Item :

Download link

Date

Please do not distribute on Forums

Exeinfo Pe v. 0.0.9.0 ntest

( with NAG Screen )

1214 / 181 signatures

( Ext_detector  ver.0.7.5.4   )

userdb.txt : 4462

Please do not distribute on Forums

Download link

Added on this version only :

Not tested version

for Windows XP - added x86 7z v22.09 ( ZS/LIZ mode not supported only on Windows 10 )
*fixed resources for XP


Inno unpacker update v.1.77

added "x" on main GUI for unpacking .zip files

Console modefor zip files :
Zip unpacking ( .zip archives )
exeinfope.exe FileName /un7zip - unpack .zip archive )
for many files ( mask files ) :
exeinfope.exe FileName* /un7zip - unpack .zip files

updated : GEMPlayer v1.0 protected data - ThunderSoft DRM Protection / Gilisoft Free DRM Protection

fixed updated 1136.DotFix NiceProtect v6.9 - 7x demo x86

.NET added to signatures ( Meta nstd struct ) . 080 , 1129
" - [ First Meta Data stream as Confuser/Xfuscator ] "



-  added extra exe for Windows XP 

29.03.2025

Please do not distribute on Forums

Exeinfo Pe v. 0.0.9.0 Alpha2

( with NAG Screen )

1211 / 181 signatures

( Ext_detector  ver.0.7.5.4   )

userdb.txt : 4462

Please do not distribute on Forums

Download link

Added on this version only :


for Windows XP - added x86 7z v22.09 ( ZS/LIZ mode not supported only on Windows 10 )

1211.PYinstaller GCC stub x86/x64


NOT EXE - .png - added DPI info for printing
and much more !


-  added extra exe for Windows XP 

06.02.2025

Please do not distribute on Forums

Exeinfo Pe v. 0.0.8.9 Test

1209 / 181 signatures

( Ext_detector  ver.0.7.5.4   )

userdb.txt : 4462

Please do not distribute on Forums

Download link

many changes and critical ! updates , more version detect

added Config GUI - programm paths

added .7z unpacker if "x" key pressed

.mp4 don't crash if video codek search

and much more !


-  added extra exe for Windows XP 

29.01.2025

Please do not distribute on Forums

Exeinfo Pe v. 0.0.8.8 Alpha

1206 / 181 signatures

( Ext_detector  ver.0.7.4.7   )

userdb.txt : 0

Please do not distribute on Forums

many changes and updates


added .NET GUI auto click on .NET 4 / 6 detector
added .PYD x86 v2.x 3.x / x64 v3.x version detector
fixed cpu version detector added
[ generic - CPU : 0x01C4 ARMv7 (or higher) Thumb mode only ] GO Programming Language Compiler
added x86 only : [ plugin : Photoshop plugin ]
fix 5005. x64 Microsoft Visual C++ v14.20 - 2008 [ RT_CODE ] - DLL
added to .pdb - NOT EXE - .IDB Microsoft Developer intermediate
.zlib ripper fixed - Zlib - false Alarm - skipped ( now ripp more files ) - fixed for Android backup : fullbackup.ab
.zlib added ripper for zlib v2 - if Fast scan off option in Config (example : installer LLC SysDev Laboratories )
detect NOT EXE - .zlib v2 files
added dll detector - XerinVM.Runtime v1.0 2024
small fixed XerinFuscator v1.0 - 3.0 , XFUSCATOR 1.0.0.4

and much more !


-  No exe  added for Windows XP 

14.12.2024

Please do not distribute on Forums

Exeinfo Pe v. 0.0.8.7 Beta II

1203 / 178 signatures

( Ext_detector  ver.0.7.3.9   )

userdb.txt : 4460

many changes and updates

fixed : inno unpacker engine , added "x" key for all

* .exe file unpacking on main form

Mulitiscan GUI : added search string PgDn strings and CPU detector

NET GUI : added NET 6.0 / 6.0 core detector

Go language compiler 32/64 added version DETECTOR

Fixed , updated : Rust Compiler v1.82

Detect .lzma nstd Archives included exe file

added to setup/installer detector : [ Microsoft Office Click-to-Run Setup ]

and much more !


