example3.txt

一个小编辑器

Victim:

   PE Explorer is the versatile troubleshooting tool for Delphi, C++
   and VB developers that comes equipped with a Visual Resource
   Editor, Quick Function Syntax Lookup, Dependency Scanner, Section
   Editor and Disassembler for win32 EXE and DLL files.

   A PE file ("portable executable") is the native format of
   executable binaries (DLLs, drivers and programs) for the
   Microsoft Windows 9x/NT/2000/XP 32-bit operating systems.

   With PE Explorer you can view, edit and repair the internal
   structures of PE files with the click of a button. PE Explorer
   makes it easy to analyze source code, correct checksums, repair
   damaged resources or modify the internal arrangements of PE
   files. It works with PE formats such as EXE, DLL, SYS, BPL, DPL,
   CPL, OCX, SCR and other win32 executables.

   PE Explorer offers one of the most convenient and easy-to-use
   resource editors available for Windows. Visual editing features
   let you quickly modify executable file resources from within the
   file without having to write any scripts. Dialog boxes, menus,
   string tables, icons, bitmaps and more are right at your
   fingertips.


Url:  http://mirror1.heaventools.com/pexplorer/pexsetup.zip
size: 2317263


Quick scan for possible use of Crypto Algorithms:

> cc.com pexplorer.exe > log.txt

##      Offset     Value      Method
-----   --------   --------   --------
    1   0019410C   77073096   CRC32 Table
    2   00194110   EE0E612C   CRC32 Table
    3   00194114   990951BA   CRC32 Table
    4   00194118   076DC419   CRC32 Table

    5   0008C2AA   EDB88320   CRC32 Polynomial
    6   00194308   EDB88320   CRC32 Polynomial

    7   00168359   3617E418   HEAVENTOOLS by www.heaventools.com
    8   00168360   A935FC2E   HEAVENTOOLS by www.heaventools.com
    9   00168368   57D872B9   HEAVENTOOLS by www.heaventools.com
   10   00168370   493DB437   HEAVENTOOLS by www.heaventools.com
   11   00168519   3617E418   HEAVENTOOLS by www.heaventools.com
   12   0016862F   3617E418   HEAVENTOOLS by www.heaventools.com
   13   0016866B   3617E418   HEAVENTOOLS by www.heaventools.com
   14   00168672   A935FC2E   HEAVENTOOLS by www.heaventools.com
   15   0016867A   57D872B9   HEAVENTOOLS by www.heaventools.com
   16   00168682   493DB437   HEAVENTOOLS by www.heaventools.com
   17   001686CA   3617E418   HEAVENTOOLS by www.heaventools.com
   18   001686D1   A935FC2E   HEAVENTOOLS by www.heaventools.com
   19   001686D9   57D872B9   HEAVENTOOLS by www.heaventools.com
   20   001686E1   493DB437   HEAVENTOOLS by www.heaventools.com
   21   00168817   493DB437   HEAVENTOOLS by www.heaventools.com

   22   0005FC66   B7E15163   RC5, RC6 (Magics P, Q)
   23   0005FC90   9E3779B9   RC5, RC6 (Magics P, Q)

   24   00001F3A   08088405   PKZip/Borland Pseudo-Random Generator
   25   0016D10C   08088405   PKZip/Borland Pseudo-Random Generator