[General] ; All utilites list: http://www.ntcore.com/utilities.php Name=NTCore Utilities GroupCount=4 SoftwareCount=12 [Group0] Name=System Utilities [Group1] Name=PE Utilities [Group2] Name=Other Utilities [Group3] Name=All Utilities ShowAll=1 [Software0] exe=x86\FilterMon.exe help= url=http://www.ntcore.com/filtermon.php exe64=x64\FilterMon.exe group=0 AppName=Filter Monitor ShortDesc=This utility can list kernel mode filters and also unregister them LongDesc=This utility can list kernel mode filters and also unregister them. Monitored filters are, for instance, registry filters, create process and thread notifications. FilterMon comes both for x64 and x86 and it should work on all Windows systems from Vista RTM to Windows 7 RTM. I can't guarantee that it will work on future versions of Windows as it relies heavily on system internals. [Software1] exe=DriverList_x86.exe help= url=http://www.ntcore.com/drvlist.php exe64=DriverList_x64.exe group=0 AppName=Driver List ShortDesc=Very small utility which lists the loaded drivers LongDesc=Very small utility which lists the loaded drivers. The utility is 64-bit compatible and can generate a report file from the list. [Software2] exe=VirtualReg Manager.exe help= url=http://www.ntcore.com/vreg.php exe64= group=2 AppName=VirtualReg Manager ShortDesc=Creates virtual registry files and is also able to edit them through a regedit-like interface LongDesc=VirtualReg Manager is a utility which creates virtual registry files and is also able to edit them through a regedit-like interface. It provides command line support for automation. Feel free to include this application in your freeware. Since it's a .NET assembly, it works on every Windows platform. [Software3] exe=DynLogger.exe help= url=http://www.ntcore.com/dynlogger.php exe64= group=1 AppName=DynLogger ShortDesc=Logs all dynamically retrieved functions by reporting the module name and the requested function LongDesc=DynLogger logs all dynamically retrieved functions by reporting the module name and the requested function. It can come very handy when one wants to know a "hidden" function used by an application. I recycled the code of a bigger project to write this little application. It's a very small utility, but it might be of use after all. It was tested on XP and Vista, both x86 and x64. It works for .NET application as well. Just start the logging process, the log will be saved after you quit the monitored application. [Software4] exe=Vista4Experts.exe help= url=http://www.ntcore.com/vista4experts.php exe64= group=0 AppName=Vista4Experts ShortDesc=Kind of a treat for computer experts who don't want security notifications LongDesc=Vista4Experts is kind of a treat for computer experts who don't want security center notifications, User Account Control dialogs, automatic Windows Defender scannings, automatic update installations (which cause you to reboot your system if you don't react quickly enough). People who want MSDN (or google) set as default search engine in the Internet Explorer search bar, who want the start menu power button to shut down the system instead of hibernating it, etc. These and many more fixes are included in Vista4Experts. All of these changes can be discarded, enabled or reversed. Vista4Experts is first the expert utility of its kind and works on every platform. [Software5] exe=4gb_patch.exe help= url=http://www.ntcore.com/4gb_patch.php exe64= group=1 AppName=4GB Patch ShortDesc=Patches x86 executables in order to let them have 4GB of virtual memory on x64 platforms LongDesc=This very little tool patches x86 executables in order to let them have 4GB (instead of only 2) of virtual memory on x64 platforms. This tool comes very handy for applications which need a great amount of virtual memory like games, 3D renderization, multimedia etc. To gain these 2GB, you just have to use this tool to patch the executable (*.exe file) of the software you want to have these additional GBs of virtual memory. It can be used by clicking on it and choosing the file or through command line (e.g.: "4gb_patch file.exe"). It automatically creates a backup copy of the original executable. [Software6] exe=PE Detective.exe help= url=http://www.ntcore.com/pedetective.php exe64= group=1 AppName=PE Detective ShortDesc=A freeware PE identifier LongDesc=A freeware PE identifier. This tool was originally designed to be part of the Explorer Suite II, but it can be downloaded separately as well. The PE Detective can scan single PE files or entire directories (also recursevely) and generate complete reports. The PE Detective is deployed along with the Signature Explorer, which is an advanced signature manager to check collisions, handle, update and retrieve signatures [Software7] exe=WIM Installer.exe help= url= exe64= group=0 AppName=WIM Installer ShortDesc=In a extremely easy way setups based on wim images LongDesc=A little utility created to handle from a graphical interface and in a extremely easy way setups based on wim images. Regardeless if they have been released by microsoft or not. [Software8] exe=NETUnpack.exe help= url=http://www.ntcore.com/netunpack.php exe64= group=1 AppName=.NET Generic Unpacker ShortDesc=Dump .NET packed applications LongDesc=This is a program to dump .NET packed applications. Of course no serious .NET protection relies on packing. In fact, this software shows how easily you can unpack a protected assemly. This .NET Generic Unpacker was written in a couple of hours and despite of the fact that it's very simple, it might turn useful having it: otherwise you have to unpack manually, which is also very easy. [Software9] exe=SNSRemover.exe help= url= exe64= group=1 AppName=SNSRemover ShortDesc=Removes the Strong Name Signature from .NET Assemblies LongDesc=This tool removes the Strong Name Signature from .NET Assemblies. I had to code it since all the other tools over the internet didn't work correctly with the new .NET Framework 2.0, which was released a couple of days ago. This tool was coded in plain win32, so like the CFF Explorer it doesn't need the framework to run. [Software10] exe=awfp.exe help= url= exe64= group=0 AppName=AntiWFP ShortDesc=The Anti-WindowsFileProtection LongDesc=The Anti-WindowsFileProtection [Software11] exe=CFF Explorer.exe help= url=http://www.ntcore.com/exsuite.php exe64= group=1 AppName=CFF Explorer ShortDesc=CFF Explorer was designed to make PE editing as easy as possible LongDesc=The CFF Explorer was designed to make PE editing as easy as possible, but without losing sight on the portable executable's internal structure. This application includes a series of tools which might help not only reverse engineers but also programmers. It offers a multi-file environment and a switchable interface. Also, it's the first PE editor with full support for the .NET file format. With this tool you can easily edit metadata's fields and flags. If you're programming something that has to do with .NET metadata, you will need this tool. The resource viewer supports .NET image formats like icons, bitmaps, pngs. You'll be able to analyze .NET files without having to install the .NET framework, this tool has its own functions to access the .NET format.