Skip to content

Commit 516446e

Browse files
extremecoders-reextremecoders-re
committed
Initial Commit
1 parent 82593ee commit 516446e

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

46 files changed

+6154
-1
lines changed

‎README.html

Lines changed: 166 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,166 @@
1+
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
2+
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
3+
<head>
4+
<meta http-equiv="Content-Type" content="text/html; charset=utf-8"/>
5+
<title>Virtual File System Editor</title>
6+
7+
<style type="text/css" media="screen">
8+
html, body { margin: 0; padding: 0;}
9+
body { color: #333; font: 12px Helvetica, Arial, sans-serif; line-height: 18px; }
10+
h2 { color: #333; }
11+
a { color: #337810; }
12+
p { margin: 0 0 18px; }
13+
#container { width: 760px; margin: 0 auto; }
14+
15+
/* Header */
16+
#header { background: #eee; border-bottom: 2px solid #ddd; }
17+
#header h1 { color: #004b6f; margin: 0 0 3px; padding: 24px 18px 0; }
18+
#header p { color: #666; font-size: 11px; font-weight: bold; padding: 0 18px; }
19+
20+
/* Content Style */
21+
#navigation { margin-left: 18px; }
22+
#navigation ul { padding: 0 18px 9px; }
23+
#extra { margin: 0 18px; }
24+
#extra small { font-size: 11px; line-height: 18px; }
25+
#content { border-bottom: 1px solid #ccc; margin: 0 18px; }
26+
#content p, #extra p { padding-right: 18px; }
27+
28+
/* Content Positioning and Size */
29+
#navigation { float: left; width: 350px; }
30+
#content { }
31+
#extra { float: right; width: 350px; } /* Footer */
32+
#footer { background: #333; border-bottom: 2px solid #999; clear: both; }
33+
#footer a { color: #eee; }
34+
#footer p { color: #ccc; margin: 0; padding: 0 18px 10px; }
35+
#footer ul { border-bottom: 1px solid #555; list-style: none; margin: 0 18px 6px; padding: 10px 0 6px; }
36+
#footer li { display: inline; font-size: 11px; font-weight: bold; padding-right: 5px; }
37+
</style>
38+
<!--[if IE]>
39+
<style type="text/css">
40+
#navigation, #content, #extra { margin-top: 20px; }
41+
</style>
42+
<![endif]-->
43+
</head><body>
44+
<div id="container">
45+
<div id="header">
46+
<h1>Virtual File System Editor</h1>
47+
<p class="description">A tool to extract embedded files from application virtualizers</p>
48+
</div>
49+
<div id="wrapper">
50+
<div id="content">
51+
<h2>General Information</h2>
52+
<p align="justify">
53+
Virtual File System Editor is a tool to extract/modify embedded files from packed executables created by application virtualizers.
54+
The main tool is provided in the form of a DLL which needs to be injected into the process you want to extract files from.
55+
Since DLL injection is a separate topic with it's own nuances, I have not provided a DLL injector in this package. You may use any DLL
56+
injector. I recommend the one developed by Ralph Hare available at <a href="http://www.ysgyfarnog.co.uk/utilities/Injector/" target="_blank">ysgyfarnog.co.uk</a> or
57+
RemoteDLL available at <a href="http://securityxploded.com/remotedll.php" target="_blank">SecurityXploded</a>. The latter is particularly
58+
recommended for ASLR aware systems.
59+
</p>
60+
</div>
61+
62+
<div id="content">
63+
<h2>Program Usage</h2>
64+
65+
<p align="justify"><b>Access Test</b> : Use this to check if the selected file is readable by the virtual application. Normally both access tests
66+
