Developers use .NET Reflector VSPro to:

• Debug assemblies without source code using the Visual Studio debugger
• Decompile and explore .NET assemblies inside Visual Studio
• Serve as a powerful object browser
• Decompile .NET code to understand how it works
• Learn or teach the complexities of a .NET language
• Provide a better alternative to library documentation
• Recover lost or unavailable source code
• Locate performance issues
• Analyze dependencies
• Check obfuscation

Sorry but this tool is not designed for newbies, you should be familiar a bit with manual unpacking first (some tutorials are easy to find on internet).

Features:

- Imports
- An original tree view
- 2 different methods to find original imports (by IAT and/or API calls)
- A *FULL* complete rebuilder (including a new fresh IAT)

- Loader
- An analyzer and ripper of redirected API code
- An injected loader code to support mix of imports + ripped code in a thunk
- A heuristic relocator

- Tracers
- 3 default tracers (disasm, hook & ring3) to find APIs in redirected code
- A plugin interface to develop your own tracers

- Misc
- Support ALL 32/64bits Windows (9x, ME, NT, 2k, XP and Vista32/64)
- An export renormalizer for Win9x/ME (ala Icedump)
- A built-in coloured disasm/hex-viewer to analyze the redirected code
- A built-in dumper
- Support almost all known antidump tricks

Download Link : Download from GencliQ CT Server

32Lite
AnslymPacker
AREA51 Cryptor
Armadillo (minimal protection)
AsdPack
ASPack
ASProtect (old versions)
BeroEXEPacker
CD-Cops
DDeM
depack
DragonArmor
Exe32Pack
ExeCryptor (old versions)
ExeFog
ExeSax
ExeShield
ExeStealth
fEaRz Crypter
FreeCryptor
FriCryptor
FSG
HidePE
HidePX
hmimys-Packer
JDPack
KByS
kkrunchy
LameCrypt
Manolo
MEW
Minke
NeoLite
NME
NsPack
Orien
PackMan
PECompact
PEDiminisher
PE-PACK
PEncrypt
Perplex PE-Protector
PeTite
PEX
PI Cryptor
PKLite32
PollyBox
PolyEnE
Protection Plus
QrYPt0r NuTraL Poly
QuickPack
RLPack
Sopelka
StealthPE
TeLock (not all versions)
TheMida (minimal protection)
unnamed Scrambler
UPack
UPolyX
UProtector
UPX
WindOfCrypt
WinUPack
WWPack32
Yoda Crypter
Yoda Protector
YZPacker
…many others…

Quick Unpack tries to bypass all possible scramblers/obfuscators and restores redirected import. From the version 1.0 the opportunity of unpacking dll is added. From the version 2.0 the attach process feature added which allows to use Quick Unpack as a dumper and import recoverer. Scripts are also supported from version 2.0 which allows unpacking of more complicated protections. This makes Quick Unpack a unique software product which has no similar analogues in the world!

Use force unpacking tick. When the application is run QuickUnpack waits for the OEP breakpoint to trigger. But sometimes this breakpoint may be triggered several times but only the last one is the correct OEP. Using ForceMode option solves this problem. With this option after the application is run QuickUnpack counts breapoint hits and dumps the application only at the last stop. For DLL-files this option is always ticked and allows to restore relocs.

Download :Download Quick Unpack v2.3.7 Apr2010

The loss of source codes is a very serious problem for many developers. From my personal experience I can say that it is indeed a terrible misfortune. Imagine you write the program, spend your force, time and money, release compiled program to the customers… But one morning you see that all your sources are gone (it may be your cat, or aliens. Who knows?) You are in panic. What should you do? Tear one’s hair? There is no need. Just take the VB Decompiler and simply decompile your project! VB Decompiler restores the source code from the pseudo code (P-Code) as close as possible to the original. So, after some modifications you may get really workable source code.

