Very good disassembler supporting 8/16/32 bit assembler, PE, DOS executables, Z80, 80XXX, Pentium Pro, MMX and KNI.

New Features : File save as text/asm now use new ofn functions in common.cpp , Extra debug function added to debug.cpp , Changes to file loading, now checks for zero size file , Bugfix in display code re looping at start of segs in display output , Fixed export code outside known data area was causing a crash.

This is a simple disassembler featuring full support for Win32 Files , build-in powerfull PE Editor , supports MMX opcodes , easy & good looking interface ;)

Unassembly upto MMX/P6 opcode. Assembly upto Pentium opcode(without FPU opcode). Hook all imported functions (like system dll call) that are called APIs. All hooked APIs are counted when called. MultiThread enabled. Emulation - Automatic trace through the debugee until a breakpoint is met. Log the API call history. When a value is needed, an expression can be used. (like eax + ebx, [ecx + 3] + ebx). Delphi 3.0 object structure recognizing(only for registered user).

DebugView is an application that lets you monitor debug output on your local system, or any computer on the network that you can reach via TCP/IP. It is capable of displaying both kernel-mode and Win32 debug output generated by standard debug print APIs, so you don’t need a debugger to catch the debug output your applications or device drivers generate, and you don't need to modify your applications or drivers to use non-Windows debug functions in order to view its debug output. DebugView works on Windows NT 4.0, Windows 2000, Whistler Beta 1, Windows 95, Windows 98 and Windows Me.

Its big , its good and its rare.A must have if you can download it. It's also probably the best.

IDA is the best disassembler for our reversing work. Newbies seem to have a difficult time adjusting to the IDA environment (including me when I was an IDA newbie). I think this is mostly because they are accustomed to W32Dasm and it's abitlity to look at the String References in the disassembled program. IDA doesn't really provide a good interface for analyzing string references in a unified place. Currently, IDA analyzes the program and places strings in the "Names" window. They appear in this window along with many other things. They usually have a prefix of 'a' so they can be easily picked out. For Example: "This is a string" would probably have a name of aThis or something similar in the Names window. This is very confusing and frustrating for a Newbie to IDA. The same problem exists with IDA in the viewing of Imports and Exports of the program. W32Dasm also provides a nice interface to view and find these and IDA does not. I've decided to write 3 plugins to add this functionality to IDA Pro. All plugins will emulate the way in which W32Dasm handles them currently. The 3 plugins are as follows:

1) String References - Will analyze the string references of the program and display them in a single dialog to the user. The user can search for a particular string by simply starting to type the string into the dialog. Once the desired string is found, the user may highlight the string and double click it (or press enter) to take them to the place(s) in the disassembly where those string references occur. Keep Double clicking on the string to show the next reference(s) to the string in the disassembly. **NEW** Now analyzes the resource section of the program, annotates it, and also includes string references from that section in the selection dialog.

2) Import Viewer - Will analyze the imported functions in the currently disassembled file and display them in a single dialog to the user. It will act in the same manner as the String References dialog where you can double click each item to take you to the place(s) in the disassembly where the functions are referenced.

3) Export Viewer - Will analyze the exported functions / entry points of the currently disassembled file and display them in a single dialog to the user. Once again, you can double click on the exported functions to take you to the begining of the exported function.

New Features : Now includes a version compatible with IDA 4.14

This plugin is intended to search for code signatures defined in the file loaded in IDA in another file. Source Codes included.

Memory Editor is a debugging tool utility. You can debug your applications / drivers by watching memory content. Memory Editor can also edit / change memory content, and save it to a file. Searching facility is also supported. Why do you ever want to use view / edit / save your memory ? There are many reasons.You want to debug your applications or drivers.You want to save your data when the applications hang. If you're working with some applications..... then the applications suddenly crash, before you can save your work. Your data may still reside in memory. So, you need to find the data in memory, and save it into a file. However, you need to have some knowledge about memory structure in Windows.

Features : Memory Editor supports searching facility.Memory Editor supports saving memory content into a file.Memory Editor supports editing memory content.Memory Editor supports linear memory as well as physical memory (by mapping physical memory to linear address).Easy to use.

