Sothink AoB finder

This program generates the AoB from the raw data put in it.
works perfectly with a copy & paste from sothink

[attachment=0:mtqzhsak]S0th1nk C0d3 F1nd3r.rar[/attachment:mtqzhsak]

Update Log:

Version 1.00 - first release
Version 1.10 - fixed the space bug and included
Version 1.15 fixed the bug on the other textbox (silly me :D)

for example, if you put in

//d0
_as3_getlocal <0>
//66 bd 08
_as3_getproperty _root
//62 05
_as3_getlocal <5>
//66 af 01
_as3_getproperty x
//62 05
_as3_getlocal <5>
//66 b0 01
_as3_getproperty y
//24 64
_as3_pushbyte 100
it would give you

d0 66 bd 08 62 05 66 af 01 62 05 66 b0 01 24 64
Virus Scan:
original: http://www.virustotal.com/file-scan/report.html?id=08834af8b355215f61aeb530f43bc208b78a119039dfd2061f92693e4ce031a2-1289640776
File name:
S0th1nk C0d3 F1nd3r.exe
Submission date:
2010-11-13 09:32:56 (UTC)
Current status:
queued queued (#3) analysing finished
Result:
0/ 41 (0.0%)
   
VT Community

not reviewed
 Safety score: -
Compact
Print results
Antivirus    Version    Last Update    Result
AhnLab-V3   2010.11.13.00   2010.11.12   -
AntiVir   7.10.13.235   2010.11.12   -
Antiy-AVL   2.0.3.7   2010.11.13   -
Authentium   5.2.0.5   2010.11.13   -
Avast   4.8.1351.0   2010.11.12   -
Avast5   5.0.594.0   2010.11.12   -
AVG   9.0.0.851   2010.11.12   -
BitDefender   7.2   2010.11.13   -
CAT-QuickHeal   11.00   2010.11.09   -
ClamAV   0.96.4.0   2010.11.13   -
Comodo   6703   2010.11.13   -
DrWeb   5.0.2.03300   2010.11.13   -
eSafe   7.0.17.0   2010.11.11   -
eTrust-Vet   36.1.7973   2010.11.13   -
F-Prot   4.6.2.117   2010.11.13   -
F-Secure   9.0.16160.0   2010.11.13   -
Fortinet   4.2.249.0   2010.11.12   -
GData   21   2010.11.13   -
Ikarus   T3.1.1.90.0   2010.11.13   -
Jiangmin   13.0.900   2010.11.13   -
K7AntiVirus   9.67.2973   2010.11.12   -
McAfee   5.400.0.1158   2010.11.13   -
McAfee-GW-Edition   2010.1C   2010.11.12   -
Microsoft   1.6301   2010.11.13   -
NOD32   5616   2010.11.13   -
Norman   6.06.10   2010.11.12   -
nProtect   2010-11-13.01   2010.11.13   -
Panda   10.0.2.7   2010.11.12   -
PCTools   7.0.3.5   2010.11.13   -
Prevx   3.0   2010.11.13   -
Rising   22.73.03.06   2010.11.12   -
Sophos   4.59.0   2010.11.13   -
Sunbelt   7296   2010.11.13   -
SUPERAntiSpyware   4.40.0.1006   2010.11.13   -
Symantec   20101.2.0.161   2010.11.13   -
TheHacker   6.7.0.1.083   2010.11.13   -
TrendMicro   9.120.0.1004   2010.11.13   -
TrendMicro-HouseCall   9.120.0.1004   2010.11.13   -
VBA32   3.12.14.2   2010.11.12   -
ViRobot   2010.11.13.4145   2010.11.13   -
VirusBuster   12.75.1.0   2010.11.12   -
Additional information
Show all
MD5   : 9cc092b7f0175f77c69c7367e10c4399
SHA1  : 1727a74169845c75cee3d4fd6ed7744b2e046e20
SHA256: 08834af8b355215f61aeb530f43bc208b78a119039dfd2061f92693e4ce031a2

please give feedback!  (broken image removed)

Version 1.00 :[attachment=2:mtqzhsak]S0th1nk C0d3 F1nd3r.rar[/attachment:mtqzhsak]
Version 1.10 :[attachment=1:mtqzhsak]S0th1nk C0d3 F1nd3r.rar[/attachment:mtqzhsak]

You again...

