Hacker

home *** CD-ROM | disk | FTP | other *** search

/ Hacker / Hacker.iso / HACKER / PATCH / PTOOL / EXM.DOC < prev next >

Wrap

Text File | 1997-05-27 | 26.2 KB | 724 lines

▒███████ ▒██ ▒██ ▒███████ ▒██ ▒██ ▒██ ▒██ ▒██████ ▒███ ▒██████ ▒██ ▒██ ▒██ ▒██ ▒███████ ▒██ ▒██ ▒███████ ██▀▀█▀▀█ █▀▀▀▀▀█ ██▀▀▀▀▀▀ ▀▀▀▀█▀▀▀ ██▀▀▀▀▀▀ ██▀▀▀▀▀█ ██ ██ ██ █▄▄▄▄▄█ ██▄▄▄▄▄▄ ██ ██▄▄▄▄▄ ██▄▄▄▄▄█ ██ ██ █ ▄█ ▄█ ██ ██ ██ ▄█ ██ ██ █ █ ▄▄▄▄▄▄▄█ ██ ██▄▄▄▄▄▄ ██ ██▄ 3.8 -= David Smith, 1993 =- {{{{{{{{{ FREEWARE }}}}}}}} ┌───────────────────────────────────────────────────────────┐ │ │ │ TYPE: EXM ? for help │ │ │ └───────────────────────────────────────────────────────────┘ ExeMaster is NOT another executable file lister! ExeMaster combines the power of compression listers with the ability to show Self-Extracting Archivers, Windows files, Batch Compiler recognition, self-displaying text files, plus batch file information, and the CheckSum, and MORE! Shows 57 types of files... ExeMaster recognizes: PKLITE (tm) version 1.0 and up LZEXE .90 and .91 DIET all versions TINYPROG all versions SCRUNCH 1.0 and up COMPACK all versions SHRINK 1.0 PKZIP 1.1 - 2.0 self-extracting archives ARJ all versions of self-extracting archives LHA all versions of self-extracting archives SQUEEZE all versions of self-extracting archives LHARC all versions of self-extracting archives ARC all versions of self-extracting archives PAK all versions of self-extracting archives ZOO all versions of self-extracting archives LARC (.LZS) all versions of self-extracting archives DWC all versions of self-extracting archives WINDOWS(tm) 2.0 and up files WordPerfect(tm) all versions of executable files COM2EXE converted .COM files COMVERT converted .COM files TSRMaker TSR converted files TurboBat compiled batch files PowerBat compiled batch files BAT2EXE (PC Magazine) compiled batch files BatLite compiled batch files BAT2COM compiled batch files Laughing Dog self-displaying ANSI screens Dave's README Compiler self-displaying text files TurboTXT self-displaying text files Asc2Com self-displaying text files Doc2Com self-displaying text files Txt2Com self-displaying text files MakeRead self-displaying text files TEXE self-displaying text files BigText self-displaying text files SHOW 2.0 self-displaying text files TDISPLAY self-displaying text files BOOK-E self-displaying text files RO-SOFT Txt2Com self-displaying text files DOC Maker self-displaying text files TXT Maker self-displaying text files GRABBER self-displaying Graphic Files GIFEXE self-displaying Graphic Files Graphic Workshop self-displaying Graphic Files FLI 2 EXE self-displaying .FLI (Autodesk Animator) files Graphic Workshop for Windows Graphic Files Norton(tm) Files Compressed Norton Executable Files PROTECT EXE/COM (version 1 and 2) Binary encrypted files COP (version 1.0 and 1.4) encrypted files PKLITE altered file (virus authors have a utils called NOLITE LZEXE altered file and NOLZEXE that remove the PKLITE and LZEXE header. These altered, possible virus files are ID'd) CRYPTCOM Encrypts .COM files (used by virus authors) XEQ.COM XEQ Library Files COM-PAK .COM Library Files ALSO: Shows CheckSum of files, finds description files in compressed archives,and displays line information about Batch files. And ExeMaster does this at LIGHTNING speed. USAGE: EXM [path/file/options] [options] [[press any key during operation to pause : another key to continue]] [[pressing ESC during operation aborts