A Portable Executable (Win32) file viewer/dissection utility.

Features : Dump any part of an executable or files of any type and size . View images and structures for resources . Powerful code disassembler with support for .dbg, .pdb, and .tds debug files . Save and restore sessions . Improved text support - columns, line-numbers, search . Improved session management . Integrated DBGHELP support . Private debug symbols . "Callbacks", i.e. entry-points in forms and class modules listed; view the code produced by the VB native compiler . Subroutine discovery option.Subroutine discovery option.

A light weight debugger and reverse engineering tool.

New Features : Trace user-selected API calls , Trace API calls created using GetProcAddress , Breakpoints on memory access.

This program is a console mode PE (Windows Portable Executable program) viewer/disassembler. There are many work to do. Developed with Borland C++ 5.01, compiled with Visual C++ 6.0 and Gcc for Linux platform. Tested with HP ia64 compiler and SKI emulator. Does not work with big-endian machine. It support full Pentium II instruction, old Intel processors instruction (old system 486 instruction, 8087 and 80287 opcode), MMX Pentium III, Pentium III control instruction and full 3DNow! extension.

New Features : Many bugfixes , Disabled unsafe heuristics, Updated config scripts , Project ported to SourceForge.

This is an excellent tool to find any information on PE executables.

New Features : New features added to Resource Viewer , Delay Import Viewer added , The Characteristics Editor added to Section Headers Viewer , Fixed a bug which raised an exception when obtaining debug info , Registration is removed, now PE Explorer beta is fully functional , Some changes to interface.

SoftICE, the Advanced Windows Debugger, is the only "all purpose" debugger for C/C++, ASM programmers developing for Windows NT and Windows 95/98. Solving complex Windows problems requires a deeper view into Windows internals. Unlike conventional SDK/DDK tools, only SoftICE gives the absolute system-wide control and visibility programmers need to fix tough software application/system-level problems. With SoftICE, programmers can view, explore or debug any EXE, DLL, device driver or system component with powerful, reliable, source/kernel-mode debugging on a single PC.

This tool is an experimental open source project entirely written in Win32ASM. We figured out that it currently only runs under Windows98, Windows ME has not been tested yet.

FrogsICE is able to defend almost all Anti-SI tricks and hide Soft Ice (big thx to +Frogs's Print for that tool!). Just 2 well known ways still exist: the BoundsChecker interface and 'Soft Ice's Backdoor Commands'. Both are executed by Int 03 that can't be hooked when SoftIce is in memory :( and FrogsICE can't detect them. This tool modify WinIce.ExE and switch the BoundsChecker Interface and 'Back Door Commands' off. The progy create a backup of the original WinIce.ExE to WinIce.ExE.org. It should work with all SI-Version (tested on v4.01).

This tool is useful in bypassing anti-softice code which checks the offset between int1 & int3 to detect the presence of SoftICE.

With the ever increasing number of programs that employ some form of winice detection it is our hope to provide you with at least a basic protection against these methods. Do not expect too much from this little tool as there are really countless ways of both detecting and crashing winice...

Generic extension for SoftICE for Win9x and NT. nticedump supports dumping and Bhrama only. Implemented as an internal Winice/NTice command (PAGEIN). Subcommands: dump memory to file, load file into memory, dump via Bhrama/Procdump, dump winice screen to file, suspend/resume thread/process, set page table entry flags, change FPU registers, start/stop playing tracks on CD, start/stop playing mp3 songs, print usage info... Parser accepts expressions whereever possible.Supports V86, ring-3/16, ring-3/32 and ring-0/32 protected mode clients whenever possible. Fool-proof internal parser (but do RTFM ;-). - Sources are included.

New Features : PEDUMP can coagulate rsrc and has better compatibility (G-RoM) , PROTECT hides REGMON and FILEMON VxDs as well (hint from Blackbird) , Tracer emulates a VTD service.

SoftICE loader doesn't work with certain packed files. This litle program puts CC (which is the opcode for Int03) at the entry point of all PE files. Now you can set a breakpoint "bpint 03" and your problem is solved.