would pass. If the tests fail, it indicates that packer did not correctly hook the APIs. In such cases you need to find the real VA of the
67+
hooked APIs and enter it in the options dialog.
68+
69+
<p align="justify"><b>Run</b> : Use this to run another application in the context of this process. For example, this can be used to run <i>regedit.exe</i>
70+
to work with embedded registry keys. This feature has been modelled on the basis of Windows Run dialog, and will accept URLS, file paths etc.
71+
Note that if the application does not virtualize child processes it will be run of outside the virtualization container.
72+
73+
<p align="justify"><b>Extract</b> : Use this to extract any files from the virtual file system. You need to ensure that the output
74+
folder is outside the virtual file system or otherwise the files will be created within it (if the filesystem is writable of course). This mode uses
75+
<i>SHFILEOPERATION</i> function to copy selected files/directories.
76+
77+
<p align="justify"><b>Extract by name</b> : Use this to extract files by specifying their path. This option is particularly useful for extracting
78+
hidden files, which are not visible in the listing. For example, <a href="http://www.molebox.com/" target="_blank">molebox virtualization solution</a>
79+
provides an option to hide files from directory listing which uses <i>FindFirst</i> API function. In such cases, if you know
80+
the full file path (which you may obtain by debugging the application), you can extract it using this option. Also note that
81+
this method extracts the file using vfsserver process, so you need to run it. Additionally, you can only extract files by this.
82+
83+
<p align="justify"><b>Extract by server</b> : Use this to leverage the extraction of files by using a separate process(vfsserver.exe) which is run outside
84+
the virtualization container. You can use this
85+
extraction mode, if file creation is not possible within the virtualized application. You can only extract files by this method.
86+
87+
<p align="justify"><b>Add</b> : You can add/copy files to the virtual file system using this method. Note that the virtual file system should be
88+
writable for this to succeed. You can only add files by this method.
89+
90+
<p align="justify"><b>Delete</b> : Delete files from the virtual file system. As usual the file system should not be read-only.
91+
Also make sure that selected files are a part of the virtual file system, or otherwise real files on disk which are outside the virtualization container
92+
will be deleted. You can delete both files as well as directories by this method.
93+
94+
<p align="justify"><b>Options</b> : Here you can specifiy the virtual addresses for the APIs used for extraction. You need to provide the VA of
95+
four API's namely <i>CreateFileA</i>, <i>GetFileSize</i>, <i>ReadFile</i>, &amp; <i>CloseHandle</i>. Normally, you do not need to use this,
96+
but for very old packers such as old versions of molebox this is needed. This is because the software incorrectly hooks the IAT, as a result the newly injected dll
97+
does not use the hooked APIs. In such cases, you need to debug the application to find the VA of the said hooked APIs and then provide the values here.
98+
Also note that the provided values are only used in extract by name &amp; server modes.
99+
</div>
100+
<div id="content">
101+
<h2>Tests</h2>
102+
<p>
103+
Virtual File System Editor was tested with the following packers on Windows XP SP3.
104+
<ul type="square">
105+