But you ask: what if the program is compiled not to interpreted P-Code, but in assembler Native Code? In this case, of course, you can’t get fully compilable source code. But there is no need for disappointment. VB Decompiler has a built-in powerful disassembler and emulator commands to the extent possible to bring the assembly code to the original. Of course because of the diversity of modern methods of optimization and protection code, the process is not always ideal, but in this situation, VB Decompiler really helps you in the software analysis and reverse engineering.

And what if you develop in Visual Studio, using .NET Framework?

For our decompiler it’s not a problem! VB Decompiler can easily restore the structure from the tables of the assembly, and will be useful for disassembly and analysis of IL code. Our decompiler does not require .NET Framework. It works fine in any 32-bit Windows operating systems and does not require installing additional software.

As you can see VB Decompiler is an ideal tool for analyzing and restoring the source code. VB Decompiler is a “must-have” tool for VB-developers, who appreciates their work, time and money.

Visual Basic Decompiler 8.2

Download Page: Download

Download Page: Download

-New Interface!
Fast-Mode Detection Mode and Enhanced Powerful!
Super-Base of Signatures Updated!
Binders-heuristic detection
“Detection and Extraction Overlay!
-Checking and Automatic Updating!
Super-Fast Detection MD5 Hash!
Multiple-Support Plug-ins for both RDG Packer Detector and other detectors!
Multi-Format Detection MPG, GIF, RAR, ZIP, MP3 etc.
“Detection and removal of attachments!.
-Improved Heuristic!
“Greater stability!
-Supports Windows Vista & Windows 7
“Optimization in scanning speed
MA-detection (Quick) Totally Integrated Home Interface
From New Multi-Language.
And Much More!

Web : http://rdgsoft.8k.com/

Download: RDG Packer Detector Version 0.6.7 ~ 2011

Signature: Signatures 13 May 2011

- Support for multi-monitor configurations
- Hardware breakpoints and fast command emulation now co-operate. That is, run trace rund at full speed (up to and exceeding 500000 commands per second) even if there are hardware breakpoints set
- Purely conditional breakpoints during run trace are strongly accelerated
- Stepping, tracing and execution till selection with hardware breakpoints instead of INT3. Controlled by option Debugging | Use HW breakpoints for stepping
- INT3 and hardware breakpoints allow to declare their location as an entry point and specify call parameters for protocolling
- Scan for hidden modules. .NET environment frequently loads modules but does not report them to Debugger
- Search window keeps up to 8 last searches in a separate tabs
- Option to load .udd information even when path, file name or file checksum is different
- Option to save .udd file on request
- Expressions allow for DWORD==”text”. Doubleword is interpreted as a pointer to string, comparison is done both in ASCII and UNICODE modes
- Updated decoding of several rare commands
- List of windows. I get address of window function directly from the Window tables. This is tricky but works perfectly
- ASCII dumps and ASCII strings in Binary edit are displayed according to the seleced code page (option Appearance | ASCII code page)
- Memory allocated at address 0 will be correctly recognized and displayed. (Yes, it’s possible – I was also astonished by this fact! In this way one can address data using NULL pointer!)
- Improved post-mortem dump. I was unable to find the reason for several reported crashes because they occured in the system DLLs. Now when creating the dump I attempt to backtrace the stack
- Several not-so-inportand changes, like accelerated analysis of tricky code sequences, option to decode registers for selected command, new origin on non-command (safeguard: no shortcut), correct truncation of very long file names in the main menu, restarting of the last loaded executable even when several OllyDbg instances are running in parallel, etc, etc
- And, of course, multiple bugfixes.

http://www.ollydbg.de/odbg201c.zip

Download

SKIDROW ve Razor1911 yazmadan biz yazdık

şimdi ygs (x86 & x64) yakında sonu “s” ile biten sınavların hepsi.

p.s : ne olacak bu öğrencinin hali =]

This tutorial shows you how to set up Visual Studio 2010 (including the Express version) to work with Microsoft MASM.Click here.
If you are using Visual Studio 2008 or Visual C++ 2008 Express, Click here.