-  extra exe added for Windows XP 

09.11.2024

Exeinfo Pe v. 0.0.8.6

1201 / 177 signatures

( Ext_detector  ver.0.7.3.5   )

userdb.txt : 4460

many changes , signatures updated , and few hidden options

NET_GUI changed items visible
added support for 5,6 NET Streams - view streams enabled

.NET Bug fixed

user skin bug fixed


-  extra exe added for Windows XP 

- more
 

02.09.2024

Exeinfo Pe v. 0.0.8.6 Beta - Nag  !!!

1200 / 175 signatures

( Ext_detector  ver.0.7.3.5   )

userdb.txt : 4460

many changes , signatures updated , and few hidden options

fixed : 1199.XerinFuscator v.1.0.0

NET_GUI changed visible
added support for 5,6 NET Streams - view streams enabled

added detector zip sfx : Beijing JJJsafe Technology - unpack problem Xpack mode

added better password detector for .7z files AES and AES*

added to .7z archives ZS compressions detector - not supported with std 7zip Archiver
( Zstd , Liz, LZ5, Brotoli )
 

console mode .7z ZS mode unpacker

-  Windows XP  not supported

15.08.2024

Exeinfo Pe v. 0.0.8.5 

1192 / 173 signatures

( Ext_detector  ver.0.7.2.8   )

userdb.txt : 4457

- many updates and fixes , more inteli warnings on .NET files
- added detector for : Virbox Protector v.3.3.x -3.x.x appsecurity.virbox.com ( Windows & Linux only )

- included version for Windows XP :

exeinfope_Win_XP.exe

- much more and not tested !

06.06.2024

Exeinfo Pe v. 0.0.8.4 

1191 / 173 signatures

( Ext_detector  ver.0.7.2.8   )

userdb.txt : 4457

strong update - .NET inteli infos added

Warning : This version work with Windows XP only after patch !

added to Version info : ISInternalVersion = 27.0.58
update and detect : v9.0 InstallAware Virtualization
951. .NET compiler - unknown structure - strange [ Native EntryPoint - NSTD Struct is OK ]
fix ver.detector up to 90% (for files over 2 MB ) .NET + dotfuscator - PreEmpire Solutions v1.2 - 7.1
fix for 2019 ver.1083.Eazfuscator.NET v2019.x
update to v.2015 8011.*Unknown DLL , A1 00 30 x [ BoxedApp SDK32 - 2021 ]
added 988.SSE Setup 10.7 - xx.x ( 7-Zip sfx
added NOT EXE - .txt UTF-16 (LE) + Hidden .exe PE file at offset 0040
added generic : on 8011.,8010. x64 LLVM compiler : clang version 18.1.2
Sections GUI scan added detector : LLVM compiler Clang ver.18.1.1 (MSC++14)
Disable Warning - if exe Pe Magic=0107 ROM DATA
detect dll files 5144. x64 Microsoft VC++ 14.29 DLL [ CPU : AA64 ARMv8 ]
fixed updated : 472.Autoit v3.3.x.x
fixed : Hamrick Software - VueScan
update 1123.[ Rust Compiler v1.60.x - 1.77.0 ]
update and fixed detector 1031.Advanced BAT to EXE Converter [ v.4.61 ] 2017-2024
fixed 798.Advanced Installer Web/Next [ v.21.5.x ] 2003-2024 - www.caphyon.com
update MS linker to 14.39 x86 x64
Compiler Detector fixed : x86 and x64 MingWin32 Free Pascal / MinGW-w64
fixed NOT EXE - .ZIP archive - [ Mode Unknown : 5Fh ] to : NOT EXE - .ZIP archive - [ XZ Compression ]
added .NET x86 if sign 080; x64 with zero EP Warning : NET Streams: 6 ...
fixed version : 1038.MINGW32 Cygwin family [exe] msys-2.0 GCC: (GNU) [v0.2.0]
added Visual C# / Basic.NET - DLL [ VMProtect SDK32 .NET - 2023 ]


- much more and not tested !

