rukov Posted November 30, 2014 Report Posted November 30, 2014 ! BUG Fix! Entry: Compiler: Microsoft Visual C++ (RTL: __crtGetStringTypeA) misdetected! BUG Fix! Entry: Compiler: Microsoft Visual C++ (RTL: __crtLCMapStringA) misdetected* ZLib better detect* Borland Turbo C 1.0 better detect* MinGW32 better detect* PowerBasic CC 3.x better detect (EP)* CheckSum Adler32() better detect (RFC 1950)* Borland Delphi version better detect* Borland Delphi DCU Hdr magics* Borland C++ Builder better detect* Microsoft Visual C++ x64 better detect* NIST B571 better detect* LZX better detect* Tiny Primes array better detect* Hash padding array detection method changed* WinZip SFX better detect+ GCC Algo group+ MINGW Algo group+ QT Algo group+ ACSS Crypt+ MinGW32 2.x..4.x DLL (EP)+ MinGW64 2.x..4.x DLL (EP)+ Qt strings detect (use QT Algo)+ Aladdin HASP SRM+ Rar 5.x Archive Signature+ Confuser .NET Obfuscator (String)+ LZXC2 Hdr marker+ SnakeSoftware ExeBook+ Photodex Installer+ Map: Bits in byte count lookup table+ Map: Power 2 table+ eLicense initial detectUsage: cc.exe [AlgoGroupName] wildcards* Built to find everythingAvailable AlgoGroup names are:AES AES Block Cipher* Search ALL - try as last resortBLACK A few known blacklisted namesBLOWFISH Blowfish Block CipherBORLAND Some Borland common sigzCAST CAST Block CipherCOM COM-specific text stringsCRACK Some words relative to crackCRC CRC16/32 Hash functionDES DES Block CipherDITTO Search for Ditto valuesEBOOK e-booksEXCEPTION ExceptionsEXTRA Extra search - Generate a Lot of JunkFERMAT A few Fermat's numbersGFX Common graphics formatsHAVAL Haval Hash functionHASH Some Hash specific valuesIMUL Some strange IMUL immediate valuesIRREDUCIBLE Some Irreducible polynomialsLOCKBOX Some LockBox sigzLZX Some LZX archiver sigzMAGIC Some common Magic valuesMARKER Some common markersMARS Mars Block CipherMASK Some common Mask valuesMD MD Family Hash functionsMICROSOFT Some M$ common sigzMSG WinAPI Message referenceNUMS A few common Numerical valuesPRNG A few common PRNG sigzQ128 Q128 Block CipherRSA RC5/6 Block Cipher etc.SMALL_PRIMES 90,000+ small Prime numbers (> 65,521)SNEFRU Snefru Hash functionSTL STL-containers namesTBYTE System@Pow10 TByte arraysTEXT Rough ASCIIZ strings dumper (5..1040 chrs)TIME Date/Time calculation relativeTINY_PRIMES 6,000+ tiny Prime numbers (< 65,537)WAKE Wake Block CipherWIDE Borland Wide strings dumperZIP A few (PK)Zip sigzDownload https://github.com/nihilus/IDA-CC Quote