http://forums.windowsforum.org/index.php?showtopic=33778

找引擎, 发现有些引擎exe都是不压缩的, 也就是, 如果感染病毒, 照样可以运行.

然后, 就随便找了两个, 用ResHacker装模作样修改成"新"版本, 加上自己的图标和信息...

但也碰到压缩过的引擎, 这类引擎的资源不容修改, 一旦修改, 立即罢工, 病毒就无可奈何... 类似技术1999以前就有...

Resource Hacker is a tool to hack Windows system files. You can edit system files and change the look of dialog boxes, menus and many other things the way you like.

Following are a few screenshots of a few interesting hacks which can be done using Resource Hacker:

http://img459.images...untitled7gu.jpg

http://img354.images...ntitled23nx.jpg

http://img354.images...ntitled32jt.jpg

http://img299.images...ntitled28ey.jpg

Above are just a few examples. You can use Resource Hacker for changing almost everything you want.

I have posted my resource hacker tutorial at my site, I got a gr8 response from ppl in various forums. So pls take a look at the tutorial and lemme know how is it? If you want to ask anything, feel free to ask.

All About Resource Hacker in a brief Tutorial

To read all resource hacker tutorials:

All Resource Hacker Tutorials

0

#2   APK

  • Newbie
  • Group: WF Member
  • Posts: 98
  • Joined: 22-November 07
  • Gender:Male
  • Location:A discrete point in the space-time continuum...

Posted 09 May 2008 - 14:30

Vishal Gupta, on Nov 26 2007, 04:16, said:

Resource Hacker is a tool to hack Windows system files. You can edit system files and change the look of dialog boxes, menus and many other things the way you like.

Heh, I would bet you CANNOT do that to my programs, (only 3, I have others online, but these ought to do as examples), here:

====================================
APK REGISTRY CLEANING ENGINE 2002++ SR-7:
====================================

http://www1.techpowerup.com//downloads/389...ooglehappy.html

http://www.techpowerup.com//downloads/389/...ooglehappy.html

====================================

OR, this "Matrix ScreenSaver" I wrote years ago in 1999:

====================================
APK MATRIX SCREENSAVER:
====================================

http://www1.techpowerup.com//downloads/390...creenSaver.html

http://www.techpowerup.com//downloads/390/...creenSaver.html

====================================

OR, to this one I just recently released (for Dr. Who fans worldwide)

====================================
APK DOCTOR WHO SCREENSAVER 2008++:
====================================

http://www.drwhodail...p?showtopic=386

====================================

Why & how does it work? Well - Because every app I have ever written & put out online for "general public consumption/usage" is a "compressed executable" (for security purposes) first of all...

(& when you try to do alterations to them, by using ResHacker (or, tools like it)? You'd first try to do it w/ out uncompressing them... this will fail, & IF you uncompress them?? It WILL FAIL AGAIN - the apps check themselves vs. alteration in a built-in rudimentary self-check/self-test vs. viral infection mainly, so they do not help "spread the disease" so-to-speak)

However - in my apps, You can @ most, ONLY get to the "version strings" (which I allow viewing & alteration of via right-click on a program & using the PROPERTIES popup menu item that appears)... & I COULD STOP THAT as well, but I don't because then it would not show any version info. @ all were I to protect vs. that...

STILL, as far as the interface, & altering ANY of those 3 programs of mine above, by using reshacker?

Well, try it & see...

All 3 programs above (& any others I have put out in freeware since 2002, but not ones I have done prior to that) will reject such changes, & refuse to run (after signalling you of this alteration occurring)... Simply because programs like ResHack alter the size &/or CRC-32 of the executables!

(So do binary infecting viruses as well - the change you will create signals possible corruption, tampering, OR even virus infection of my apps - to which they immediately notify you, & shut themselves down (to help stop virus infections &/or those who alter programs as you are noting a way to do this)).

This technique? It works... against:

  • Virusal infections of programs vs. "std. oldschool" binary infecting viruses (most importantly, helping to help STOP from spreading them)
  • Disassembly/code theft/hacking of my work by others
  • Programmatic corruptions (which happens sometimes, due to filesystem errors even)

Proof?

At last years' "CODING FOR DEFCON" (security oriented competition in coding practices)? This went over pretty well, & here is some 'proof to that effect':

********************************************************************************

APK INTERNAL PROGRAM PROTECTION METHOD (FILESIZE &/or CRC32 CHECKING) FOR BUILT-IN RUDIMENTRY ANTIVIRUS/CORRUPTION/ANTIHACK SELF-PROTECTION FOR APPS (MODDED UP @ "CODE AUDITING FOR DEFCON" POST @ SLASHDOT (famous geek website)):

http://it.slashdot.org/comments.pl?sid=158...mp;cid=13257227

********************************************************************************

Where this "technique" was "modded up" as technically interesting, which I suppose is the equivalent of "star ratings" on most other forums...

(& that occurred @ a forums section where the very famous in this field "hang out" no less, such as John Carmack of IDSoftware no less, as 1 example thereof)

This may sound a bit weird, but, being modded up there is sort of an "honor" imo, because after 15++ yrs. online as a professional coder in this field? I think they truly have the MOST talented folks technically in 1 spot there is online (just my opinion though).