18.04.2024

Exeinfo Pe v. 0.0.8.4 

1188 / 171 signatures

( Ext_detector  ver.0.7.2.8   )

userdb.txt : 4457

Warning : This version work with Windows XP only after patch !

Last news - only in this version :

fixed : Obsidium v1.5 - 1.8 - [ v.1.8.2.1-2 - option : Def. MZ Head ]
added : detector for DLL 32/64 bit : [ plugin for : AutoPlay Media Studio ]
added detector for DLL 64bit : [ .PYD Python C Extensions library ]
fixed : Embarcadero Delphi version show x64
update to v1.77 : 1123.Rust Compiler v1.60.x - www.rust-lang.org
added : console mode : unpack all exe files and Inno script from InnoSetup installer : exeinfope.exe file_name /unp-inno-exe
fixed : if Themida protector , result : Themida - Winlicense , if Winlicense result : Winlicense - Themida
added : Skater v24.2.0.51 2024
Added : Delphi version resolver : XE7,Sydney,Rio,Alexandria,Yukon,Tokyo,Berlin
added : DLL [ VMProtect SDK32 .NET - 2023 ]
fixed : version :1038.MINGW32 Cygwin family [exe] msys-2.0 GCC: (GNU) [v10.2.0]
added : .NET 32 if sign. 080 Warning : NET Streams: 6 ...
added : detector 7z Bandizip sfx
fixed : .zip added 5F ( Bandizip ) NOT EXE - .ZIP archive - [ Mode Unknown : 5Fh ] to : NOT EXE - .ZIP archive - [ XZ Compression ]
fixed : Compiler Detector x86 and x64 MingWin32 Free Pascal / MinGW-w64
update : MSC++ linker to 14.39
fix for 599.Advanced Installer [ v21.5.x ] - 2003-2024
update and fixed detector 1031.Advanced BAT to EXE Converter [ v.4.61 ] 2017-2024
fixed/updated : 472.Autoit v3.3.0.0 x64 - Autoit v3.3.6.1
fixed : 599.Advanced Installer [ v.15.5.x ] - 2003-2024
fixed : and debug info added 5144. x64 Microsoft VC++ 14.39 exe [ CPU : AA64 ARMv8 ]
added : 068.x64 Sfx 7z GUI 22.01 ZS v1.5.5 R3 GUI - 2023 Tino Reichardt
Disable Warning - if exe Pe Magic=0107 ROM DATA
Sections GUI scan added detector : LLVM compiler Clang ver.18.1.1 (MSC++14)
added : partial detector generic on 8011.,8010.sign x64 LLVM compiler : clang version 18.1.2
added : ( exe od offset 0040 , Busy21.exe v21.0 https://busy.in ) NOT EXE - .txt UTF-16 (LE) + Hidden .exe PE file at offset 0040
added : 724. NOT EXE - (.) Win PE 32/64 File ( .exe Crypted with : ADD 05 )
- .NET files scan changed , many .NET false detection fixed
- added .NET ConfuserEx structure [ mutation / mod -> Packed Generic Unknown ]

- much more and not tested !!!

- Buffer for exe file : 336 MB

01.04.2024

Exeinfo Pe v. 0.0.8.4 Alpha

1187 / 169 signatures

( Ext_detector  ver.0.7.2.3   )

userdb.txt : 4455

- .NET files scan changed , many .NET false detection fixed
- Delphi version resolver Added :
Delphi v12 Yukon,
Delphi v11.0 Alexandria,
Delphi v10.4 Rio,
Delphi v10.4 Sydney,
Delphi XE7 - v10.4,
Delphi v10.1 Berlin
- update Skater added v24.2.0.51 2024 - Skater_NET_Obfuscator
- added console mode :
unpack all *.exe files and script file from : InnoSetup installer
( work only if you don't have installed Inno Extractor - Exeinfo Pe internal unpacker )
parameter example : exeinfope.exe file_name /unp-inno-exe
- Rust Compiler v1.76 update
- added detector for DLL 64bit : [ .PYD Python C Extensions library ]
- added detector for DLL 32bit : [ plugin for : AutoPlay Media Studio ] v8.5 http://www.indigorose.com
- fixed Obsidium v1.5 - 1.8 - [ v.1.8.2.1-2 - option : Def. MZ Head ]
- fixed Themida - Winlicense
- added .NET ConfuserEx structure [ mutation / mod -> Packed Generic Unknown ]

- much more and not tested !!!

