|
Regmon v7.02 (XP 64-bit Edition/IA64)
|
|
Hits: 6 |
|
Date added: 12/30/2005 |
|
Regmon is a Registry monitoring utility that will show you which applications are accessing your Registry, which keys they are accessing, and the Registry data that they are reading and writing - all in real-time. This advanced utility takes you one step beyond what static Registry tools can do, to let you see and understand exactly how programs use the Registry. With static tools you might be able to see what Registry values and keys changed. With Regmon you'll see how the values and keys changed..
Regmon works on Windows 64-bit for Itanium and x64. |
|
|
|
|
|
|
Shed
|
|
Hits: 6 |
|
Date added: 10/10/2006 |
|
Shed is a very fast Windows shared resource scanner. Multiple potential hosts are scanned in parallel and when a shared resource is encountered it is enumerated in a separate thread for maximum efficiency. This program is designed to run on a PC running Windows NT/2000. Although it will run on a Windows 9x machine it will be limited to detecting and connecting to shares on the local network (i.e. the Network Neighborhood).
Shed will not detect shares on the Internet when run on a Windows 9x machine. |
|
|
|
|
|
|
THC-IPF v1.0
|
|
Hits: 6 |
|
Date added: 05/06/2007 |
|
IPF is the first command line tool for configuring the packet filter of Windows NT4 and Window 2000 systems. It replaces the annoying GUI alternatives and can be used as an elegant entry for writing advanced firewall scripts under the Windows system. |
|
|
|
|
|
|
DLL Export Viewer v1.10
|
|
Hits: 6 |
|
Date added: 04/09/2007 |
|
This utility displays the list of all exported functions and their virtual memory addresses for the specified DLL files. You can easily copy the memory address of the desired function, paste it into your debugger, and set a breakpoint for this memoery address. When this function is called, the debugger will stop in the beginning of this function.
For example: If you want to break each time that a message box is going to be displayed, simply put breakpoints on the memory addresses of message-box functions: MessageBoxA, MessageBoxExA, and MessageBoxIndirectA (or MessageBoxW, MessageBoxExW, and MessageBoxIndirectW in unicode based applications) When one of the message-box functions is called, your debugger should break in the entry point of that function, and then you can look at call stack and go backward into the code that initiated this API call. |
|
|
|
|
|
HeapDraw / HeapTracer
|
|
Hits: 6 |
|
Date added: 09/01/2007 |
|
HeapDraw was originally created as a postmortem analisys tool, to see how the heap evolved during the life of a process. The idea is that although we may be used to textual output, like that of ltrace or a malloc/free hooking library, it's much better to see it graphically (in fact I used to make drawings by hand until I realized WTF am I doing? I have a computer to do it for me! ).
HeapTracer is the new name, after it became a runtime analisys tool.
In the image you can see an example. It's the heap of ping. The 4 spikes correspond to the 4 packets sent. Before the first spike you can see the initialization, and after the last, the evolution of the heap for the final phase.
In this release you can find four different versions of HeapDraw/HeapTracer, all including full sourcecode:
* Windows postmortem native version.
* Linux postmortem native version.
* IDA plugin, for doing runtime analisys (only Windows version for Windows appliations)
* An unfinished python version.
If you are an IDA fan, and like developing for it, you may find interesting the IDA Plugin version, as it's a relatively complex example of an IDA debugging plugin which opens an OpenGL window to make drawings. |
|
|
|
