Exetools  

Go Back   Exetools > General > Community Tools

Notices

Reply
 
Thread Tools Display Modes
  #1  
Old 06-20-2016, 04:14
CodeCracker CodeCracker is online now
Family
 
Join Date: Jun 2011
Posts: 252
Rept. Given: 15
Rept. Rcvd 222 Times in 59 Posts
Thanks Given: 10
Thanks Rcvd at 821 Times in 185 Posts
CodeCracker Reputation: 200-299 CodeCracker Reputation: 200-299 CodeCracker Reputation: 200-299
CJ-TESTER

CJ-TESTER: (source code MASM included)
How TO USE THIS TOOLS ?
a.) Set a VA from where to start in Config.txt (you can discover the address with IDA or some other tools)
You can even start testing from Entry Point if you wish to log all conditional jumps.
b.) Load the wanted executable and wait for this tool to make the entire dirty job.

The ideea is to run CJ-TESTER an log all jumps with the unexpired program and
then with expired program and compare the log results and see where is different!
Unconventional method (I know) but sometime may do the job!
Attached Files
File Type: zip CJ-TESTER.zip (13.2 KB, 45 views)
Reply With Quote
The Following 2 Users Gave Reputation+1 to CodeCracker For This Useful Post:
MarcElBichon (06-20-2016), Storm Shadow (06-24-2016)
The Following 10 Users Say Thank You to CodeCracker For This Useful Post:
besoeso (06-22-2016), canopus (06-22-2016), Masoud (06-21-2016), Nacho_dj (06-22-2016), niculaita (06-20-2016), serseri_1453 (03-22-2017), TechLord (06-24-2016), uel888 (06-23-2016), wilson bibe (06-20-2016), ZeNiX (06-21-2016)
  #2  
Old 06-21-2016, 18:46
Masoud Masoud is offline
Friend
 
Join Date: Dec 2014
Location: Underground
Posts: 16
Rept. Given: 2
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 7
Thanks Rcvd at 1 Time in 1 Post
Masoud Reputation: 0
Nice idea and makes someone able to crack an app in shortest time, even without Reversing info.
I had the same idea years ago, but never tried to write a program like this.
May I ask you to upload it somewhere else that I could access please?
Reply With Quote
  #3  
Old 06-22-2016, 05:24
CodeCracker CodeCracker is online now
Family
 
Join Date: Jun 2011
Posts: 252
Rept. Given: 15
Rept. Rcvd 222 Times in 59 Posts
Thanks Given: 10
Thanks Rcvd at 821 Times in 185 Posts
CodeCracker Reputation: 200-299 CodeCracker Reputation: 200-299 CodeCracker Reputation: 200-299
Here is a download link:
http://www5.zippyshare.com/v/KH9fTLnm/file.html
Reply With Quote
The Following 3 Users Say Thank You to CodeCracker For This Useful Post:
Masoud (06-23-2016), user_hidden (06-22-2016)
  #4  
Old 06-22-2016, 15:30
Loki Loki is offline
Lo*eXeTools*rd
 
Join Date: Jan 2009
Posts: 122
Rept. Given: 156
Rept. Rcvd 65 Times in 30 Posts
Thanks Given: 58
Thanks Rcvd at 18 Times in 13 Posts
Loki Reputation: 65
There was an Olly plugin that did something similar on v1.10.... OllySnake or something? I'm sure someone else can remember better than me....
Reply With Quote
  #5  
Old 06-22-2016, 16:28
DARKER DARKER is offline
VIP
 
Join Date: Jul 2004
Location: Côte d'Ivoire
Posts: 236
Rept. Given: 13
Rept. Rcvd 90 Times in 35 Posts
Thanks Given: 2
Thanks Rcvd at 90 Times in 34 Posts
DARKER Reputation: 90
It's something like Olly Conditional Branch Logger plugin:
Code:
http://www.woodmann.com/collaborative/tools/index.php/Conditional_Branch_Logger
Reply With Quote
The Following 2 Users Say Thank You to DARKER For This Useful Post:
Masoud (06-23-2016), TechLord (06-24-2016)
  #6  
Old 06-22-2016, 21:05
Loki Loki is offline
Lo*eXeTools*rd
 
Join Date: Jan 2009
Posts: 122
Rept. Given: 156
Rept. Rcvd 65 Times in 30 Posts
Thanks Given: 58
Thanks Rcvd at 18 Times in 13 Posts
Loki Reputation: 65
Yeah, that one too, although I seem to recall something called OllySnake which actually diff'd 2 runs for you aswell.

Could well have been dreaming.
Or high.
Reply With Quote
  #7  
Old 06-24-2016, 09:50
TechLord TechLord is offline
Banned User
 
Join Date: Mar 2005
Location: 10 Steps Ahead of You
Posts: 786
Rept. Given: 389
Rept. Rcvd 247 Times in 112 Posts
Thanks Given: 806
Thanks Rcvd at 2,056 Times in 596 Posts
TechLord Reputation: 200-299 TechLord Reputation: 200-299 TechLord Reputation: 200-299
First of all a BIG thank you to @CodeCracker for this tool.