- Buffer for exe file : 336 MB

- more
 

22.02.2024

Exeinfo Pe v. 0.0.8.3

1183 / 169 signatures

( Ext_detector  ver.0.7.2.3   )

userdb.txt : 4455

- fixed VMProtect 3.6
- Ripper .7z xor FF - fixed , detect crypted 7z v.0.4 in Advanced Installer
- fixed NOT EXE - .7z Archive v0.3/4 ( Crypted with : xor FF )
- fixed 1157.InstallForge Setup v.1.4.2
- fixed NOT EXE - .jpg picture (.MPO bug if first section Exif )
- added console mode ( pack / unpack with lzma )
Lzma packer :
exeinfope.exe FileName /plzma - pack file with lzma packer ( 7z compatible )
Lzma unpacker :
exeinfope.exe FileName /ulzma - unpack file with lzma packer
- Visual Studio 2022 update linker 14.38
- Buffer for exe file : 336 MB
- more
 

11.02.2024

 Test version  Alpha II

Exeinfo Pe v. 0.0.8.3 Alpha II

1180 / 168 signatures

( Ext_detector  ver.0.7.1.8   )

userdb.txt : 4455

please check news directory !

- Ripped data save to Directories : ex. : !Rip_zip_file_name\
- www address menu - changed items from Result
- 7z more detections
- lzma packer unpacker : file names fix
- fix for VMprotect v3.5+
- fix ScriptCryptor (js/vbs/+exe)
- Inno script fix for big files
- more
 

20.01.2024

Exeinfo Pe v. 0.0.8.3 Alpha I

1178 / 166 signatures

( Ext_detector  ver.0.7.1.8   )

userdb.txt : 4455

please check news directory !

Inno script unpacker - internal +

7z - added compression info + Better detect passworded 7z

Added pack .lzma , .lzma Undetectable , .lzma unpacker

config : added [Internet Browset ] change to user path

Viewer : added [ Save to File - window log ]
 

12.01.2024

 Test version  Alpha- Beta

Exeinfo Pe v. 0.0.8.2 (I)

1175 / 165 signatures

( Ext_detector  ver.0.7.1.8   )

userdb.txt : 4455

- Wow64 Disable File directory redirect ( Exeinfo Pe is 32 bit app. )

[new option in Config GUI ]

- inno setup script view  ( tmp. - if you have installed Inno Extractor in default path )
- and others


Buffer for exe file : 303 MB

many Bugs - do not distribute !!!!

08.11.2023

 Test version

Exeinfo Pe v. 0.0.8.1 II

1173 / 165 signatures

( Ext_detector  ver.0.7.1.4   )

userdb.txt : 4455

NOT EXE - .jpg comment fixed bug
added : NOT EXE - .MPO - 3D Stereoscopic Picture
fixed 685. x64 - Squeez Sqx Archive Selfextractor / added cpu : x64 Microsoft VC++ 14.24 exe [ CPU : AA64 ARMv8 ]
fixed 918.Launch4j-3.x
fixed NOT EXE - .Zip Arch. - .msix/appv [ Generic detector MSIX Windows app package ]
added NOT EXE - .Zip Arch. - .msixbundle [ Generic detector Win10 MSIXBundle Windows app package ]
changed : DOS exe 8 bit / 16 bit info

Buffer for exe file : 303 MB

Small update !