<li><a href="http://www.boxedapp.com/" target="_blank">BoxedApp Packer 3.2.3.8</a> </li>
106+
<li><a href="http://www.cameyo.com/" target="_blank">Cameyo 2.0.8.32</a></li>
107+
<li><a href="http://www.enigmaprotector.com/en/about.html" target="_blank">Enigma Protector 4.20.20140508</a></li>
108+
<li><a href="http://www.enigmaprotector.com/en/aboutvb.html" target="_blank">Enigma Virtual Box 7.10.20131218</a></li>
109+
<li><a href="http://www.evalaze.de/" target="_blank">Evalaze Commercial Edition 2.2.1.1</a></li>
110+
<li><a href="http://www.molebox.com/" target="_blank">Molebox Virtualization Solution 5.4.6.2</a></li>
111+
<li><a href="http://www.smartpacker.nl/" target="_blank">Smart Packer Pro 1.93</a></li>
112+
<li><a href="https://spoon.net/studio" target="_blank">Spoon Virtual Application Studio 11.4.176</a></li>
113+
<li><a href="http://www.vmware.com/products/thinapp" target="_blank">VMware ThinApp Enterprise 5.0.0.1391583</a></li>
114+
</ul>
115+
</div>
116+
<div id="content">
117+
<h2>Tips, Tricks &amp; Limitations</h2>
118+
119+
<p align="justify">
120+
Molebox allows to hide specific or all files from directory structure listing.
121+
This can be controlled by the "Hide all files" option or passing specific flags in the MXB file. In such a case
122+
<i>FindFirstFile</i> / <i>FindNextFile</i> used for directory listing will not list the hidden files &amp; so they will not be shown in the extractor window.
123+
As a workaround, you can use the extract by name method, but you need to know the full path of the embedded file beforehand. Also the main executable cannot be
124+
unpacked by this tool. For very old versions of Molebox which incorrectly hooks the IAT you also need to specify the VA of the hooked APIs in Options.
125+
126+
127+
<p align="justify">
128+
For enigma virtual box &amp; enigma protector, the main executable will not be unpacked. The best solution in this case is to use
129+
<a href="https://forum.tuts4you.com/topic/35554-static-enigma-virtual-box-unpacker/" target="_blank">Static Enigma Virtual Box Unpacker</a>
130+
by <a href="http://lifeinhex.com/">kao</a> which
131+
not only unpacks the main executable but also embedded registry keys(if any) along with other embedded files.
132+
133+
<p align="justify">
134+
For boxed app packer the main executable may not be unpacked. In such cases open the packed file in a PE editor,
135+
dump <i>.bxpack</i> section and find the main PE within it by searching for MZ signature.
136+
137+
</div>
138+
<div id="content">
139+
<h2>Changelog</h2>
140+
<b>v0.3</b> December 15, 2015
141+
<br>&#x2022; Support for large files via name &amp; server modes
142+
<br>&#x2022; Fixed some bugs
143+
<p><p><b>v0.2</b> August 22, 2015
144+
<br>&#x2022; Added run external program feature
145+
<p><p><b>v0.1</b> August 26, 2014
146+
<br>&#x2022; First Public Release
147+
<p>
148+
</div>
149+
150+
</div>
151+
<div id="content">
152+
<h2>Credits</h2>
153+
Coded in Borland Delphi 7
154+
<p>
155+
Virtual File System Editor uses the following :
156+
<br>&#x2022; <a href="http://www.delphicomponents.net/" target="_blank">Ortus Shell Components</a>
157+
<br>&#x2022; <a href="http://dryicons.com/" target="_blank">Aesthetica Icon Set version 2.0</a>
158+
</div>
159+
<p>
160+
161+
<div id="footer">
162+
<p><p><b>Developed by <a href="mailto:[email protected]">Extreme Coders</a> &#xA9; 2014 - 15. All Rights Reserved.</b></p>
163+
</div>
164+
</div>
165+
</body>
166+
</html>

