and rewrite resources of executable files, that is, EXE, DLL, OCX, etc. without source files.

Tool Updated: Resource Hacker (Reshacker)

2008-01-01T19:19:55Z

Listed in categories: Resource Editors

Most recent version:
3.4.0

Most recent release date:
March 24, 2002

Description:
Resource Hacker is a freeware utility to view, modify, rename, add, delete and extract resources in 32bit Windows executables and resource files (*.res). It incorporates an internal resource script compiler and decompiler and works on Win95, Win98, WinME, WinNT, Win2000 and WinXP operating systems.

Viewing Resources: Cursor, Icon, Bitmap, GIF, AVI, and JPG resource images can be viewed. WAV and MIDI audio resources can be played. Menus, Dialogs, MessageTables, StringTables, Accelerators, Delphi Forms, and VersionInfo resources can be viewed as decompiled resource scripts. Menus and Dialogs can also be viewed as they would appear in a running application.

Saving Resources: Resources can be saved as image files (*.ico, *.bmp etc), as script files (*.rc), as binary resource files (*.res), or as untyped binary files (*.bin).

Modifying Resources: Resources can be modified by replacing the resource with a resource located in another file (*.ico, *.bmp, *.res etc) or by using the internal resource script compiler (for menus, dialogs etc). Dialog controls can also be visually moved and/or resized by clicking and dragging the respective dialog controls prior to recompiling with the internal compiler.

Adding Resources: Resources can be added to an application by copying them from external resource files (*.res).

Deleting Resources: Most compilers add resources into applications which are never used by the application. Removing unused resources can reduce an application's size.

Known limitation:
Resource Hacker will not read 16bit (Windows 3.1) executables.

Tool Updated: StringEditor

2007-12-29T00:25:00Z

Listed in categories: Resource Editors

Most recent version:
1.0

Most recent release date:
Back in 2005 (but still works!)

Description:
String editor is UNICODE editor for binary string resources.
It is pretty straightforward to use it, so it doesn't have a help (if you press F1, God will help you!)

Besides normal side-by-side expected functionality, and capability of changing the string resource ID, you can also perform a string resource cleanup (messup occurs when buggers are frequently deleting the strings without repacking, so whole string blocks are consuming memory for nothing).

Small and works.

Tool Added: Resourcer for .NET

2007-10-20T15:07:44Z

Listed in categories: .NET Resource Editors

Most recent version:
1.0

Most recent release date:

Description:
Resourcer is an editor for .resources binaries and .resX XML file formats used with the .NET platform. Resourcer allows editing of name/string pairs, import of bitmaps/icons and and merging of resources from different sources.