-
Notifications
You must be signed in to change notification settings - Fork 14
/
README.html
166 lines (146 loc) · 9.81 KB
/
README.html
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8"/>
<title>Virtual File System Editor</title>
<style type="text/css" media="screen">
html, body { margin: 0; padding: 0;}
body { color: #333; font: 12px Helvetica, Arial, sans-serif; line-height: 18px; }
h2 { color: #333; }
a { color: #337810; }
p { margin: 0 0 18px; }
#container { width: 760px; margin: 0 auto; }
/* Header */
#header { background: #eee; border-bottom: 2px solid #ddd; }
#header h1 { color: #004b6f; margin: 0 0 3px; padding: 24px 18px 0; }
#header p { color: #666; font-size: 11px; font-weight: bold; padding: 0 18px; }
/* Content Style */
#navigation { margin-left: 18px; }
#navigation ul { padding: 0 18px 9px; }
#extra { margin: 0 18px; }
#extra small { font-size: 11px; line-height: 18px; }
#content { border-bottom: 1px solid #ccc; margin: 0 18px; }
#content p, #extra p { padding-right: 18px; }
/* Content Positioning and Size */
#navigation { float: left; width: 350px; }
#content { }
#extra { float: right; width: 350px; } /* Footer */
#footer { background: #333; border-bottom: 2px solid #999; clear: both; }
#footer a { color: #eee; }
#footer p { color: #ccc; margin: 0; padding: 0 18px 10px; }
#footer ul { border-bottom: 1px solid #555; list-style: none; margin: 0 18px 6px; padding: 10px 0 6px; }
#footer li { display: inline; font-size: 11px; font-weight: bold; padding-right: 5px; }
</style>
<!--[if IE]>
<style type="text/css">
#navigation, #content, #extra { margin-top: 20px; }
</style>
<![endif]-->
</head><body>
<div id="container">
<div id="header">
<h1>Virtual File System Editor</h1>
<p class="description">A tool to extract embedded files from application virtualizers</p>
</div>
<div id="wrapper">
<div id="content">
<h2>General Information</h2>
<p align="justify">
Virtual File System Editor is a tool to extract/modify embedded files from packed executables created by application virtualizers.
The main tool is provided in the form of a DLL which needs to be injected into the process you want to extract files from.
Since DLL injection is a separate topic with it's own nuances, I have not provided a DLL injector in this package. You may use any DLL
injector. I recommend the one developed by Ralph Hare available at <a href="http://www.ysgyfarnog.co.uk/utilities/Injector/" target="_blank">ysgyfarnog.co.uk</a> or
RemoteDLL available at <a href="http://securityxploded.com/remotedll.php" target="_blank">SecurityXploded</a>. The latter is particularly
recommended for ASLR aware systems.
</p>
</div>
<div id="content">
<h2>Program Usage</h2>
<p align="justify"><b>Access Test</b> : Use this to check if the selected file is readable by the virtual application. Normally both access tests
would pass. If the tests fail, it indicates that packer did not correctly hook the APIs. In such cases you need to find the real VA of the
hooked APIs and enter it in the options dialog.
<p align="justify"><b>Run</b> : Use this to run another application in the context of this process. For example, this can be used to run <i>regedit.exe</i>
to work with embedded registry keys. This feature has been modelled on the basis of Windows Run dialog, and will accept URLS, file paths etc.
Note that if the application does not virtualize child processes it will be run of outside the virtualization container.
<p align="justify"><b>Extract</b> : Use this to extract any files from the virtual file system. You need to ensure that the output
folder is outside the virtual file system or otherwise the files will be created within it (if the filesystem is writable of course). This mode uses
<i>SHFILEOPERATION</i> function to copy selected files/directories.
<p align="justify"><b>Extract by name</b> : Use this to extract files by specifying their path. This option is particularly useful for extracting
hidden files, which are not visible in the listing. For example, <a href="http://www.molebox.com/" target="_blank">molebox virtualization solution</a>
provides an option to hide files from directory listing which uses <i>FindFirst</i> API function. In such cases, if you know
the full file path (which you may obtain by debugging the application), you can extract it using this option. Also note that
this method extracts the file using vfsserver process, so you need to run it. Additionally, you can only extract files by this.
<p align="justify"><b>Extract by server</b> : Use this to leverage the extraction of files by using a separate process(vfsserver.exe) which is run outside
the virtualization container. You can use this
extraction mode, if file creation is not possible within the virtualized application. You can only extract files by this method.