‎README.md

Lines changed: 75 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,76 @@
1-
# Virtual-File-System-Editor
1+
Virtual File System Editor
2+
==========================
3+
24
A tool to extract embedded files from application virtualizers
5+
6+
General Information
7+
-------------------
8+
9+
Virtual File System Editor is a tool to extract/modify embedded files from packed executables created by application virtualizers. The main tool is provided in the form of a DLL which needs to be injected into the process you want to extract files from. Since DLL injection is a separate topic with it's own nuances, I have not provided a DLL injector in this package. You may use any DLL injector. I recommend the one developed by Ralph Hare available at [ysgyfarnog.co.uk](http://www.ysgyfarnog.co.uk/utilities/Injector/) or RemoteDLL available at [SecurityXploded](http://securityxploded.com/remotedll.php). The latter is particularly recommended for ASLR aware systems.
10+
11+
Program Usage
12+
-------------
13+
14+
**Access Test** : Use this to check if the selected file is readable by the virtual application. Normally both access tests would pass. If the tests fail, it indicates that packer did not correctly hook the APIs. In such cases you need to find the real VA of the hooked APIs and enter it in the options dialog.
15+
16+
**Run** : Use this to run another application in the context of this process. For example, this can be used to run _regedit.exe_ to work with embedded registry keys. This feature has been modelled on the basis of Windows Run dialog, and will accept URLS, file paths etc. Note that if the application does not virtualize child processes it will be run of outside the virtualization container.
17+
18+
**Extract** : Use this to extract any files from the virtual file system. You need to ensure that the output folder is outside the virtual file system or otherwise the files will be created within it (if the filesystem is writable of course). This mode uses _SHFILEOPERATION_ function to copy selected files/directories.
19+
20+
**Extract by name** : Use this to extract files by specifying their path. This option is particularly useful for extracting hidden files, which are not visible in the listing. For example, [molebox virtualization solution](http://www.molebox.com/) provides an option to hide files from directory listing which uses _FindFirst_ API function. In such cases, if you know the full file path (which you may obtain by debugging the application), you can extract it using this option. Also note that this method extracts the file using vfsserver process, so you need to run it. Additionally, you can only extract files by this.
21+
22+
**Extract by server** : Use this to leverage the extraction of files by using a separate process(vfsserver.exe) which is run outside the virtualization container. You can use this extraction mode, if file creation is not possible within the virtualized application. You can only extract files by this method.
23+
24+
**Add** : You can add/copy files to the virtual file system using this method. Note that the virtual file system should be writable for this to succeed. You can only add files by this method.
25+
26+
**Delete** : Delete files from the virtual file system. As usual the file system should not be read-only. Also make sure that selected files are a part of the virtual file system, or otherwise real files on disk which are outside the virtualization container will be deleted. You can delete both files as well as directories by this method.
27+
28+
**Options** : Here you can specifiy the virtual addresses for the APIs used for extraction. You need to provide the VA of four API's namely _CreateFileA_, _GetFileSize_, _ReadFile_, & _CloseHandle_. Normally, you do not need to use this, but for very old packers such as old versions of molebox this is needed. This is because the software incorrectly hooks the IAT, as a result the newly injected dll does not use the hooked APIs. In such cases, you need to debug the application to find the VA of the said hooked APIs and then provide the values here. Also note that the provided values are only used in extract by name & server modes.
29+
30+
Tests
31+
-----
32+
33+
Virtual File System Editor was tested with the following packers on Windows XP SP3.
34+
35+
* [BoxedApp Packer 3.2.3.8](http://www.boxedapp.com/)
36+
* [Cameyo 2.0.8.32](http://www.cameyo.com/)
37+
* [Enigma Protector 4.20.20140508](http://www.enigmaprotector.com/en/about.html)
38+
* [Enigma Virtual Box 7.10.20131218](http://www.enigmaprotector.com/en/aboutvb.html)
39+
* [Evalaze Commercial Edition 2.2.1.1](http://www.evalaze.de/)
40+
* [Molebox Virtualization Solution 5.4.6.2](http://www.molebox.com/)
41+
* [Smart Packer Pro 1.93](http://www.smartpacker.nl/)
42+
* [Spoon Virtual Application Studio 11.4.176](https://spoon.net/studio)
43+
* [VMware ThinApp Enterprise 5.0.0.1391583](http://www.vmware.com/products/thinapp)
44+
45+
Tips, Tricks & Limitations
46+
--------------------------
47+
48+
Molebox allows to hide specific or all files from directory structure listing. This can be controlled by the "Hide all files" option or passing specific flags in the MXB file. In such a case _FindFirstFile_ / _FindNextFile_ used for directory listing will not list the hidden files & so they will not be shown in the extractor window. As a workaround, you can use the extract by name method, but you need to know the full path of the embedded file beforehand. Also the main executable cannot be unpacked by this tool. For very old versions of Molebox which incorrectly hooks the IAT you also need to specify the VA of the hooked APIs in Options.
49+
50+
For enigma virtual box & enigma protector, the main executable will not be unpacked. The best solution in this case is to use [Static Enigma Virtual Box Unpacker](https://forum.tuts4you.com/topic/35554-static-enigma-virtual-box-unpacker/) by [kao](http://lifeinhex.com/) which not only unpacks the main executable but also embedded registry keys(if any) along with other embedded files.
51+
52+
For boxed app packer the main executable may not be unpacked. In such cases open the packed file in a PE editor, dump _.bxpack_ section and find the main PE within it by searching for MZ signature.
53+
54+
Changelog
55+
---------
56+
57+
**v0.3** December 15, 2015
58+
• Support for large files via name & server modes
59+
• Fixed some bugs
60+
61+
**v0.2** August 22, 2015
62+
• Added run external program feature
63+
64+
**v0.1** August 26, 2014
65+
• First Public Release
66+
67+
Credits
68+
-------
69+
70+
Coded in Borland Delphi 7
71+
72+
Virtual File System Editor uses the following :
73+
• [Ortus Shell Components](http://www.delphicomponents.net/)
74+
• [Aesthetica Icon Set version 2.0](http://dryicons.com/)
75+
76+
**Developed by [Extreme Coders](mailto:[email protected]) © 2014 - 15. All Rights Reserved.**

