ASM Utils Debuggers File Editors File Utils Network Tools Reference System Utils Virus Tools

N E W: Map2Map + MM 7.06 | Downed "Firelli" cache site reincarnated 7.15

assembly language utilities

A86 DOS 177629 version 4.02 : One of the more popular shareware assemblers, with a companion debugger available; comes with a lot of documentation. Only for 16-bit applications unless you buy the registered version.

ASM Environment DOS 119231 version 1.9 : An Integrated Development Environment done in the style of Borland's DOS "turbo" IDEs. Very good, actually; full windowing and mouse support, ASCII table, hex calculator, integrated compiler/linker calling, plus menu "shortcuts" for common opcodes.

ASM Laboratory DOS 170259 version 1.0 : Another IDE, again not badly done: simpler than ASMEnv, a little easier to use, with the same ASCII/HexCalc funtions and a limited "heuristic scan" that checks your source code for errors (apparently only missing "ret's" at this point; the author seems to have rushed this one out due to unforseen circumstances). One edge over ASMEnv is the source code colorizer. Warning: sets off virus detectors (notably TBAV).

ASM32 DOS 480469 Protected-mode flat address .ASM programming library for use with DPMI or the Causeway DOS Extender.

Cheap Assembler DOS 105747 version 4.0 : Old Assembler (1983) that is intended for beginners --"to learn on"--and comes with an assembly language primer. Good tool to play with when starting up, but does not have the functionality to keep up with modern (not to mention object-oriented) assemblers.

Magic Assembler DOS 27656 version 1.10 : A freeware assembler that seems fairly limited. Its bonus points: it is tiny (74K for the whole package) and has a simple compiling function (with some succinct instructions) to code the boot sector on a floppy--i.e., write your own bootup routines.

MASM Help DOS 16039 A collection of non-Microsoft tools to use with MASM (Makecom.bat, Makeexe.bat, Makesys.bat) as well as ASM templates (COM and EXE), 2 include files with pre- defined symbolic constants, and documentation of the DOS and BIOS services.

Microsoft Assembler DOS Size version 6.11 : Includes Masm, Link, Make, CodeView, file header and compression utilities, and library manager.Down Version 5.1 available.

Netwide Assembler DOS 189819 A freeware 32-bit assembler that supports Intel processors up to the P6, Pentium Pro, and MMX series. Comes with sufficient documentation and a disassembler; this seems a good tool--still in prototype stage, though--but as its syntax is different from MASM and TASM I'll admit I haven't spent much time testing it. Source code is available on the net and the program itself is designed to be "modular"--i.e., you can program it into your own utilities, change the source, etc.. Comes with good docs and some samples. The Netwide Assembler Project can be found here, including updates to the assembler and even a Linux disassembler!

Norton ASM DOS 108633 Companion disk for Peter Norton's Assembly Language For The IBM PC (the classic). Contains step-by-step examples of how to build your own hex editor in assembly; with the book, a very good intro to programming in ASM that has been in publication so long it ought to become public domain.

Turbo Assembler 16-bit DOS 299552 version 1.01: Includes the Tasm executable.

Turbo Assembler 32-bit DOS 221561 version 5.0 : Includes the Tasm32 executable and a 32-bit DOS extender.

Turbo Linker DOS 324884 version 2.0 : Includes the TLink executable.

Windows ASM Win16/32 504408 The source code disk for Barry Kauler's Windows Assembly Language and Systems Programming book; contains good examples of 16/32-bit Windows Assembly Language programming. The book is excellent and highly recommended, but is hard to find and a little steep at its US$44.95 retail price. Source code for the first edition is available.

debuggers & disassemblers

Borland Resource Workshop Win16/32 844469 Resource Editor for Win16/32 files; recompiles binary with new resource information.

Brand-X Debugger DOS 24512 version 2.6 : Old (1987) but capable debugger; we can safely assume it will not handle protected mode, however as a quick-and-easy DOS debugger it does alright.

Build SYM DOS 50841 Borland Symbol (SYM) file builder. Package includes buildsym, exemap, mapsym, and tmapsym.

Map2Map Perl Script 2035 Version 2.0: A utility for converting IDA-output MAP files to mnsym.exe-input MAP files. Requires Perl. Courtesy of Gij. New! mm.zip is an executable version of Gij's Map2Map. Courtesy of Buldozer.