<p align="justify"><b>Add</b> : You can add/copy files to the virtual file system using this method. Note that the virtual file system should be
writable for this to succeed. You can only add files by this method.
<p align="justify"><b>Delete</b> : Delete files from the virtual file system. As usual the file system should not be read-only.
Also make sure that selected files are a part of the virtual file system, or otherwise real files on disk which are outside the virtualization container
will be deleted. You can delete both files as well as directories by this method.
<p align="justify"><b>Options</b> : Here you can specifiy the virtual addresses for the APIs used for extraction. You need to provide the VA of
four API's namely <i>CreateFileA</i>, <i>GetFileSize</i>, <i>ReadFile</i>, & <i>CloseHandle</i>. Normally, you do not need to use this,
but for very old packers such as old versions of molebox this is needed. This is because the software incorrectly hooks the IAT, as a result the newly injected dll
does not use the hooked APIs. In such cases, you need to debug the application to find the VA of the said hooked APIs and then provide the values here.
Also note that the provided values are only used in extract by name & server modes.
</div>
<div id="content">
<h2>Tests</h2>
<p>
Virtual File System Editor was tested with the following packers on Windows XP SP3.
<ul type="square">
<li><a href="http://www.boxedapp.com/" target="_blank">BoxedApp Packer 3.2.3.8</a> </li>
<li><a href="http://www.cameyo.com/" target="_blank">Cameyo 2.0.8.32</a></li>
<li><a href="http://www.enigmaprotector.com/en/about.html" target="_blank">Enigma Protector 4.20.20140508</a></li>
<li><a href="http://www.enigmaprotector.com/en/aboutvb.html" target="_blank">Enigma Virtual Box 7.10.20131218</a></li>
<li><a href="http://www.evalaze.de/" target="_blank">Evalaze Commercial Edition 2.2.1.1</a></li>
<li><a href="http://www.molebox.com/" target="_blank">Molebox Virtualization Solution 5.4.6.2</a></li>
<li><a href="http://www.smartpacker.nl/" target="_blank">Smart Packer Pro 1.93</a></li>
<li><a href="https://spoon.net/studio" target="_blank">Spoon Virtual Application Studio 11.4.176</a></li>
<li><a href="http://www.vmware.com/products/thinapp" target="_blank">VMware ThinApp Enterprise 5.0.0.1391583</a></li>
</ul>
</div>
<div id="content">
<h2>Tips, Tricks & Limitations</h2>
<p align="justify">
Molebox allows to hide specific or all files from directory structure listing.
This can be controlled by the "Hide all files" option or passing specific flags in the MXB file. In such a case
<i>FindFirstFile</i> / <i>FindNextFile</i> used for directory listing will not list the hidden files & so they will not be shown in the extractor window.
As a workaround, you can use the extract by name method, but you need to know the full path of the embedded file beforehand. Also the main executable cannot be
unpacked by this tool. For very old versions of Molebox which incorrectly hooks the IAT you also need to specify the VA of the hooked APIs in Options.
<p align="justify">
For enigma virtual box & enigma protector, the main executable will not be unpacked. The best solution in this case is to use
<a href="https://forum.tuts4you.com/topic/35554-static-enigma-virtual-box-unpacker/" target="_blank">Static Enigma Virtual Box Unpacker</a>
by <a href="http://lifeinhex.com/">kao</a> which
not only unpacks the main executable but also embedded registry keys(if any) along with other embedded files.
<p align="justify">
For boxed app packer the main executable may not be unpacked. In such cases open the packed file in a PE editor,
dump <i>.bxpack</i> section and find the main PE within it by searching for MZ signature.
</div>
<div id="content">
<h2>Changelog</h2>
<b>v0.3</b> December 15, 2015
<br>• Support for large files via name & server modes
<br>• Fixed some bugs
<p><p><b>v0.2</b> August 22, 2015
<br>• Added run external program feature
<p><p><b>v0.1</b> August 26, 2014
<br>• First Public Release
<p>
</div>
</div>
<div id="content">
<h2>Credits</h2>
Coded in Borland Delphi 7
<p>
Virtual File System Editor uses the following :
<br>• <a href="http://www.delphicomponents.net/" target="_blank">Ortus Shell Components</a>
<br>• <a href="http://dryicons.com/" target="_blank">Aesthetica Icon Set version 2.0</a>
</div>
<p>
<div id="footer">
<p><p><b>Developed by <a href="mailto:[email protected]">Extreme Coders</a> © 2014 - 15. All Rights Reserved.</b></p>
</div>
</div>
</body>
</html>