‎vfseditor/aboutdialogbox.dcu

3.47 KB
Binary file not shown.

‎vfseditor/aboutdialogbox.ddp

51 Bytes
Binary file not shown.

‎vfseditor/aboutdialogbox.dfm

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
object Form2: TForm2
2+
Left = 518
3+
Top = 264
4+
BorderIcons = [biSystemMenu]
5+
BorderStyle = bsToolWindow
6+
Caption = 'About'
7+
ClientHeight = 209
8+
ClientWidth = 385
9+
Color = clBtnFace
10+
Font.Charset = DEFAULT_CHARSET
11+
Font.Color = clWindowText
12+
Font.Height = -11
13+
Font.Name = 'Tahoma'
14+
Font.Style = []
15+
FormStyle = fsStayOnTop
16+
OldCreateOrder = False
17+
Position = poOwnerFormCenter
18+
PixelsPerInch = 96
19+
TextHeight = 13
20+
object txt1: TStaticText
21+
Left = 50
22+
Top = 11
23+
Width = 285
24+
Height = 29
25+
Caption = 'Virtual File System Editor v0.3'
26+
Font.Charset = DEFAULT_CHARSET
27+
Font.Color = clWindowText
28+
Font.Height = -21
29+
Font.Name = 'Tahoma'
30+
Font.Style = []
31+
ParentFont = False
32+
TabOrder = 0
33+
end
34+
object txt2: TStaticText
35+
Left = 71
36+
Top = 42
37+
Width = 243
38+
Height = 18
39+
Caption = 'Developed by Extreme Coders '#169' 2014 - 15'
40+
Font.Charset = DEFAULT_CHARSET
41+
Font.Color = clWindowText
42+
Font.Height = -12
43+
Font.Name = 'Tahoma'
44+
Font.Style = []
45+
ParentFont = False
46+
TabOrder = 1
47+
end
48+
object mmo1: TMemo
49+
Left = 9
50+
Top = 88
51+
Width = 368
52+
Height = 112
53+
BiDiMode = bdLeftToRight
54+
Font.Charset = DEFAULT_CHARSET
55+
Font.Color = clWindowText
56+
Font.Height = -11
57+
Font.Name = 'Tahoma'
58+
Font.Style = [fsBold]
59+
Lines.Strings = (
60+
'Coded in Borland Delphi 7'
61+
''
62+
'Virtual File System Editor uses the following :'
63+
'> Ortus Shell Components :: http://www.delphicomponents.net/'
64+
'> Aesthetica Icon Set, version 2.0 :: http://dryicons.com/')
65+
ParentBiDiMode = False
66+
ParentFont = False
67+
ReadOnly = True
68+
TabOrder = 2
69+
WordWrap = False
70+
end
71+
object txt3: TStaticText
72+
Left = 94
73+
Top = 62
74+
Width = 198
75+
Height = 18
76+
Caption = 'email: [email protected]'
77+
Font.Charset = DEFAULT_CHARSET
78+
Font.Color = clWindowText
79+
Font.Height = -12
80+
Font.Name = 'Tahoma'
81+
Font.Style = []
82+
ParentFont = False
83+
TabOrder = 3
84+
end
85+
end

‎vfseditor/aboutdialogbox.pas

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
unit aboutdialogbox;
2+
3+
interface
4+
5+
uses
6+
Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,
7+
Dialogs, StdCtrls;
8+
9+
type
10+
TForm2 = class(TForm)
11+
txt1: TStaticText;
12+
txt2: TStaticText;
13+
mmo1: TMemo;
14+
txt3: TStaticText;
15+
private
16+
{ Private declarations }
17+
public
18+
{ Public declarations }
19+
end;
20+
21+
var
22+
Form2: TForm2;
23+
24+
implementation
25+
26+
{$R *.dfm}
27+
28+
end.

‎vfseditor/explorer.dcu

14.9 KB
Binary file not shown.

‎vfseditor/explorer.ddp

51 Bytes
Binary file not shown.

0 commit comments

Comments
 (0)