View Full Version : review - new tool

April 1st, 2006, 15:08

i'm making a new tool where i try to do some interesting stuff ....


src will be released next week (free as in free beer and free speech )

any inputs are very welcome!

cheers, 0xf001

ps: should compile on any platform

[ edit ] i had to move the page, as that server doesn't respond anymore

April 2nd, 2006, 04:17
Hey, you liar, it didn't compile on my Commodore 64! I feel so dirty and deceived...

Jokes aside, very nice tool 0xf001, you da man.

April 2nd, 2006, 11:59
thx dELTA!

it definately has some potential with that very abstract search i think ... and applications like finding ie polymorph code among other evil things hehe
expressions and rules can be as long as you want and it includes wildcards, too.

so ... i apologize - should compile when you have a qt-devel package available for your platform and when this platform is not too stone old

i recently was told olly can do code searches, too. the difference to that is that here you can be abstract and are not bound to name an opcode explicitly - you can just use groups like "any block of arithmetic instructions of any size that modifies eax, or ebx but not ebp" for example....
(* x insn_group==insn_arithmetic && reg_used==eax || reg_used==ebx && reg_used != ebp)

or evil like
insn_group==control_flow && register_used==eax
and such



April 4th, 2006, 15:01
Very nice indeed!

April 7th, 2006, 09:24
Screenshots looks good ! It seems to be useful and user friendly , i'm waiting for the release

nice work

May 2nd, 2006, 20:33
Good Job! Looking for the source release as well and will definitely contribute to this work since I deal with Linux day to day. One big problem with ELF32 format is it's so poorly documented and really hard to decipher unlike windows PE header.

My primary platform is itanium2 the intel 64 bit chip. Hopefully I can do something in that regard as well.

June 12th, 2006, 06:34

Looks darn impressive, I look forward to its release .


September 30th, 2006, 15:06
looks like a week can be a pretty long time

October 1st, 2006, 02:36
Found on his page

[note] review is a spare time project, and under develompment. recent real life
developments have slowed down its development and thereby pushed back the
planned release also (unfortunately).

I think it will be available in the same time that Damn Vulnerable Linux.

October 6th, 2006, 09:48
Any chance of a pre-alpha release?