program]] Options: /P Stop after every page /W Wide display (5 column) /BW Black and White (No colors) /C show Checksum (much slower) /-S no size info /-D no date info /-H do not scan Hidden/System files /-W do not scan for Windows files (slightly faster) /-B do not scan for Compiled Batch Files or self-displaying TEXT files /-I no summary Information at end /OP Show only PKLITE /OS Show only SCRUNCH & SHRINK /OC Show only COMPACK /OT Show only TINYPROG /OD Show only DIET /OL Show only LZEXE /OEX Show only SFX Archives (and XEQ) /OW Show only Windows files /OB Show only Batches & text files /OGN Show only Graphic & Norton /EXE Display advanced infomation on EXE header! /SYSOP Find FILE_ID.DIZ, DESC.SDI, and .SDA files inside archived files ============= OPTIONS ======================================================= /W Wide display (five columns) /BW Black and White (No colors). EXM normally uses \EXM.CFG file for its colors. See Configuration File section below for more details. /P This causes EXM to pause after every 23 lines. /C Show Checksum of file. The "checksum" of a file is the sum total of all the bytes in a file. If any changes are made to a file (from a virus or someone hacking the program), the Checksum of that file will be different. This is useful to ensure your file integrity is good, but does take a while, since every byte of the file must be read and calculated. /-S No size information. This eliminates the file size displayed normally on the second line. /-D No date information. This eliminates the file date displayed normally on the third line. /-H Do not scan hidden files. As a default, ExeMaster scans hidden files as well as normal files. This turns that function off. /-W No Windows file search. Normally, ExeMaster scans bytes 400-700 for the "requires Microsoft Windows" string. This option eliminates that, and speeds up processing by around 20%. /-B No compiled batch file or self-displaying text file scan. DOS Batch files can be compiled into .COM or .EXE files by several different utilities. Normally, ExeMaster scans for these. Also, ExeMaster scans for compiled text files. This option turns this scanning off. /-I No ending info. This eliminates the total files/sizes and archiver information displayed at the end. /OP Show only PKLITE. Only files compressed with PKLITE(tm) will be displayed. /OS Show only SCRUNCH. Only files compressed with SCRUNCH will be displayed. /OC Show only COMPACK. Only files compressed with COMPACK will be displayed. /OT Show only TINYPROG. Only files compressed with TINYPROG will be displayed. /OD Show only DIET. Only files compressed with DIET will be displayed. /OL Show only LZEXE. Only files compressed with LZEXE will be displayed. /OEX Show only Self Extractors. Only files that are compressed with LHA, ARC, PKZIP, ARJ, SQUEEZE, PAK and LHARC will be displayed. /OW Show only Windows files. Only files that run under Windows(tm) will be displayed. /OB Show only Batch and Text. Only batch files that have been compiled, and self-displaying text files will be displayed. /OGN Show only Graphic & Norton Files. Self-displaying graphic files are images stored as .EXE files, and show themselves when run. Norton(tm) files are included in such packages as NORTON UTILITIES, or NORTON DESKTOP, and are compressed with his own executable compressor. /SYSOP New! Many SYSOPS spend a LOT of time sorting through new uploads, trying to find descriptions in them. This