PES-2-IDC DOS 94803 "PE-Strings-to-IDC-script" translator. Creates string enumerations in IDA for PE files. Courtesy of Spyder.

Resource Edito Win16/32 1858427 Symantec Resource Studio is both 16 and 32-bit, plus it has virtually all of the essential functionality of BRW (some of it you may have to "hunt" for, the UI is different). Excellent for creating/ viewing/ modifying/ deleting icons, bitmaps, strings, dialog boxes, cursors, and fonts in existing binary files or in uncompiled resource scripts.

SoftDump DOS 44090 Utility for dumping memory from Soft-Ice; courtesy of Quine.

Sourcer DOS 264623 The "commenting disassembler." Some people like it, some people don't. I like it, but think W32DASM is better.

StepDOS DOS 19088 An excellent file-monitoring utility that doubles as a poor man's debugger: this program loads an application and breaks at every system call, providing a pop-up window with a register dump and options to skip the current function, execute the function and display the return code, and continue executing the application non-stop.

Trace DOS 98912 DOS debugger that claims to replace debug, symdebug, turbo debugger, codeview, and even softice. Has register, data, and code displays. Very nice.

Turbo Debugger DOS/Win16/32 1611386 Console-mode application debugger from Borland. Supports DOS, Win16, and Win32 executables.

VB Disassembler Win32 1350032 Visual Basic disassembler. Courtesy of Revolt.

Win32DASM Win16/32 855747 16/32-bit Windows disassembler and a (limited) debugger: you can--if you feel so inclined--trace through the code. Put the output from this thing into a source-code-coloring editor like Multi-Edit and you will have a blast.

Windows CodeBack Win16 103349 An excellent 3-pass disassembler for Windows 3.1 files. Provides imported/exported modules, GPF handlers, Windows API function calls, and a disassembled listing. Apparently there is a Win32 version in beta testing.

Windows Disassembler Win16 102803 An OK Windows 3.1 disassembler; its main interest lies in the hilevel.exe utility that sometimes provides C-source for a 16-bit disassembled file (other times it just gives compiler errors).

file editors

Binary Editor DOS 389222 Andy's Folding Binary Editor, courtesy of Andy.

EditPack Win32 107702 Hutch's QEditor and the infamous Hiew bundled with a .REG file to tie them to the context (right-click) menu for any (*.*) file.

Game Wizard DOS 271382 Game cheating/patching utility, runs in DOS only. A must for video game freaks...

Hacker's View DOS 397139 An excellent Hex editor with text (ASCII) and code (disassembly) modes, search capability, show/hide carriage return and line feed toggle, and file header display.

HED Win32 125519 A surprisingly good hex editor with an equally suprisingly horrible file-open dialogue box (files are not listed alphabetically...I recommend using drag-n-drop to load). In addition to the standard macros, ASCII table, and hex calculator, this file gets bonus points for its "Fixups" menu: listings of imported names/ordinals, exported names/ordinals, and internal references/ ordinals. As if this weren't enough, this editor provides a disassembled listing and excellent search/replace functions.

PS Edit DOS 67308 Small DOS hex editor

QEditor Win32 GUI 53216 Small, fast, with user-configured add-in tools and help files; a handy editor. Allows command-line and Explorer access, and comes with a tiny Notepad replacement. Courtesy of Hutch.

QuickView DOS 169126 Quick View: Hex editor remarkable similar to Hiew, same inherent functionality.

UltraEdit Win95 GUI 601918 A good hex/text editor with features such as Mac-UNIX-DOS conversion, user-added tools and help files, spell checking, searching and other useful functions. Fully customized version with opcodes.hlp replacing the standard (read: useless) uedit help file.

XED DOS 168748 An even better (and bigger) Hex editor with improved functionality over HIEW and a much nicer interface.

file utilities

2M DOS 403917 Utility to make all of your floppies store 2 Megabytes.

Data Crack Engine DOS 16384 Excellent crack engine; allows you to include patches for multiple files in one crack.exe. Courtesy of Pirate1.

Debug File Dump DOS 57265 Utilities for viewing debug file information. Includes dumpw4, dumppdb, and dumpcv.

Dump Bin Win95 Console 522593 Useful file dumping utility from Microsoft VC++ 5.0 with requisite DLLs. Displays symbol, import, export, relocation, section, header, and summary data, as well as disassembly and other info. Package includes dumpbin, editbin, link, and remap.

