Portable Executable 101 - a windows executable walkthrough

PE101 - corkami - Portable Executable 101 - a windows executable walkthrough - reverse engineering experiments and documentations - Google Project Hosting

On the hunt for malware...

Nice video about malware inspecting/removing using sysinternals tools...


Credits go to : http://channel9.msdn.com/Events/TechEd/NorthAmerica/2012/SIA302

BTProximity

BTProximity : Dave Amenta.com

BTProximity is an application for Windows Vista and Windows 7 that can detect when your bluetooth-enabled phone has come into range, and unlock your computer.  When the device moves out of range, the computer is automatically locked.  This isn’t a fake lock window, the desktop is actually locked the same as if you pressed Win+L.
http://www.daveamenta.com/btproximity/setup.exe

Create Shortcuts using late binding

Simply create a new shortcut using some late binding, instead of having to reference the Windows Scripting Host : IWshRuntimeLibrary

Usage:
Shortcut.Create_Shortcut(PathtoExecutable, PathToShortcutFolder, ShortCutName,ExecutableFolderPath, Description, "", 0, 0)

 
Imports System.Runtime.CompilerServices
Imports Microsoft.VisualBasic.CompilerServices
Public Class Shortcut
    Public Shared Function Create_Shortcut(ByVal Target_Path As String, ByVal Shortcut_Path As String, ByVal Shortcut_Name As String, _
    ByVal Working_Directory As String, ByVal Description As String, ByVal Arguments As String, ByVal Window_Style As Integer, ByVal Icon_Num As Integer) As Boolean
        Try
            Dim objectValue As Object = RuntimeHelpers.GetObjectValue(Interaction.CreateObject("WScript.Shell", ""))
            Dim objectValue2 As Object = RuntimeHelpers.GetObjectValue(NewLateBinding.LateGet(objectValue, Nothing, _
            "CreateShortcut", New Object() {Shortcut_Path & "\" & Shortcut_Name & ".lnk"}, Nothing, Nothing, Nothing))
            NewLateBinding.LateSet(objectValue2, Nothing, "TargetPath", New Object() {Target_Path}, Nothing, Nothing)
            NewLateBinding.LateSet(objectValue2, Nothing, "WorkingDirectory", New Object() {Working_Directory}, Nothing, Nothing)
            NewLateBinding.LateSet(objectValue2, Nothing, "Arguments", New Object() {Arguments}, Nothing, Nothing)
            NewLateBinding.LateSet(objectValue2, Nothing, "WindowStyle", New Object() {Window_Style}, Nothing, Nothing)
            NewLateBinding.LateSet(objectValue2, Nothing, "Description", New Object() {Description}, Nothing, Nothing)
            NewLateBinding.LateSet(objectValue2, Nothing, "IconLocation", New Object() {Target_Path & "," _
            & Conversions.ToString(Icon_Num)}, Nothing, Nothing)
            NewLateBinding.LateCall(objectValue2, Nothing, "Save", New Object() {}, Nothing, Nothing, Nothing, True)
            Return True
        Catch ex As Exception
            Return False
        End Try
    End Function
End Class

A special thanks to Tirthraaj Gobin for comming up with this solution...
http://social.msdn.microsoft.com/Forums/en-US/vbide/thread/126c09a2-6f38-4747-9ddd-55ff977fcba0?prof=required

The Life and Times of Windows XP

Check out this article on the lifetime of windows XP...

http://arstechnica.com/microsoft/news/2011/10/ten-years-of-windows-xp-how-longevity-became-a-curse.ars

Check For 64bit Operating System VB.NET 2.0

    Public Function Is64BitOperatingSystem() As Boolean?
        Dim amount As Integer
        Try
            amount = Runtime.InteropServices.Marshal.SizeOf(IntPtr.Zero)
            If amount = 8 Then : Return True
            Else : Return False
            End If
        Catch ex As Exception
            Return Nothing
        End Try
    End Function 'End Method Is64BitOperatingSystem

Upgrade Internet Explorer 1.0 to 9.0

http://www.winrumors.com/man-upgrades-internet-explorer-1-0-to-9-0-video/

Credits go to Andrew Tait

From the same person who made the video about upgrading from windows 1.0 to 7
another nostalgic video taking us way back into Internet Explorers past.

The video shows the install processes and UI for each version of Internet Explorer.

Andrew also tested the various versions at the Acid test pages.

Upgrade Windows 1.0 to Windows 7

http://www.winrumors.com/man-upgrades-windows-1-0-to-windows-7-via-every-other-windows-versions/

I stumbled upon this video of a guy upgrading windows from the first until the last version…
Talk about backward compatibility !!!

The movie  shows all details about the installation process of each version of the windows UI from windows 1.0 until windows 7.
The only exception is Windows ME, missing as you can only upgrade to ME or 2000 and not both.

The video creator, Andrew Tait, used VMWare to install each version and started by installing MS-DOS 5.0 to prepare for the Windows 1.0 installation.

If you’re a Windows fan and have 10 minutes free then check-out the nostalgic video below,
thanks to The Next Web for spotting this classic.

mRemote : multi-tab remote connections manager

mRemote is a full-featured, multi-tab remote connections manager.

http://www.mremote.org/wiki/

It allows you to store all your remote connections in a simple yet powerful interface.