merely searches the compressed (ZIP,ARJ,etc) file and tells if it contains a FILE_ID.DIZ, DESC.SDI, or .SDA. It may be a little slow, since it searches through the WHOLE file. /EXE This shows advanced information about the HEADER of an .EXE file. NOTE: You can only specify ONE file on the command line when you use this option! The typical information provided is: Signature byte = MZ Remainder after dividing load module = 8C Size of file in 512-byte pages = 2A Number of relocation table items = 0 Size of header in bytes = 32 Minimum memory needed for file = 35536 Maximum memory needed for file = 65520 Offset of stack in load module = 8BE Stack Pointer register loaded with = 80 Checksum of all words in file = 0 (sometimes zero...) Instr. Pointer register loaded with = E Offset of code segment in load mod. = 511 Offset of first relocation item = 1C Overlay number (zero if no overlay) = 0 These should be self-explanatory. If not, please consult a technical manual for more information. The important things about the above are: Minimum memory needed for file, since this is the absolute smallest amount of MEMORY you can survive through the .EXE with. Overlay number, since an overlay file usually cannot be compressed with a .EXE compressor. ==== CONFIGURATION FILE ====================================================== ExeMaster uses a configuration file in your current directory (or root directory) called EXM.CFG for your colors. Each archiver has its own color (default of WHITE ON BLACK), in the following format: Normal= Uncompressed Files Pklite= Compressed Lzexe= " Diet= " Tinyprog= " Scrunch= " Compack= " PKZIP= Self-Extracting Archivers ARJ= " LHA= " Squeeze= " Arc= " Pak= " Windows= Windows Files Batch= Compiled Batch Files Text= Self-Displaying Text Files Graphics= Self-Displaying Graphics Files Norton= Norton(tm) Files XEQ= XEQ Library Files WordPerfect= WordPerfect executable files Each of these file types are followed by a color. Valid colors are: Foreground Background ======================= ====================== BLACK BLACK BLUE BLUE GREEN GREEN CYAN CYAN RED RED MAGENTA MAGENTA BROWN BROWN LGREY LGREY DGREY LBLUE LGREEN LCYAN LRED LMAGENTA YELLOW WHITE BLINK (causes the foreground color to blink) The format is: WHITE ON BLACK or: LRED ON BLUE or: WHITE or: BLACK ON LGREY BLINK A valid example of a configuration file is included. Please notice the format: Normal=WHITE ON BLACK Pklite=RED ON LGREY Lzexe=LMAGENTA Diet=BLACK ON LGREY Tinyprog=RED Scrunch=LCYAN Compack=YELLOW ON BLACK PKZIP=LGREEN ARJ=DGREY ON BLUE LHA=YELLOW ON BLUE Squeeze=WHITE Arc=YELLOW ON LGREY Pak=GREEN ON BLACK Windows=LGREEN ON BLACK Batch=LBLUE ON MAGENTA Text=LRED ON BLACK Graphics=CYAN ON LGREY Norton=MAGENTA ON BLUE XEQ=CYAN WordPerfect=RED ON BLACK (the default is WHITE ON BLACK. If no color is specified, or the file type is not in the configuration file (ie: no "Norton" lines), WHITE ON BLACK will be assumed) === VALID EXAMPLES: ========================================================== EXM Display and scan all files. As a default, EXM scans everything except the Checksum, and no pause after every page. Ending file info, size and date display are also displayed. EXM *.exe Scan all .EXE files in current directory. EXM *.com /C Scan all .COM files, and show Checksum information. EXM /-S/-D Scan all files, but do not display size and date info. EXM \TURBO Scan all files in \TURBO directory. EXM \TURBO\*.com Scan