DumpExe DOS 39478 A TSR utility that can be used to unpack .exe files. Requires a bit of work to set up: input for the program includes the CS, IP, SS, SP, the size and name of the file, and the file's PSP. Once the file is dumped the included MAKEEXE program can be used to create an unpacked version of the file. The documentation includes instructions on using a debugger (in this case TD.EXE) to unpack an compressed executable.

Dump LX Win16/32 42237 Utility for viewing the contents (modules, entry points, etc) of Linear Executables (VXDs) in Windows 3.1 and 95. Exactly like examining the VXD in Soft-Ice; output can be redirected.

Dump NE Win16 50105 Utility for viewing the content (resources, modules, entry points, imports, exports, segmentation) of a 16-bit binary file. Successfully tested with Kernel386.exe, Moricons.dll, and winfile.exe.

Dump PE Win32 25942 Utility for dumping the content (resources, modules, entry points, exports, imports) of a PE binary file (32-bit .EXE or .DLL). I successfully tested this with Kernel32.dll, Curves&Colors.scr, and mkcompat.exe.

Far Manager DOS 472604 Console-mode File and Archive Manager for zip, arj, rar formats. This is a very useful util that allows you to browse directories and archives ina tree-view; files may be viewed in hex or text and editted in text, or can be configured to use an external viewer/editor.

Fast Zip Cracker DOS 46676 PKZip file cracker for password-protected zip files.

File Sniffer DOS 9699 A DOS application that provides a listing of the interrupt calls and scan/compare string byte calls in a file; output can be redirected.

FileDump DOS 1093 Provides a hex dump of any file, but redirection to a file does not work so well. Unless you consider pages of hexidecimal numbers rolling up your screen to be high entertainment, use only for printing or if your hex editor is broken.

MiniChainer DOS 40905 Chain/join files

Nowhere Utilities DOS 106620 The old (1992) and famous set of Nowhere Man's h/c/v utilities! Files included are: cipher, cryptcom, dbgscrpt, decrypt, fakefile, fakeware, fixattr, fixtime, nolzexe, replace, resize, user2txt, and wipe. Most of these are mainly of interest to virus writers and may be a little dated, but they certainly have their uses...

NU DOS 74346 That's right, the old (v 4.5) Norton Utilities for file editing/unerasing. An excellent utility for your obsolete DOS machine; this thing will give you disk error messages if you use it in 95.

PE Info Win95 GUI 1439756 Utility for viewing Imports, Exports, Header, and Resources of PE files. Warning: resource functions can cause crashes.

Peek Win32 11492 A file "peeker", like Quick-View.

PGP DOS 236322 The unofficial standard for data encryption on the internet. This is version 2.62g, with full encryptive (4096) functionality.

PK-Zip Cracker DOS 26280 PK-zip file cracker

Patch-Maker's Toolkit Win95 GUI 47294 Patch creation utility that outputs in either binary data, an asm file of the patch, or in a functional .com file. Very good util, with a license better than GNU's! Courtesy of Hutch.

ReLoc DOS 10262 Relocations handler: moves reolcation table to the end of an executable so that you can encrypt/compress the executable; with full source.

Resource Dump Win16/32 11889 Lists the resources contained in a 16-bit (NE) binary file. Note that this may be a .DLL or .SYS file as well as a binary file, and that there are still 16-bit support files in Win95; I successfully dumped DriveSpace3, moricons.dll and user.exe with this file. Output redirection is suggested as the stuff scrolls by pretty fast.

RTV Reco Win32 18000 Allows you to program buttons on an application to push themselves according to your instructions. Gets rid of very simple nag-screens.

Search and Replace DOS 237312 A (somewhat) quick search/search and replace utility for finding files that contain a certain string. Allows file masking and "touching" (changing the file date/time) of masked files.

S-Tools Win32 278774 Drag-and-drop steganography for the Win95 GUI: open an audio or graphics file in S-Tools, then drag data files in from the Windows Explorer to hide them in the open file. Very handy for sending passwords, source code, virii, cracks, you name it....

String Search DOS/Win16/32 26960 Provides a listing of all of the strings present in a file. Useful for finding exports, functions, and string tables in an executable file.

Symbiote DOS 10067 Symbiote: DOS executable loader, wrapper for an executable with user-programmed "payload" with full source. Courtesy of Greythorne.