 

06.10.2023

Ext_detector.dll

for : Exeinfo Pe   &   Xor Data Uncrypter

version 0.7.1.8

LAST SIGNATURES :

711. NOT EXE - .m4s MPEG-DASH Video Segment Moving Picture Experts Group
712. NOT EXE - .heic image picture - H.265/HEVC codec ( need : Microsoft's HEIF Image Extensions )
713. NOT EXE - .dz Dzip ( zlib packed files : xx ) Speed Demos Archive - http://speeddemosarchive.com/dzip
714. NOT EXE - .hli UniLink v1.13 ( #hash# linker file ) - http://unilinker.com
715. NOT EXE - .ejpg Encrypted JPEG bitmap
716. NOT EXE - .empo Encrypted Multi-Picture Object jpg bitmap
717. NOT EXE - .pl Photolist file format multi jpg picture by Filefrend 2016
718. NOT EXE - .epl Encrypted Photolist file format multi picture [ files : xxx ]
 

Old .sqx signature - added compression info / crypted info
 

30.09.2023

 Test version

Exeinfo Pe v. 0.0.8.1

1173 / 164 signatures

( Ext_detector  ver.0.7.1.4 !  )

userdb.txt : 4455

update to ver.45.5 :   1156.PUP/PUA - Softonic Downloader
fixed :
589.Generic - Free Pascal compiler (MinGW/FPC) familly
NOT EXE - .vcproj Visual Studio C++ Project v8.0-9.0
NOT EXE - .PDF format ( ver.1.6 ) - [ *ENCRYPTED ]
5138. x64 NET IntelliLock v.1.5 - 3.0 ( .NET Reactor 6.x ) - for DLL 00 EP
5088. x64 Java installer v.11-20.0 offline/online
673.Sun Java Installer v8.0.x
added NOT EXE - .cbproj Radstudio ( C++ Builder )
NOT EXE - .Zip Arch. - .msixbundle
NOT EXE - .Zip Arch. - .msix/appv
Detector for Dos , win 32 , win 64 - UniLink creator
added : over 100 mb info in zip and rar files



and other
 

28.07.2023

 Test version

Exeinfo Pe v. 0.0.8.0

1172 / 162 signatures

( Ext_detector  ver.0.7.1.2 !!!  )

userdb.txt : 4455

- NON exe file format many fixes , mp4 , jpg , pdf, img/EXT2/3/4 Linux extended file system image
- add size on mp4/avif - file ( MPEG 4 container H.265 ) - [ 2048 x 1536 ]
- jpg file added GPS - data detector !
- added NSIS Installer Nullsoft NSTD detector for GCC compiler
- fixed result for NSIS exe if file size over 1 GB
- update C++ MS linker to 14.36 x86/x64
- Zip ripper fixed
- added detector on Linux ELF files for hidden : .SQUASHFS image files
- x64 - MinGW-w64 GCC: (GNU) version detector fix
- added New to Compiler detector menu for : GCC GNU v11/MinGW-W64 v4/MSYS v12 - 32/64 compiler

and other detection fixes

small visible on GUI

and other
 

28.07.2023

 Test version II

Exeinfo Pe v. 0.0.7.8

1169 / 161 signatures

( Ext_detector  ver.0.7.0.7 !!!  )

userdb.txt : 4455

console mode fixed - window no flash

- many fixes VMP 3.6 - 3.7 and other
- added more inteli hints
- fixed : Inno Setup Un/Installer
- update 1000.[ MS BoxStub Installer v17.x ]
- update : 1083.Eazfuscator.NET v2020.x - 2023.2

- fixed apng detected as png ( if .png file 20 mb )
- fixed .APNG file format - more frames : 323

- fix : 5036. x64 - Embarcadero Technologies Inc. clang version 5.0.2 (36917.e4aabb3.b018c58) (based on LLVM 5.0.2)
- fix detection for 15 sections Dll :
5040. x64 Lazarus v1-2.2 / FPC v2-3 [ v3.2.2 ] for x86_64 - [ Dll ] 