APK

P.S.=> Truth be told? Well, IF EVERY APPLICATION DID THIS (very simple idea too)? We'd have a LOT LESS viruses of the executable/binary infecting type, period... apk

This post has been edited by APK: 09 May 2008 - 14:45

"I'm REESE: Sgt. TechComVN38416, assigned to protect you - YOU'VE BEEN TARGETTED, FOR TERMINATION!"

从 Resource Hacker 到 Heaventools PE Explorer 1.99 R6相关推荐

  1. Resource Hacker+mysql安装会出现错误“应用程序无法启动因为应用程序的并行配置不正确”...

    Resource Hacker:免费软件,用于查看,修改,添加和删除 Win32可执行文件的资源. 1. 查看 Win32 可执行和相关文件的资源 (*.exe, *.dll, *.cpl, *.oc ...

  2. 利用Resource Hacker简单去除WinRar广告-boldiy

    利用Resource Hacker简单去除WinRar广告-boldiy boldiy关注IP属地: 江苏 2022.04.26 18:43:27字数 114阅读 315 下载 Resource Ha ...

  3. Resource Hacker

    http://www.angusj.com/resourcehacker/#download 转载于:https://www.cnblogs.com/olajennings/p/9787889.htm ...

  4. Wannacry病毒分析

    1.样本概况 1.1 样本信息 病毒名称:Wannacry 所属家族:WannaCrypt MD5值:DB349B97C37D22F5EA1D1841E3C89EB4 SHA1值:E889544AFF ...

  5. 【reverse】buu-CrackRTF——提取PE中的resource、rtf的固定文件头

    文章目录 依赖 正文 第一关 代码 第二关 提取exe中的资源 RTF的固定文件头 总结 完整代码 参考资料 依赖 IDA7.7 python的pefile库 作者:hans774882968以及ha ...

  6. 【破解利器】PE工具篇(PE编辑,查看等操作)

    来源:http://fcjblog.com/crack-weapon-pe-tools-articles-pe-edit-view-and-other-operations [破解利器]PE工具篇(P ...

  7. [re入门]PE文件小知识

    从PE入手的信息收集,让恶意样本无处可逃 一. PE文件格式的基础知识 1.1 认识PE文件 1.2 整体结构 1.3 基地址 1.4 相对虚拟地址 1.5 文件偏移地址 1.6 结构 1.6.1 D ...

  8. PE格式详细讲解11 - 系统篇11|解密系列

    PE格式详细讲解11 - 系统篇11 让编程改变世界 Change the world by program   今天我们来谈谈资源部分,资源部分可以说是 PE 文件所有结构中,最复杂的一部分,也最让 ...

  9. 小甲鱼PE详解之资源(PE详解11)

    小甲鱼PE详解之资源(PE详解11) 我们知道,Windows 将程序的各种界面定义为资源,包括加速键(Accelerator).位图(Bitmap).光标(Cursor).对话框(Dialog Bo ...

  10. PE文件和COFF文件格式分析——节信息

    在<PE文件和COFF文件格式分析--签名.COFF文件头和可选文件头3>中,我们看到一些区块的信息都有偏移指向.而我们本文讨论的节信息是没有任何偏移指向的,所以它是紧跟在可选文件头后面的 ...

最新文章

  1. SeqStack(Templateclass T)实现
  2. 【USACO06DEC】—牛奶模式Milk Patterns(后缀自动机)
  3. 用kali的Meterpreter控制win10,可以偷看你的电脑的所有数据
  4. (十七)java版spring cloud+spring boot 社交电子商务平台-spring+springmvc+kafka分布式消息中间件集成方案...
  5. 一个SAP开发人员的养蚕流水帐
  6. android win8风格布局,Android仿Win8界面开发
  7. 织梦(安装,模板,基本标签)
  8. 阿里正式进军机器人赛道,首款物流机器人“小蛮驴”来了!
  9. mac上配置rails开发环境
  10. 2021-02-07 USR-WIFI232-B2 串口转WIFI模块
  11. html表单查重,毕业论文的表格会被查重吗?
  12. google 浏览器 常用插件
  13. 程序员应当正确突破英语障碍
  14. Scrapy框架采集微信公众号数据,Python大佬机智操作绕过反爬验证码
  15. 青龙面板-快手极速版(每天3块脚本)
  16. ​stp文件转ply
  17. 推荐免费的文本编辑工具
  18. Axure 交互案例:放大缩小图片
  19. 蓝桥杯真题:三羊献瑞
  20. NTP服务端和客户端的部署——Chrony

热门文章

  1. CC2540蓝牙开发二 OSAL系统
  2. linux下怎么解压tar.gz,linux下怎么解压.tar.gz .tar.bz2命令
  3. java并行计算π_3月14日圆周率日—使用并行计算求圆周率π
  4. dubbo源码解析-spi(四)
  5. macOS Big Sur初体验之自带五笔输入法质变
  6. outlook搜索栏不见了_回忆了一下Foxmail内置的全文搜索那点事,于是有了此文
  7. 如何正确的获得一个view的宽和高
  8. 我的职业规划500字计算机范文,职业生涯规划自我分析(职业生涯规划500字)
  9. 对于三极管饱和状态的一些浅见——与网友的讨论贴
  10. Pytorch 报错 Python int too large to convert to C long