TRON DOS 32241 Unpacker for PKLite, TinyProg, Diet, LZExe, ExePack, and Protect-packed files.

VXDLib Win16/32 19393 This utility allows you to decompress VXDs from within Windows 95's binary files so that you can take them apart at you leisure. Also allows you to recompress the VXDs into their standard files in cae any changes were made...

WinDiff Win32 56654 WinDiff is the Windows version of the DOS utility FC: it compares files or directories with a (somewhat poor) graphic representation of the results.

Xenocide's Hacking Utilities DOS 97986 Xenocide's hacking utilities including brute, dzip, fakelog, isprime, netware, passwd, permute, primes, and winsscrk.

network tools

GetAdmin NT 48753 Utility to get admin rights on an NT 4.0 machine. Works only on local password tables. Updates avilable from NT Internals.

IP Prober Win32 GUI 128906 Remote host port prober.

L0pht NT Console 508913 NT password recovery utility. Updates available from www.l0pht.com.

Network Info Win32 GUI 85399 Provides tabs for Local Info, Query (whois), Scanner (port scanner), and Service (status of ervice on remote host).

NTFS-DOS DOS 46199 Mount NTFS partitions for reading from DOS environments. Updates avilable from NT Internals.

Spanner Win16/32 GUI 243374 A near-legendary WinSock troubleshooting tool that allows you to create, open, and close sockets on the fly, as well as sending messages or testing functions over open sockets. Useful for testing out your WinSock theories, testing network connections, or as a "bare bones" network utility.

WS-Ping Win32 GUI 69212 A very good network utility that has ping, host lookup (Whois), and trace (tracert) functions. Small, quick, easy to use.

reference material

Base Calculator Win32 729659 Calculator with binary, octal, decimal, and hexadecimal functions; AND, OR, NOT, NEG, XOR, and EQV macros.

CrackPC DOS 348923 The classic HelpPC program with the Soft-Ice Command Reference incorporated into it.

Edison'95 Win95 40637 Edison's famous Windows 95 cracking tutorial. Warning: sets off virus scanners (TBAV).

Help PC DOS 260616 An on-line programmer's reference with the following sections: Assembler Programming Topics, C Programming Topics, Interrupt Services DOS * BIOS * EMS * Mouse, Tables & Formats use by DOS and BIOS, Miscellanoeus Topics. From 1991 but unbelievably useful. Highly recommended for the serious engineer, cracker, or programmer; not for "visual" developers.

Intel OpCodes List N/A 3MB This reference is a must-have! Every opcode supported by the Intel processors, plus their hexadecimal (machine code) equivalents, registers/flags affected, etc. This is actually volume two of the three volume Intel Architecture Software Developer's Manual, which consists of these three files: Volume 1: Basic Architecture , Volume 2: Instruction Set Reference , Volume 3: System Programming Guide in PDF format.

Win 95 Kernel Documentation Win95 311698 From the Win95 DDK.

OpCodes Help Win95 GUI 47294 Windows help-file format version of opcodes.txt. Suitable for browsing or for adding to your favorite Win95 hex editor (just rename it to the name of the Hex-editor's help file). Courtesy of Hutch.

OpCodes List N/A 113054 Unfortunately, without the actual hex op-codes (machine code); this is more of a reference of assembly-language processor instructions.

Personal Bookshelf Site Link Site Link MCP offers a "personal bookshelf" service that allows you to read (or snatch via Teleport Pro) 5 books online. Granted, this is not the best technical library one could hope for--all SAMS and QUE books, no meat on them--but really one gets what one pays for (and then some).

Soft-Ice Quick Reference Win32 4747 Soft-Ice for 95/NT quick reference.

VxD Documentation Win95 60066 From the Win95 DDK

system utilities

API Vision Win95 GUI 1148729 API Vision API call logging. Function disabled.

API Vision Upgrade Win95 GUI 98846 Adds COMMDLG trapping.

DiskSave DOS 21770 backs up NT 4.0 volumes for future recovery.

DongleSpy DOS 28534 A utility for viewing calls to .DLL files in SentinelSuperPro hardware key ("dongle") protection schemes. I have not yet tested this (I do not have anything protected by a dongle....).

FAT Viewer DOS 25709 Show File Allocation Table provides a visual representation of your hard drive. While it is not inherently useful--statistics on fragmentation and file locations can be obtained more easily using other utilities--it does provide a low-level view of your hard drive for the curious.