- added x64 / x86 [ python core ] x64 Microsoft Visual C++ v14.34
- update detector : 1091.PUP/PUA Asystent pobierania - komputerswiat/dobreprogramy

and other
 

23.05.2023

 Test version

Exeinfo Pe v. 0.0.7.8

1167 / 161 signatures

( Ext_detector  ver.0.6.9.6  )

userdb.txt : 4453

many fixed for test

console mode fixed - window no flash

Now detect All exe xor-ed -combination on binary files*

fix and update 32/64 : VMware/BitRock InstallBuilder ver: 22.x

fixed console mode option '/se' scan with external signatures userdb.txt

added detection :
925.Make SFX v5.x http://74.cz

NOT EXE - .ZIP archive - .appxbundle Windows 8.1 App Bundle

851.VirtualBox Installer [v.7.00.6 ] 2023

[ Sfx Easy 7-Zip 0.1.6 James Hoo

added 32/64 & update :
[ Update Tool ] - x64 Microsoft Visual C++ v14.34

update EP
VMProtect v.3.6.0 - 3.7.3 2022 [ Exe , Option : packed ]

now detect v.23
1054.Yandex browser installer v19 - 23.x full

update detector
970.Google UPDATE (MS Edge/Chrome) Update Setup Installer

added only x86 stub : [ Opera 2023 Installer ]

fixed : x64 for Alexandria ver35
5012.x64 Embarcadero Delphi compiler

added signatures :

5150. x64 .NET - DNGuard HVM v4.20 by ZiYuXuan Studio - 2022.11 - www.dnguard.net - stub : EP=0000
5151. x64 DLL from : Microsoft AppStore ( Export : RHBinder__ShimExeMain ) - stub : NSTD MSV C++ built by: PROJECTNREL
5152. x64 EXE from : Microsoft AppStore ( exe run dll -> RHBinder__ShimExeMain ) - stub : NSTD MSV C++ built by: PROJECTNREL
5153. x64 Baymax Patch Tools v3.1.0 - 3.x 2023.01 by Nisy/PYG www.chinapyg.com - stub : Microsoft Visual C++ v.9.00 & UPX Stub
5154. x64 Microsoft Visual C++ v14.16 - 2017 - DLL ( push rbx , DisableThreadLib.Cs. )
5155. x64 Yano v1.0.15.0 ntoolbox.bom/yano 2012 obsolete! - stub : x64 .NET exe file : 00 Entry Point
5156. x64 ArmDot 2023 v3.0.0 - www.armdot.com ( protector/license creator ) - stub : x64 .NET DLL with : 00 Entry Point - CPU : AMD64
5157. x64 GO Programming Language - Compiler v1.19.7
5158. x64 - DLL to EXE converter v1.1 - for 32 & 64 bit DLLs - 2018-10-10
5159. x64 .NET - DLL to EXE converter v1.1 - for 32 & 64 bit DLLs - 2018-10-10
5160. x64 .NET IntelliLock 2.9 - 3.0 ( unreg.js script ) .NET Reactor

and x86 signatures :

1155.ArmDot 2023 v3.0.0 - www.armdot.com ( protector/license creator ) - stub : MS Visual C# / Basic.NET
1156.[ PUP/PUA - Softonic Downloader v6.4x 2022 ] - Inno Setup Module 5 SFX - [ v.6.1.0 ]
1157.InstallForge Setup v.1.4.2 ( free ) 2007-2020 - http://installforge.net - stub : PureBasic v4.20 - v6.0
1158.[ A.S.L - NSIS Setup Protector ver.0.01 ] - Nullsoft Install System v2.xx - 3.0 / v.2.12
1159..NET exe bytepress v1.0.0.2 by Adam Roach - http://github.com/roachadam/bytepress ( Mode : lzma/gzip/quickLz )
1160..NET Bat2Exe v2.1 ( 17.11.2021 ) - http://github.com/dehoisted
1161.[ Overlay crypted PUP/PUA - Unknown Pack ] - Generic : Installer Nullsoft PiMP Stub / v.20-Sep-2022.cvs
1162.Generic new : AVAST/AVG Software Sfx installer v23.x 2023 - www.avast.com - stub : NSTD MS VC++ 14.x
1163.x86/x64 Chromium Installer v.113.x - 2023 - stub : Microsoft Visual C++ v.14 - 2015 ( NSTD ) microsoft.com
1164.x86/x64 Generic/Modded : Chromium Installer v.xx - 2023 - stub : Microsoft Visual C++ v.14 - 2015 ( NSTD ) microsoft.com ( ex.Maxton )
1165.x86 - DLL to EXE converter v1.1 - for 32 & 64 bit DLLs - 2018-10-10
1166.Adobe Installer downloader v2.11.0.30 - upx stub 3.91
1167..NET IntelliLock 2.9 - 3.0 ( unreg.js script ) .NET Reactor
 