This reminds me of a post in 2005 regarding almost exactly the same method, that was posted by someone named Benina in one of these forums.

Please do not share or upload on public servers.

Though the content is not mine, I had created the PDF and archived it in my records from 2005, after all !

So I want it to remain only within this forum please. Thank you

Last edited by TechLord; 02-26-2018 at 07:10.
Reply With Quote
  #8  
Old 06-25-2016, 05:54
Kurapica's Avatar
Kurapica Kurapica is online now
VIP
 
Join Date: Jun 2009
Location: Archives
Posts: 114
Rept. Given: 11
Rept. Rcvd 126 Times in 35 Posts
Thanks Given: 14
Thanks Rcvd at 171 Times in 36 Posts
Kurapica Reputation: 100-199 Kurapica Reputation: 100-199
Is there any plan for the 64 bit apps ?
Reply With Quote
  #9  
Old 06-25-2016, 11:53
niculaita's Avatar
niculaita niculaita is online now
Family
 
Join Date: Jun 2011
Location: here
Posts: 1,076
Rept. Given: 835
Rept. Rcvd 85 Times in 57 Posts
Thanks Given: 2,452
Thanks Rcvd at 405 Times in 286 Posts
niculaita Reputation: 85
link to pdf deleted file/dead
Reply With Quote
  #10  
Old 06-25-2016, 17:59
Masoud Masoud is offline
Friend
 
Join Date: Dec 2014
Location: Underground
Posts: 16
Rept. Given: 2
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 7
Thanks Rcvd at 1 Time in 1 Post
Masoud Reputation: 0
Quote:
Originally Posted by niculaita View Post
link to pdf deleted file/dead
File attached .
Attached Files
File Type: pdf USINGLOGWINDOW.pdf (131.6 KB, 15 views)
Reply With Quote
  #11  
Old 06-26-2016, 00:27
squareD's Avatar
squareD squareD is offline
VIP
 
Join Date: Aug 2005
Location: Banana Republic
Posts: 245
Rept. Given: 31
Rept. Rcvd 31 Times in 23 Posts
Thanks Given: 19
Thanks Rcvd at 73 Times in 47 Posts
squareD Reputation: 31
Just saw this little prog few minutes ago...
Next time working with 30 day trial, I will test it, but will changing some jumps solve the problem?
May be, I will report when test has done.
But first I almost work for key, activation code or something like that, it's the best solution
__________________
The three worst enemies of the reversers: sun , fresh air and especially this unbearable roar of birds ...
Reply With Quote
  #12  
Old 03-22-2017, 01:09
CodeCracker CodeCracker is online now
Family
 
Join Date: Jun 2011
Posts: 252
Rept. Given: 15
Rept. Rcvd 222 Times in 59 Posts
Thanks Given: 10
Thanks Rcvd at 821 Times in 185 Posts
CodeCracker Reputation: 200-299 CodeCracker Reputation: 200-299 CodeCracker Reputation: 200-299
CJ-TESTER v2

WellCknown limitations:
- When threads are created with ntdll_12.RtlUserThreadStart (77C201C4)
jump logs are not logged anymore! Doesn't support multiple threads!

What's new in 2.0 version:
- Now a new dialog is shown when Config.txt is not present,
with that dialog you can write configuration information - configure the program:
- "Target exe" - file for which to log jumps
- 2 radio buttons: RVA (Relative Virtual Address) or VA (Virtual address)
are the type of first breakpoint address
- Skip System - skip logging jumps from system files
- EP button: get entry point from "Target exe" and set address with it
- Fixed Windows 7 compatibility

Read Readme.txt
Attached Files
File Type: zip CJ-TESTER_v2.zip (41.7 KB, 23 views)
Reply With Quote
The Following 3 Users Gave Reputation+1 to CodeCracker For This Useful Post:
alephz (03-22-2017), MarcElBichon (03-22-2017), niculaita (03-22-2017)
The Following 5 Users Say Thank You to CodeCracker For This Useful Post:
abhi93696 (03-23-2017), new_profile (03-22-2017), niculaita (03-22-2017), serseri_1453 (03-22-2017), wilson bibe (03-22-2017)
  #13  
Old 03-23-2017, 16:41
abhi93696 abhi93696 is offline
Friend
 
Join Date: Mar 2017
Location: India
Posts: 73
Rept. Given: 0
Rept. Rcvd 9 Times in 3 Posts
Thanks Given: 157
Thanks Rcvd at 164 Times in 69 Posts
abhi93696 Reputation: 10
Hi

I have a old video regarding tracing the differences b/w 2 programs using only debugger, Excel,Text compare soft which i had posted it in the tutorials section-:

http://forum.exetools.com/showthread.php?t=18178

BR
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Export Table Tester Nacho_dj Community Tools 3 08-13-2016 07:02


All times are GMT +8. The time now is 20:15.


��ICP��05004977��
Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX