[Tool] Mask/Pattern Builder

[LilGho$t]

So, i got bored and decided to release a really simple mask/pattern builder.

Really simple (16 lines and could be made less), so i didn't bother to obfuscate. I'm sure someone else has made this before, but i decided to make my own anyways xD Basically you input the old bytes & then input the new bytes and then simply press "build mask/pattern". Really made this for lazy people like me.

Image:


Virus Scans:
https://www.virustotal.com/file/ea4e...is/1360375653/

Byte Mask Builder.zip - Jotti's malware scan

As a heads up, when entering in the bytes, make sure they're separated by a space.

[Skaterforeva1]

@Flengo approve please

so basically this is just sig maker plugin for ollly just external?

[LilGho$t]

@Flengo approve please

so basically this is just sig maker plugin for ollly just external?

Didn't know olly had one, but if olly does, then i would assume they're very similar.

[[SMA] Paradise`]

File seems clean.

/Approved.

[Skaterforeva1]

Didn't know olly had one, but if olly does, then i would assume they're very similar.

https://www.mpgh.net/forum/207-combat..****-update.html

yupps pretty much the same well nice work anyways!

[LilGho$t]

https://www.mpgh.net/forum/207-combat..****-update.html

yupps pretty much the same well nice work anyways!

Well damn xD Oh well, good learning experience anyways.

[RobinC]

Nice release! Less work for me .

[Ch40zz-C0d3r]

lol this is very easy and I think not the best way.
Olly plugin is using good knowledge and doesnt need old bytes.
You simply create the pattern like this:

if(tx1.char[0] == tx2.char[0]) 
     tx3.text.add("x"); 
else 
     tx3.text.add("?");

[Genesis]

Looks like a pretty decent program, nice work.

[LilGho$t]

lol this is very easy and I think not the best way.
Olly plugin is using good knowledge and doesnt need old bytes.
You simply create the pattern like this:

if(tx1.char[0] == tx2.char[0]) 
     tx3.text.add("x"); 
else 
     tx3.text.add("?");

You don't say? Actually not quite because i stored as an instance variable and then set the text = to that variable at the end so if you were doing a long one you wouldn't see them appearing 1 at a time. That being said, I never said i was trying to compete with the olly plugin. By all means, the olly plugin seems excellent (i haven't used it myself just yet, but it looks nice). However, i don't appreciate you trying to degrade what i threw together and released. Also, if you'd like to see the entire code (in all of it's 16 lines of vb.net glory) feel free to ask instead of posting your attempt (which is actually not correct).

[Ch40zz-C0d3r]

You don't say? Actually not quite because i stored as an instance variable and then set the text = to that variable at the end so if you were doing a long one you wouldn't see them appearing 1 at a time. That being said, I never said i was trying to compete with the olly plugin. By all means, the olly plugin seems excellent (i haven't used it myself just yet, but it looks nice). However, i don't appreciate you trying to degrade what i threw together and released. Also, if you'd like to see the entire code (in all of it's 16 lines of vb.net glory) feel free to ask instead of posting your attempt (which is actually not correct).

That wasnt an attempt, it was wrote in less then 4 seconds, because I know how patterns work.
You should focuse more on the asm rules and remove the second textbox.
At all, this is just my thought, you dont need to get angry like that.

[ZysorceN]

lol this is very easy and I think not the best way.
Olly plugin is using good knowledge and doesnt need old bytes.
You simply create the pattern like this:

if(tx1.char[0] == tx2.char[0]) 
     tx3.text.add("x"); 
else 
     tx3.text.add("?");

byte don't need to match to generate the signature also 00 can change over patches so those will also be ? and ur pseudo code isn't acurate so i wouldn't have posted it if i was you

[demtrios]

wow Nice

[R4v0r]

Could use some more work, furthermore good job . You should add some crap and release v2.0

[Departure]

olly plugin and this does 2 completely different things, olly plugin analyses the op code to determine if the there is a pointer, it replaces these pointer and references with wild cards, you can't have pointer addreses/reference ect.. in a byte pattern as it will change each time, the plugin also scan the section for any other sequence of bytes that is the same, actually the olly plug in is pretty advanced. The one posted here replaces strings if there is a match, can be useful for the lazy people.

good job, but like you said it is no replacement for olly plugin.... these are 2 completely different things