all .COM files in \TURBO directory. EXM B:*.com Scan all .COM files in B: drive. EXM /-B/-I Scan all files, but don't scan for compiled batch files, or self-displaying text files, and no ending information at end. EXM /OB Only compiled batch files and self-displaying text files are listed. EXM /OEX Only self-extracting compressed files will be shown. EXM /exe TRYME.EXE Show the advanced header information from the executable file. EXM /sysop *.ZIP Finds FILE_ID.DIZ, DESC.SDI, and .SDA files inside archives. This is convenient for SYSOPS who want to post compressed files, but don't want to hunt through all of them to see if they have descriptions. NOTE: EXE MASTER will exit with an errorlevel of the last file tested. The errorlevels are: 0 Normal 1 Pklite 2 Lzexe 3 Diet 4 Tinyprog 5 Scrunch 6 Compack 7 PKZIP or ZOO 8 ARJ 9 LHA 10 Squeeze 11 Arc 12 Pak 13 Windows 14 Batch 15 Text 16 Graphics 17 Norton 18 XEQ 19 WordPerfect So if you run a local BBS, and want to be able to identify your uploaded files, then you could have a batch file like: EXM %1 /-I if errorlevel 10 goto ITS_SQZ if errorlevel 9 goto ITS_LZH if errorlevel 8 goto ITS_ARJ if errorlevel 7 goto ITS_ZIP goto UN_KNOWN **************************************** * VIRUS NOTE * **************************************** Although EXE MASTER identifies NOLITE and NOLZEXE files, false alarms may arise. Don't panic if a few files come up as altered. They may merely be compressed with something that's unidentified by EXE MASTER. However, if a file is already suspicious, a warning from this program should make you even MORE suspicious. But if you know with confidence that the file is perfectly OKAY, then ignore the EXE MASTER warning. Considering the level of hacking that virus authors can perform, it is impossible to perfectly identify an altered file. What in the world is CRYPTCOM, NOLITE, NOLZEXE? In order to introduce detectable viruses onto computer systems, virus authors are compressing them with executable compressors or encryptors. At that point, the virus is no longer detectable. When the file is executed, the program decompresses, the virus is run (or the boot sector virus is dropped into your disk) and wala, you gotta virus. ExeMaster is freeware from David Smith. For a great deal, see the enclosed CATALOG.COM file for over 30 utilities for only $20.00 ! ======== UPDATES ========================================================== 2.7 Added WordPerfect(tm) files, FLI 2 EXE graphics files, Laughing Dog Self-Displaying ANSI files, COM2EXE converted .COM files, Dave's Readme Compiler, plus added commas into the "TOTAL BYTES USED" ending section. Also fixed bug with locating .COM self-extractors, and updated some other new versions of graphics and document conversion files. 2.8 Added Graphic Workshop for Windows, MakeRead 1.4, TDISPLAY, and improved speed by looking directly at bits of the buffer rather than comparing strings in many compressions. 2.9 Added RO-SOFT and BOOK-E self-displaying text files, plus ZOO self-extractors. 3.0 Added PROTECT EXE/COM 1.x plus LARC (.LZS) files. 3.1 WARNING: Virus authors use a file util called NOLITE that removes the PKLITE header information from files, in order to hide embedded viruses. Those files are now included. 3.2 Added NOLZEXE files, and Protect EXE/COM 1.1 and 2.0 files. 3.3 Added CRYPTCOM files (used by virus authors), plus improved the help screen. 