FHK95 SDK Win95 107463 Demo SDK for hooking .DLL functions, includes sample code.

File Monitor Win95 GUI 44368 This is a Win32 app that tracks file access on the local machine. Very useful for debugging, cracking, or reverse-engineering an application; also can be used to track system functions. Updates available from NT Internals.

Heap Walker Win95 GUI 73164 Shows statistics about the local heaps allocated to every process currently running. Sorts by Process ID, Module (exectuable file) name, Heap ID, Object Count, and Bytes Free.

Install-Watch Win95 GUI 493076 A utility that backs up your system files and registry brefore an install, then compares your system files, registry, and any user-specified directories to find the changes made by the install. Also works as an excellent un-installer.

KGB DOS 6137 Resident system log utility that tracks calls made by an application.

Map DOS 23959 Memory editor that allows code, hex, and text read/writes of memory locations; shows interrupt vectors, loaded files and their PSP s, and BIOS information, and also allows displayed information to be written to a file. The program remains resident in memory, can be activated with the F10 key. Also gives an overview "map" of system memory and has a simple calculator. Excelsior!

Memory Map DOS 23921 A memory editor that displays memory in a "map" of allocation, allowing you to quickly jump to i/o addresses, loaded programs, system environment, etc.

MemScan DOS GUI 9492 An interesting utility that allows you to visually scan your memory (the first 1MB, in 8K allotments), displaying a segment "map" with the offsets lines vertically (increasing "y"--vertical down--increases the offset by 1, increasing "x"--horizontal left--increases the offset by 128). Segment map represents 1 bit per pixel, and is 64 bits across and 128 bits tall--a "lit" bit (green?) indicates a "true" (1) bit; each byte is comprised of eight horizontal pixels. Controls allow you to coarse-tune (segment 0xxx - Fxxx) or fine-tune (segment +/- 0200h) the view. Have fun.

Norton RegEdit Win95 GUI 116827 Huge if good Windows Registry Editor (expanded is >2MB). Bookmark functionality disabled (read: broken); full searching backup and restore capabilities included.

PC Watch DOS 18150 A DOS monitoring utility that allows you to set breakpoints on interrupts individually or grouped by function (e.g., file access, video display, etc); splits the DOS screen and gives a register dump and a call listing when triggered.

Process Tree Win95 GUI 522239 Excellent system monitor utility showing DLLs and windows used by all active processes, allows "Kill Gracefully" and "Kill Forcefully" actions. Combined with dumpbin.exe from MS VC++ (available above) this provides an excellent interface for viewing imports, exports, disassembled code, and other file info.

Process Viewer Win95 GUI 270726 A tool from the Win95 SDK: allows you to monitor, view, and kill any process running on your system.

ProView DOS GUI 231801 A disk/memory editor that allows absolute reads on memory locations and disks; very well done.

Registry Monitor Win95 GUI 22172 The Windows 95 Registry Monitor logs all Registry accesses in a scrollable window or to a log file. Very handy for finding out what an install does to your system. Updates avilable from NT Internals.

Resource Spy Win95 GUI 177838e Hooks calls to Windows API registry functions.

Scout Win16/95 GUI 62532 An excellent utility for monitoring Tasks, Modules, and Windows. Provides Load, Free ("kill"), Links, Liposuction (no kidding), and Function Exports actions for Modules; Load, Free, Links, and Liposuction actions for Tasks; and Parent, Child, Mail (send Windows Message--very useful!!!!), Mouser (pick with Mouse), and Metrics actions for Windows. Built for Win16, works great in Win95...truly an excellent tool.

Show DOS Calls DOS 4321 Records DOS services calls.

Snoopy Win16/95 GUI 7510 A windows task/message monitor that displays file, module, and process calls in 16-bit windows applications.

Spray DOS 6513 Source code (ASM) for a utility to dump some or all of the first 640K after an application crash. Useful in Win16 systems.

System Info Win95 GUI 63302 An excellent utility task manager/system monitor utility. Built-in process viewer shows all running processes and allows you to view their associated threads, modules, and windows, and provides an option to kill the process. Built-in window viewer shows all open windows and allows you to view information on each window such as process, module, class, parent, and handle; provides options to destroy windows. The task manager is standard and the program also includes a screen capture utility with a functionality reminiscent of SnagIt.