You again...

yes...
sorry about last time but this time i am trying to help!

make it have a 3rd and 4th textbox

3rd textbox takes as input a string AoBTitle
4th textbox displays as output

[b]AoBTitle[/b]
AoB Search Val
AoB Replace Val

this way you can direct c&p to the board without needing to do anything. and its only one cp

make it have a 3rd and 4th textbox

3rd textbox takes as input a string AoBTitle
4th textbox displays as output

Code: [Select]

[b]AoBTitle[/b]
AoB Search Val
AoB Replace Val

this way you can direct c&p to the board without needing to do anything. and its only one cp

nice idea!
working on it!

Actually, if you put in:

   //d0
    _as3_getlocal <0>
    //66 bd 08
    _as3_getproperty _root
    //62 05
    _as3_getlocal <5>
    //66 af 01
    _as3_getproperty x
    //62 05
    _as3_getlocal <5>
    //66 b0 01
    _as3_getproperty y
    //24 64
    _as3_pushbyte 100
It gives you out:

 //d0  //66 bd 08  //62 05  //66 af 01  //62 05  //66 b0 01  //24 64

This post was imported from an account that no longer exists!
Previous Name: phreneticus

Actually, if you put in:

Code: [Select]

   //d0
    _as3_getlocal <0>
    //66 bd 08
    _as3_getproperty _root
    //62 05
    _as3_getlocal <5>
    //66 af 01
    _as3_getproperty x
    //62 05
    _as3_getlocal <5>
    //66 b0 01
    _as3_getproperty y
    //24 64
    _as3_pushbyte 100

It gives you out:

Code: [Select]

 //d0  //66 bd 08  //62 05  //66 af 01  //62 05  //66 b0 01  //24 64

yeah - i'll have to fix the space bug - working on it XD

yeah - i'll have to fix the space bug - working on it XD

There also shouldn't be any of these "//".

This post was imported from an account that no longer exists!
Previous Name: phreneticus

I think hes not using regex

//(([a-zA-Zd]{2}s*)+) just off the top of my head ....capture group 1 will be the whole match, capture group 2 will be the last byte in the line,

updated with the space bug fixed and including the idea from sataniccgurll

updated with the space bug fixed and including the idea from sataniccgurll

Thanks mate, it's quite useful for long AoBs. Karma for you! (broken image removed)

This post was imported from an account that no longer exists!
Previous Name: phreneticus

just a trival problem but
in the second window i see

d066 bd 0862 0566 af 0162 0566 b0 0124 64as output for

   //d0
    _as3_getlocal <0>
    //66 bd 08
    _as3_getproperty _root
    //62 05
    _as3_getlocal <5>
    //66 af 01
    _as3_getproperty x
    //62 05
    _as3_getlocal <5>
    //66 b0 01
    _as3_getproperty y
    //24 64
    _as3_pushbyte 100
anyways this is def usefuls man, but for the issue above. also if you could add bbcode to the title oh and a copy to clipboard button.
ETA: even better would be copy to clipboard when you click the box.

just a trival problem but
in the second window i see

Code: [Select]

d066 bd 0862 0566 af 0162 0566 b0 0124 64as output for

Code: [Select]

   //d0
    _as3_getlocal <0>
    //66 bd 08
    _as3_getproperty _root
    //62 05
    _as3_getlocal <5>
    //66 af 01
    _as3_getproperty x
    //62 05
    _as3_getlocal <5>
    //66 b0 01
    _as3_getproperty y
    //24 64
    _as3_pushbyte 100

You have to remove the spaces on the left.

This post was imported from an account that no longer exists!
Previous Name: phreneticus

just a trival problem but
in the second window i see

Code: [Select]

d066 bd 0862 0566 af 0162 0566 b0 0124 64as output for

Code: [Select]

   //d0
    _as3_getlocal <0>
    //66 bd 08
    _as3_getproperty _root
    //62 05
    _as3_getlocal <5>
    //66 af 01
    _as3_getproperty x
    //62 05
    _as3_getlocal <5>
    //66 b0 01
    _as3_getproperty y
    //24 64
    _as3_pushbyte 100
anyways this is def usefuls man, but for the issue above. also if you could add bbcode to the title oh and a copy to clipboard button.
ETA: even better would be copy to clipboard when you click the box.

I will look into those ideas

and will try to fix the bug (broken image removed)
was it in the replace part? if so i might have missed something out there that i put in the other one

(lol, all these bugs only happen with raw data from the AS2 script XD)

EDIT:
Bug fixed - working on te improvements

well I hope you dont think I am stepping on your toes or anything, but I went ahead and made a knockoff with some of the features I had wanted.

added optional highlighting to help distinguish the hex from the pcode.
added optional BBCode
added a copy to clipboard button
added "NOP selection" to edit pane's context menu


http://www.forceprojectx.co.cc/services/rawdata

[spoiler=screenshot:9ua3ur1y](broken image removed)