Software for reversing

[Man]

Debuggers and disassemblers:

Ollydbg

with plugins

plugins can be found here:

OpenRCE

OpenRCE: The Open Reverse Code Engineering Community

www.openrce.org

http://www.cracklab.ru/olya/

Turbo Debugger

Quite a good debugger from Borland.

TRW2000

This debugger allows you to examine DOS .com, DOS .exe, DOS applications running in protected mode, 16-bit NE, 32-bit PE programs. It is possible to set several control points. TRW uses many new ideas for tracing programs under Windows 95. After SoftICE, TRW is the best debugger for Windows, but unfortunately not for XP/NT/2k.

IDA Pro

IDA Pro is an interactive disassembler and debugger at the same time. It allows you to convert binary program code into assembler text, which can be used to analyze the program's operation.

BORG

According to the words, it is a pretty good disassembler, the source code in C is included. If you follow the link, you can find everything you need for the final 2nd branch.

PE tuzly:

PEiD

The program allows you to define hundreds of packers, compressors, joiners and hanging protections for PE files (defines more than 450 signatures for PE files). For every reverse engineer and cracker

Process Explorer

You can monitor running processes on your computer using
the TaskManager task manager built into the system. However, it is not possible to see
all processes with its help. The Process Explorer program copes with this task much better and
will allow you to monitor running processes more effectively. Each such
process can be terminated or a certain priority can be set for it using this utility
. The program has a built-in search engine that allows you to search for
a specific process using the loaded *.dll library. The program does not require installation and
is small in size. Developer: http://www.sysinternals.com Mark Russinovich

Process Monitor

An advanced monitoring utility for Windows that
allows you to display active registry entries, processes in real time
. It combines two utilities from Sysinternals, Filemon and Regmon, and
adds a wide range of improvements, including reliable process information
and much more.

Sniffers and analyzers:

tcpdump for Windows

A command-line network sniffer. Allows you to track incoming and outgoing packets. Brief information is displayed about each packet - who sent the packet, to whom, the protocol, some parameters of the packet.

Wireshark

The program is designed to collect and analyze information about incoming/outgoing network traffic. Wireshark supports DNS, FDDI, FTP, HTTP, ICQ, IPV6, IPX, IRC, MAPI, MOUNT, NETBIOS, NFS, NNTP, POP, PPP, TCP, TELNET, X25, etc.