TechFacts95 Win95 GUI 73524 A system monitor brought to you by the same guys who did Infospy. Allows you to monitor processes, modules, threads, windows, heaps, and atoms; to search for files, .DLLs, icons, and strings; to kill a process, unload a module, save/restore CMOS, capture the screen, and ove applications (with full directory structure and Registry keys intact); to view the Registry, edit system/.INI files, and dump your CMOS; to watch disk usage and program access. Very good tools, but I have to admit I really hate the interface: lots of big windows with the MSIE-style toolbar. I'll stick with SysInfo...

Track Memory DOS 9591 Tracks the memory used by an application. This program takes the target application's name as a parameter and returns (when you exit the application) the starting DOS memory, the lowest available memory during the course of the application, and the maximum memory used by the target (i.e., the last two values add up to provide the first one). Output redirection is not possible.

Unauthorized 95 Win95 804994 The disk of utilities and source code for the Unauthorized Windows 95 book, the Developer's Resource edition. The book is largely concerned with interaction between 32-bit Windows, 16-bit Windows, and DOS, and is therefore only of interest to those who want intimate knowledge of their operating systems. I am presenting the utilities and sample source code here as a collection of learning material for reverse engineers.

Undocumented PC DOS 209094 A collection of interesting utilities that comes with the old Addison-Wesley Undocumented PC book, part of the Schulman "Undocumented" series. The file UnPCList.txt describes all of the included programs, but the highlights are : cmosview (displays CMOS registers), cputest (looks for undocumented PC opcodes), disktest (for BIOS problems), iospy (monitor I/O port states), irqredir (re-redirect irqs), sspy (monitor serial port states), and unpc (general system overview). Also included are a number of .ASM files and .SUB subroutine examples to demonstrate how to apply the principles of the book (i.e., how to find out EVERYTHING about your PC). The book itself I highly recommend; the inclusion of these utilities is not meant to discourage you from buying the book, but rather is part of an attempt to provide a comprehensive set of tools for reverse-engineering.

Undocumented Windows Win16 1043071 The disk of utilities and source code that comes with the old Addison-Wesley Undocumented Windows book, part of the Schulman "Undocumented" series. Included are a number of excellent utilities for monitoring the goings-on of an operating system, as well as the WINIO library for writing quick, "on-the-fly" windows programs (using the old stdio routines from C rather than the complex Windows API). Once again, I highly recommend the book and would require all would-be reverse engineers to read it; the inclusion of these utilities is not at all meant to discourage you from buying the book, but rather is part of my attempt to provide a tools for reverse-engineering.

VXD Monitor Win95 GUI 60260 Very interesting tool, shows exactly what the system is doing behind your back. Allows you to hook any number of VXDs and monitor how many times they are called, who called them, etc...very powerful, but then again you kind of hope you will never need it.

Watch DOS 19890 This program monitors your computer while other applications run. It creates a file called REPORT that contains a log of system events such as interrupt vectoring, file access, memory allocation, and OS queries. Very thorough, but it doesn't work with the Windows 95 GUI running.

virus/antivirus utilities

Anti-Virus Toolkit Pro Dos/Win16/32 Site Link I like their DOS utility much better than their 95 one, mostly because of the poor windows interface on the latter. AVPro is slightly heuristic, with brief info on file compression, memory model, etc, but like McAfee relies mostly on a virus database. Also available for (free) download are the Virus Encyclopedia (info on virii) and the AVPro Macro Virus Killer.

Biological Warfare DOS 39876 Virus creation kit by Mnemonix from 1994. Useful for educational purposes only; nothing made with this kit will past Thunderbyte or even McAfee.

Bizatch Win95 96674 Demonstration Windows 95 virus.

Macro Killer DOS 22049 From the Anti-Virus Toolkit designers: a utility that selectively eliminates macros from files.

Nuke Random Life Generator DOS 140811 Another virus creation kit from 1994, this one by Azrael. Again, useful only for learning the finer points of assembly language.

Thunderbyte Dos/Win16/32 Site Link The best for detection, although the TBClean utility has had some weaknesses in the past. Thunderbyte uses "heuristic scanning": basically it decompiles every executable on your hard drive and checks for opcodes/services that viruses commonly use. As a result, you will get a lot of false alarms if you have--like I do--many TSRs, boot sector utilities, key stroke captures, etc.. It also does a good job on macro viruses, for those of you unfortunate enough to have to rely on MS-Office for your daily tasks (are there any macro viruses for non-MS products?). To sum up: very good for the experienced, horrible for the consumer.