FrogsICE is a VxD (Virtual device driver for Windows, just like a good old TSR for DOS). It allows you to intercept programs (exe or COM, DOS/Win16 or Win32) which would try to detect if SoftICE is loaded. It is particularly useful for packed/encrypted programs.

New Features : Misc changes & fixes, Re-enforced protections, Full "Bit-arts support".

This utility is a small loader designed to load Winice on Windows Millennium, without the need of the checked build of io.sys, which is part of the Millennium DDK, and is not freely available yet.

SoftSnoop is a small debugger which uses the Debug API's to show the normal debug events. SoftSnoop is also able to spy the API calls of a given process. It's full written with VC++6.

New Features :BPMs , Support for some rare Win95 version added , Api return value modification , Thread handling stuff recoded , BPXs can now automatically be restored after execution , GUI updated , Install shell extension , One can avoid SS from trapping the calls to specific dlls , Stop at the EntryPoint , Show TID of events , Plugin interface updated , Several bugfixes

This is a tool for converting a small part of a program into assemblycode that you could paste into your own sources. The program takes either a fileoffset or a virtual address as input and starts to disassemble from that point. When a conditional jump is reached, it branches and follow both directions. It also follows unconditional jumps and traces calls.

New Features : Fixed bugs for those dissam command : xchg eax,ebp and eax,[Immediate] , Linked with an own-coded WinMain-caller, reducing the size by 10KB , Interface shrinked to fit 800*600 resolution.

TRW2000 is an advanced system-level debugger which runs under Windows 9x. What does "system-level" mean? It means that TRW2000 sits between the Operating System and the your computer's hardware. Because of this, TRW2000 can debug and trace any code that is running under Windows (DOS .COM Programs, DOS .EXEs, DOS protected mode programs, old 16-bit "NE" executables, new 32-bit "PE" executables, and even executables that run at Ring 0 (the Windows Kernel, device drivers, VxDs, etc...) including other system-level debuggers!!!

New Features : Fixed [ebp-4] data error, Fixed PS2 mouse drag bug , Fixed DOS address bug.

It's a great disassembler. Supports Windows 32Bit PE, 32Bit LE, 6Bit NE format and other formats. Integrated debugger, exported functions, imported functions and string data references.

This patch is intended for W32Dasm v8.93. It does the following - Add Syntax Highlightin by Cold Coder , Add Let you add comment by Cold Coder , Add Auto vb patch by Cold Coder(base on Dread'S VB SDR) , Add Search Improvement by Cold Coder , Add CommandLine Function by Harlequin , Add Recent Files List by Harlequin , Add Quick Edit by Harlequin , Add Permenant Patcher by Harlequin , Add Write Enable Patch by LaZaRuS.

This package consists of all the add-ons made by Harlequin for Win32Dasm 8.93 . It includes W32Dasm Disassembled and some more patches and essays which show us how the extra features were added. A very very useful addition to the great Win32Dasm.

This is a patch for Win32Dasm Version 8.93 which adds some versy useful functions to this already amazing program. This is an updated version of one of the files conatined in the above package.

New Features : Fixed the ug due to which the PGUP, PGDWN and cursor did not work in W32Dasm.

Win32 Program Disassembler is a straight line disassembler of Windows 32-bit executables (i.e. PE). The program works in console mode (no graphical interface). Win32PD appears to understand switch statements as it does not get tripped up by the pointers. It also decodes Win32 API calls. No disassembly of the data section is done, but string statements are emitted where appropriate. This disassembler does not support symbols in PE files.

DeDe is a very fast program that can analize executables compiled with Delphi 3,4,5 and give you the following: - All dfm files of the target. You will be able to open and edit them with Delphi. - All published methods in well commented ASM code with references to strings, imported function calls, classes methods calls, components in the unit, Try-Except and Try-Finally blocks. - A lot of additional information. - You can dump and process packed/crypted application direclty from memory. - You can create a Delphi project folder with all dfm, pas, dpr files.

New Features : Class emulator improved , Added plugin support. DeDe SDK ver 1.0 beta included ! Simple test plugin with sources included , DCU2INT output changed and DCU.2.DSF engine improved.