25.03.2023

 Test version 5

Exeinfo Pe v. 0.0.7.7 V

115x / 15x signatures

userdb.txt : 4453

.NET - Babel v9.x updated , IntelliLock 3.0

console mode fixed - window no flash

overlay xor - changed ! , you can use on non executable files ( un-xor binary file )

fix : 426.Themida & WinLicense 2.0 - 2.4.6 - struct (Hide from PE scanners II-V)

Config - if set to English , I delete config lng file for external language like : Chinese.lng

added on MSV C++ for PUA App. : [ WARNING : File use VirtualProtect ]

update [ 7-zip SFX stub ] [ v22.01 Con - GENUINE Stub ]

1145.[ BoxedApp SDK32 - 2018-2021 ] DLL library - www.boxedapp.com

All signs : imptoved VMProtect 3.5.x - 3.6.x - x86 & x64 - Strong detection POWER !

fix 797.DeployLX Software Protection System - Codeveil 5.x for .NET

added
800.[ NETSecureFake Signature ! ] .NET + dotfuscator - PreEmpire Solutions

fixed Non exe - .h264 movie detector

18.03.2023

Can generate NET results :

Skater : if obfuscation method  is identical

Test version

Exeinfo Pe v. 0.0.7.5

1141 / 146 signatures

userdb.txt : 4451

signatures update

- Strong update .NET obfuscator x86 / x64 !!!
- DLL Characteristics GUI updated
- Added .jp2 jpeg2000 Ripper ( for .pdf files )
- fixed : x64 GO Programming Language
- 5045.x64 - AutoIt [ v3.3.14.5 ]
5045.x64 - AutoIt [ v3.3.16 2022.09 ]
- 5012.x64 Embarcadero Delphi NSTD
- 5035.x64 Paquet Builder v21.0.0
- 016.PEcompact ver.3.02.2
update : 5076.[ x64 Enigma ver.5.x - 7.0 ]
update ver.VMProtect v.3.5.1 - 3.7.3 2022
fixed & upd.723.Ahk2Exe for AutoHotkey [ v1.1.36.02 ]
added v10 : 588.Enigma Virtual Box - v10.00 (2022.12.14)
fix detector :
5135.x64 VMProtect v.3.6.0 - 3.7.3 2022
added new version :
1021.InstallAware Virtualization v6 ( BoxedApp packer v2.x - 14.0 )
1021.BoxedApp Packer 2018 / 2019 14.0
added x64 : [ ESET module MZ-Header ]
added v5 generic :
760.Generic Crypto Obfuscator For .Net v5 - LogicNP Software
added tampared exe :
Windows PE exe for .NET / GNU compiler but no "PE" tampared/compr.
Windows PE exe compressed LZ77
fix : NOT EXE - .dex - Dalvik Executable v5.0 - 9.0



 

25.12.2022

Test version

Exeinfo Pe v. 0.0.7.3

1132 / 138 signatures

userdb.txt : 4447

NOT compatible with - Arabic Windows 10 !

signatures update

added Flip EOF to offset 0000 - binary file tool

added Fake detector for : 800..NET + dotfuscator - PreEmpire Solutions

fix : 5096. x64 Eazfuscator.NET v2022.1

fix For : Inx .NET Protector & Obfuscator ( Strong ConfuserEx Mod )

and others

29.08.2022

PDF , doc

  and

picture hints

update hints

ExeinfoPe_documents.zip

15.03.2023

updated !

7.5 MB

Update file ,

main exe only + dll !

Exeinfo Pe v. 0.0.7.1 AR

1124 / 134 signatures

This version is compatible with - Arabic Windows 10

this version try detect x64 dotfuscator

VMProtect v.3.5.1 2021

CPU Bug fixed

Autoit 3 ver. fix

fix : 800. .NET + dotfuscator - PreEmpire Solutions v1.2 - 6.5.x

info : Deleted Address Converter GUI - crash on Arabic Windows
 

27.06.2022

Update file ,

main exe only !