3.4 Added COMVERT, COM-PAK, DOCMAKER, TSRMAKER, TXTMAKER, COP 1.0 & 1.4 (courtesy of Jack Orman) 3.5 Added some weird headers from PKZIP -AV options. 3.6 Added the advanced header information (/EXE) switch, plus fixed a couple of bugs... 3.7 Had to fix some bugs... 3.8 Added (/SYSOP) configuration for sysops who want to check through their .ZIPPED or compressed files for descriptions plus added SHOW v2.0 and Breeze v5.2 files. =============== CREDITS ================================================ Protect! EXE/COM v.3.0 encrypts your EXE & COM files and leaves them executable, making a complete FILE INTEGRITY CHECK every time it is run using a complete CRC. Anti-debugging techniques and a new header have been added to this version to make it more resistant to cracking and you can customize your own CRC error messages ! SHOW V20 is Copy(c)right 1989,1993 by Gary M. Raymond, New Orleans, La. Show TEXT Converter (Text to COM) Program V2.0 by Gary M. Raymond all other archivers and programs are copyright by their individual authors ┌─────────┐ │ MEMBER │ Society of │ ┌──────┴──┐ Independent │ │ │ Shareware └──┤ ■ │ Authors │ ║ │ └────╨────┘ This program is produced by a member of the Society of Independent Shareware Authors (SISA). The Society wants to ensure that all valid shareware principle actually work for you and SISA members. The principle behind shareware distribution is simple; try before you buy. Society members agree to license all shareware for a minimum of 10 days, free of charge, to first time users as an evaluation period. After 10 days, buyers are then obligated to license their copy with the Society member. Society members are obligated to provide high quality, useful shareware, but, are free to choose whatever marketing methods suit their specific needs. SISA sanctioned marketing methods include: demonstration versions; providing printed documentation after purchase; registration keys that unlock additional features not necessary to determine basic usefulness; and, providing bug fixes free of charge. Any Shareware author may become a member of SISA without cost by simply agreeing to the above conditions and displaying, at their option, this logo in their documentation. ███████╗ ██╗ ██╗ ██████╗ ██████╗ ██████╗ ██████╗ ████████╗ ██████╗ ██╔════╝ ██║ ██║ ██╔══██╗ ██╔══██╗ ██╔═══██╗ ██╔══██╗ ╚══██╔══╝ ╚════██╗ ╓──███████╗ ██║ ██║ ██████╔╝ ██████╔╝ ██║ ██║ ██████╔╝ ██║ ▄███╔╨─╖ ║ ╚════██║ ██║ ██║ ██╔═══╝ ██╔═══╝ ██║ ██║ ██╔══██╗ ██║ ▀▀══╝ ║ ║ ███████║ ╚██████╔╝ ██║ ██║ ╚██████╔╝ ██║ ██║ ██║ ██╗ ║ ║ ╚══════╝ ╚═════╝ ╚═╝ ╚═╝ ╚═════╝ ╚═╝ ╚═╝ ╚═╝ ╚═╝ ║ ║ ║ ║ ║ ║ Support for this program is available in the following ways: ║ ║ ║ ║ ║ ║ ╓──┐ ╓──┐ ╓─╥─┐ ╥──┐ ╥ ┬ ╓─┐ ╥──┐ ╥──┐ ╥ ┬ ╥──┐ ║ ║ ║ ║ │ ║ ║ │ ╟──┘ ║ │ ╙─┐ ╟─ ╟─┬┘ ╙╖┌┘ ╟─ ║ ║ ╙──┘ ╙──┘ ╨ ╨ ┴ ╨ ╙──┘ ╙──┘ ╨──┘ ╨ ┴ ╙┘ ╨──┘ ║ ║ User ID: 71441,2723 ║ ║ I usually log on every day and check my mail. ║ ║ ║ ║ ║ ║ ▄▄▄▄▄▄ ▄▄▄▄▄▄ ▄▄▄▄▄▄▄ ║ ║ █ ▄▄ █▄ █ ▄▄ █▄ █ ▄▄▄▄█ ║ ║ █ ▄▄▄ █ █ ▄▄▄ █ █▄▄▄▄ █ ║ ║ █▄▄▄▄▄█ █▄▄▄▄▄█ █▄▄▄▄▄█ ║ ║ Drop me a line on the Hogard Systems Bulletin Board ║ ║ David Smith (214) 641-6292 ║ ║ ║ ║ ║ ║ ▄██▄ ▄██▄ ▄███████▄ ▄█▄ ▄██▄ ║ ║ █████▄█████ ████▀▀▀████ █████ ████ ║ ║ ███████████ ████▄▄▄████ █████ ████ ║ ║ ████ ████ ███████████ █████ ████ ║ ║ ████ ████ ████ ████ █████ ████▄▄▄▄▄▄▄ ║ ║ ▀██▀ ▀██▀ ▀██▀ ▀██▀ ▀█▀ ▀████████▀ ║ ║ Write to: ║ ║ ║ ║ David Smith ║ ║ 1104 Mason Dr. ║ ║ Hurst TX 76053 ║ ║ ║ ╙─────────────────────────────────────────────────────────────────────────────╜