FOXDCOMP is a program reads a precompiled Foxbase program and recreates the original program source. This is an essential utility for the Foxbase environment that can be used for the following purposes: - Recreating lost, unavailable, or destroyed source code. This will allow modifications to an existing system without starting from scratch. - As an aid in understanding a purchased compiled package that was delivered without source code. This can be a very useful tool when adding a customized front-end to a purchased compiled system. - To view the source code of professionally-developed systems in order to learn programming techniques used to create efficient, reliable, and visually- appealing systems.

Features : Simple DOS command-line operation.Correctly decompiles programs compiled with Foxbase version 2.1 or lower.Written in efficiently structured C language for FAST execution.Fully indented source code is produced.Language keywords are printed in capital letters.Variable name are printed in lower-case.Macros, arrays, user-defined functions, and functions with variable arguments are fully supported.

Decafe is the fastest Win95/98/NT decompiler for Java which reconstructs the original source code from the compiled binary CLASS files (for example Java applets). Decafe is able to decompile the most complex Java applets and binaries, producing accurate source code.

DJ Java Decompiler is a decompiler for Java which reconstructs the original source code from the compiled binary CLASS files (applets). DJ Java Decompiler is able to decompile the most complex Java applets and binaries, producing accurate source code.

This command line tool for Windows extracts Java class files from a .exe created with Microsoft Visual J++.

Jad is a Java decompiler, i.e. program that reads one or more Java class files and converts them into Java source files which can be compiled again. Jad is a 100% pure C++ program and it generally works several times faster than decompilers written in Java. Jad doesn't use the Java runtime for its functioning, therefore no special setup is required (like changes to the CLASSPATH variable).

Disassembler for PCODE programs.It only works for Pcoded programs. It "disassembles" them back to Psuedo ASM.There are some cracking tutorials that comes with it, and a few other assorted programs.

The best VB Debugger from the guys who made SoftIce - Numega.

The WKT debugger is a run-time live debugging. Features include - Supports VB5 and VB6 P-Code compiled applications , Displays a complete list of opcodes and VM API functions, can save the list to a file , Breakpoints on any p-code instructions , Breakpoints on any code address (unlimited) , Can put breakpoints on any Virtual Machine API cal , . Stack viewer, dumps the stack in two different modes: from EBP to ESP or from ESP to EBP.

New Features : Events , methods and properties recognition , TraceX command , Loader bugfix.

The idea for E_WISE comes from ExWise. My version includes reimplemented in Pascal , can handle more WISE-versions , can retrive filenames and date/time.

Features : New versions supported.

This decompiler is used to decompile the script file(setup.ins) included in installshield installations, which contains all the instructions and many of the messages for the installation.

This is an installshield decompiler. It supports all versions of installshield up to v5.5 (as far as I know). Full source included.

This is a slightly extended version of the above Andrew de Quincey's Installshield Decompiler. Version 2 of isDcc prints, by default some additional information for each source line which can be helpful.

New Features : Fixed the problem of isDcc messing up labels , Fixed the bug which printed "string" instead of the modulo sign "%" , Added Cross References for labels.

This is a utility to handle version 6 of the InstallShield cabinet files. Its based on i5comp by -] fOSSiL [-, so, thank him first. Without his excellent work, this one would not exist. All features are present from i5comp. What changed was the data structures only. The decompression routines are handled in ZD51145.DLL .

This is a "disassembler" for Shochwave Flash Movies ( SWF ).Its lets you load them and save all sound streams, sound events , jpegs, movies and shows you the actions in the movie frame by frame.It is a very usefull tool.It can also unlock protected movies and set them as screensavers.

Caller is a 32-bit console application to assist in the reverse engineering of Fortran programs. Caller generates call trees and variable lists. The output is in either text or HTML for easy linked navigation. Caller can optionally annotate the call tree with comment information (eg "DESCRIPTION") from the original source file.

palmdeMON is a disassembler, resource viewer and eventuallly integrated debugger for the 3Com Palm Pilot, Handspring Visor and derivatives.

New Features : Fixed support for uncompressed bitmaps, and improved bitmap preview dialog , Added PRC history menu items to File menu , Minor GUI enhancements , Added 'Find string' functionality for disassembly view.