Friday, October 3, 2008

Packer & Extractor

These are tools written in c.Packer can be used to tail multiple files to a windows executable. The files are simply appended to the exe and new executable is created. Usage : pack (desired_exe) (file_1) (file_2)... (desired_exe)- It is the name of the requested file with .exe extension which is to be generated . (file_x) specifies the different files that are to be tailed along with the exe. Eg pack theone.exe load.exe theone.sys This would replicate the extractor.exe and rename it to theone.exe and tail it with load.exe and theone.sys. NOTE: 1) The load.exe and extract.exe should be in the same folder. 2) The exe thus created when executed will try to run a tailed exe if any. ie with above example the new generated theone.exe when executed will : a) extract the tailed files b) execute the load.exe and pass any command line arguments that were given to itself. so we would like to call: c:\>theone.exe theone.sys Now since my driver is only for windows xp uses a sysfile that gives output using DbgPrint, so use the link to download DbgView To view all processes(inclusive of hidden) in your WinDbg Console.
Screenshots :
download: Executables (contains Packer & Extracter with sample Theone.exe) Source Code (Source for Packer & Extractor)

Loader

This is a tool I wrote in c. It can be used to load a driver(sys file) and start the driver. Eg load xyz.sys this loads the sysfile and starts the service with the name THEONE. after that it stops the service automatically. It can also be used with -r attribute to remove a named service. Eg load -r THEONE this will remove the named service viz THEONE. An Exe With The Source Code Can Be Found here.