Currently these protocols are supported:

RDP (Remote Desktop)
VNC (Virtual Network Computing)
ICA (Independent Computing Architecture)
SSH (Secure Shell)
Telnet (TELecommunication NETwork)
HTTP/S (Hypertext Transfer Protocol)
Rlogin (Rlogin)
RAW

mRemote is a multi-tab, multi-protocol remote connections mananger written mainly in VB.NET and some bits in C# 2.0.

External Programs can be used, for example Dameware :

Features

Free and Open Source, released under the GPL
Panels and tabs allow to group certain connections together, dock them to any side of the window or completely undock them and move them to another screen for example
Multiple supported protocols (RDP, VNC, ICA, SSH, Telnet, RAW, Rlogin and HTTP/S)
Easy to organize and maintain list of connections
Inheritance makes it possible to store properties on folder basis and let the underlying connections inherit this info
Support for importing connections from Active Directory
Allows creating nested containers (folders) to categorize connections
"Quick Connect" feature to quickly open a connection without creating an entry
"Quick Search" feature to quickly find a connection while typing
Support for SCP/SFTP (SSH) file transfers
Assign icons to connections to easily identify purpose
Screenshot manager allows to collect multiple screenshots and save them all together or copy them to the clipboard
View remote session info and log off sessions (RDP)
Portable
Auto-Reconnect feature
"Auto-Update" feature
SQL Server support
Show description tooltips when hoovering over connections
System tray icon with connection menu
Fullscreen (Kiosk) mode
Assign global credentials to use when no information is provided on connection basis
Host Up/Down (Ping) feature shows if the selected host answers to a ping

System Requirements

Supported Operating Systems:
Windows XP
Windows Vista

Prerequisites:

Microsoft .NET Framework 2.0
Microsoft Terminal Services Client 6.0
Needed if you use RDP. mstscax.dll and/or msrdp.ocx must be registered.
PuTTY
Needed if you use Telnet, SSH, Rlogin or RAW. Included in all packages.
Citrix ICA Client
Needed if you use ICA. wfica.ocx must be registered.

ATTENTION!
mRemote was only tested under 32bit environments, so 64bit systems are unsupported but may run mRemote just as usual.

Download mRemote (Change Log)
Downloads are provided in four packages, the setup package, binary package, portable package and the source package.

The setup package is the compiled version of mRemote which comes in the form of a NSIS generated setup. (The common/fastest way to get mRemote up and running)

The portable package consists of the same files as the bin package but contains an modified version of the executable which stores and loads all your settings from files in the application's directory. This package can be used to run mRemote from an USB stick an preserve your configuration wherever you go.

The binary package is a zip package and contains the same files as the setup package but has no automated installer.

The source package is a zip package and contains the mRemote source code.

English Release:

Setup Package Download V1.50

Portable Package Download V1.50

Binary Package Download V1.50

Source Package Download V0.50

http://www.mremote.org/wiki/Edit.aspx?Page=Downloads&Section=5

Licensing
mRemote is released under the GPL (GNU General Public License)

Licensing

mRemote is released under the GPL (GNU General Public License)

Retrieve Windows Product Key Function

I found a nice little function to retrieve the Windows Product Key.
Credits go to Digital Thunder : http://www.codeproject.com/KB/vb/SysInfo.aspx

' Usage : GetProductKey("HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\")

' A function that retrieves the product key used to install Windows.

    Public Function GetProductKey(ByVal regKey As String) As String

        ' This function will retreive the digital product ID from the registry 

        ' and decode it into the CD key used to install a Microsoft product.

        ' All that is needed is the registry path to the digital proudct ID block

        ' for the product in question.

        Dim validChars() As String = {"B", "C", "D", "F", "G", "H", "J", "K", "M", _

                                      "P", "Q", "R", "T", "V", "W", "X", "Y", "2", _

                                      "3", "4", "6", "7", "8", "9"}

        Dim CDKey As String = ""

        Dim encodedKey(15) As Byte

        Dim digitalProductID As Byte()

        Dim dpidDataBlock As Object

        ' Get the Digital Product ID data-block from the registry.

        dpidDataBlock = My.Computer.Registry.GetValue(regKey, "DigitalProductId", 0)

        If dpidDataBlock Is Nothing Then Return "Not Available"

        digitalProductID = DirectCast(dpidDataBlock, Byte())

        ' Extract the encoded CD key (15 bytes) from the digital product ID block.

        For n As Integer = 52 To 67

            encodedKey(n - 52) = digitalProductID(n)

        Next

        ' Decode the CD key.

        ' Note: The actual CD key is not stored in the registry; only the positions  

        ' within the validChars() array of the characters that make up the CD key

        ' are stored and encoded.

        For i As Integer = 28 To 0 Step -1

            ' Calculate where the dashes are.

            If ((i + 1) Mod 6) = 0 Then

                CDKey += " - "

            Else

                Dim j As Integer = 0

                For k As Integer = 14 To 0 Step -1

                    Dim Value As Integer = CInt(CLng(j * 2 ^ 8) Or encodedKey(k))

                    encodedKey(k) = CByte(Value \ 24)

                    ' Position within the validChar() array of the character to add to the CD key string.

                    j = Value Mod 24

                Next

                CDKey += validChars(j)

            End If

        Next

        Return StrReverse(CDKey)

    End Function