Exeinfo Pe v. 0.0.7.1 Test

1124 / 132 signatures

fixed :
5074. x64 Qt Installer v2.0.0 - x.x.x
fix [ Virtualbox.org Header ] 32 / 64
x64 - Qt [v.601.34] DLL - App.dev.framework
5043.structure : x64 VMProtect v.3.0x
800..NET + dotfuscator - PreEmpire Solutions v1.2 - 6.4.x

added :
5129. x64 VMProtect v3.x Minim. section
935.VMProtect v3.00 - 3.5.0 [ option : not packed - First section Delphi ]
769.InstallShield [ 2021 Pro Unic. v27.0.122 ]
1124..NET + dotfuscator - PreEmpire Solutions v6.5.x [ 6.5.0 ]
5131. x64 InstallShield [ 2014-2021 Pro Unicode v21.00-27.00 ]

update 32/64
Autoit3 [ v3.3.3.16 ]

fix : Run Uniextract v2
Long directory names with space bar

Exeinfo size = -100 kb

and other fixes
 

16.06.2022

Exeinfo Pe - Advanced config tool 

ver. 1.5.0.3

You can enable hidden  Config options

 down link

added : support shell Die v.3.0

updated !

16.09.2020

Exeinfo Pe ver.0.0.6.2 Final

1083 / 97 signatures

( Ext_detector  v.0.5.6.7  )

userdb.txt : 4432 
 

update old detections :

GO Programming Language Compiler v1.14.5

fixed 935.VMProtect v3.00 - 3.5.0 2003-202

960.Radstudio v10.x ESD ( C++ Builder 10.1 - 10.4 - DLL library ) -

added support for bmp files v4

added for Delphi   10.4 Sydney - pas,dfm,dpr

www ripper - fixed for unicode www

Scan files faster ! - visible on big NET files

24.07.2020

Cryptographic plugins for Exeinfo Pe

kanal v2.92

and

Hash & Crypto Detector v1.4

07.03.2019

Exeinfo Pe ver.0.0.5.0

1015 / 67 signatures 

Ext_detector.dll

for : Exeinfo Pe   &   Xor Data Uncrypter

version 0.4.9.0

new signatures added : Detect VMProtect v3.1 ( 32 & 64 bit )

many diagnose changed , added new Ripper for Packed .js files

changed  :Quick Unpack registry from v2.2 -> v3.4 , v2.2 not supported !

External scan - userdb.txt support up to : 4800 sign

.ico Ripper error fix

fix : Not Windows PE -> Signature : LX <- OS/2 ver.2.0 or higher , EIP : 00xxx

added to DOS exe : Not Windows PE -> Sign. : DOS 8 bit - CS:IP : 0000:00xx

961.[ Obsidium ver.1.6.43.0 ] fix TAGG

946. fix : ESET Live Installer

external db signatures : 4524

GUI - Windows Visual Style - fixed

12.04.2018

Exeinfo Pe ver.0.0.4.8 Test

994 / 64 signatures

( Ext_detector  v.0.4.5.2 )

Many fixes : Added detection for  Go language x64

old signatures updated GNU GCC MinGW + ver.detector ,

added : GO language detector , STATIC - Qt v5.x App.devel.

fix for ScreenShot create - Multiscan GUI Win7 , Inno Setup updated

External scan changed : minimum 4 bytes length ( ex. E8 ?? ?? ?? ?? ) !!!

10.09.2017

   Adv_scan.dll plugin  - A.S.L version fixed

-> no trojan on Anti Virus scanners

For Developers / Programmers

           Exeinfo Pe / PeID  plugin

   Source code  : 

PowerBASIC ,

C++ ,

Delphi ,

MASM

           Exeinfo Pe / PeID  plugin

   Example code :  Delphi source code

 How to use Ext_detector.dll from  Exeinfo Pe

    Language : Delphi 2006 - Console only 

              minimum code  - source

Please send suggestions   :   asl@onet.eu