Virus Sort DOS 14437 Tool for collectors of infectious viruses and rare diseases.

software libraries

1001 Best Downloads

Chiba City

Computing Supershop
DaveCentral

Filez

OAK Software Repository
Silicon Toad's

Tucows

Webside Story

WinSite

Ziff Davis/PC Computing's site for the 1001 best free downloads (the actual count may vary...), updated monthly. When it started out it was pretty good; now it is rather commercial and requires a lot more time to browse through.

The File Archives of the Chiba City Blues page. A lot of interesting utilities, with links to their Cyberpunk Applications and Virus Research Center pages.

This site has a number of trial versions of commerical software--usually from companies like Microsoft and Symantec, as well as some smaller companies. The collection is not too extensive, and doesn't seem to be updated frequently.

"Shareware, Freeware, Demos and Betas"...that pretty much describes it. This is a pretty decent site, all things considered; navigation is simple if somewhat slow, and the site has many files to offer. Most of the stuff here is more "to be reverse-engineered" than to reverse-engineer with.

Filez.com is a shareware/freeware site that links to a number of others, amking them easy to browse. The programming section in particular is very useful (though they are short on ASM).

A great resource, with links to the Virtual Software Library (see Searches, below), Simtel, IRC, OS/2, and even CPM archives.

Silicon Toad maintains an excellent site with highly commendable links, files, and tutorials: good design, and well worth the visit.

Tucows is a decent source of Internet-oriented applications. All of the applications are rather commerical and most of them focus on HTML or the World Wide Web (I could not, for example, find an SMTP server), but as far as these go the selection is pretty good.

Webside Story maintains a "Top 1000" list for a number of categories; this link leads to the Hacking/Phreaking section, the majority of which points to warez sites. A couple of these sites will tace your IP; be sure to go in with an applet-killer and through a firewall, if you have one.

One of the best sites for downloading shareware and freeware. Winsite has a number of categories, from games and utilities to drivers and programming tools--for DOS, Win16, and Win95.

software searches

AltaVista
FTPSearch

Shareware.com
Snoopie
Virtual Software Library

Alta-Vista is one of the few search engines that allows you to search for a file by filename; simply enclose the DOS 8.3 name in quotes (e.g., "hiew560.zip") and you're on your way... Also can be used to search for .GIFs, .WAVs, etc.. Wildcards are not accepted.

This is the "Norway" FTP search; it works very well, veen taking wildcards, so you do not have to have the whole name of the target file in order to find it.

A site with a simple search engine for tracking down shareware. There are better, and there are worse.

Snoopie claims to have one of the largest indexes of files on the Internet; I personally have found only one file using this search. The FTPSearch listed above is much better.

The VSL contains a simple search, power search, archive search, new arrivals, most popular, and browse. This is the search that I use the most when searching for software; the things you can find here--especially the older programs--are incredibly. In addition, the browse option is pretty powerful, providing a listing of the servers which the VSL searches and a list of their subdirectories (i.e., \games, \apps, \prog, etc.).

assembly language utilities
A86	DOS	177629	version 4.02 : One of the more popular shareware assemblers, with a companion debugger available; comes with a lot of documentation. Only for 16-bit applications unless you buy the registered version.
ASM Environment	DOS	119231	version 1.9 : An Integrated Development Environment done in the style of Borland's DOS "turbo" IDEs. Very good, actually; full windowing and mouse support, ASCII table, hex calculator, integrated compiler/linker calling, plus menu "shortcuts" for common opcodes.
ASM Laboratory	DOS	170259	version 1.0 : Another IDE, again not badly done: simpler than ASMEnv, a little easier to use, with the same ASCII/HexCalc funtions and a limited "heuristic scan" that checks your source code for errors (apparently only missing "ret's" at this point; the author seems to have rushed this one out due to unforseen circumstances). One edge over ASMEnv is the source code colorizer. Warning: sets off virus detectors (notably TBAV).
ASM32	DOS	480469	Protected-mode flat address .ASM programming library for use with DPMI or the Causeway DOS Extender.
Cheap Assembler	DOS	105747	version 4.0 : Old Assembler (1983) that is intended for beginners --"to learn on"--and comes with an assembly language primer. Good tool to play with when starting up, but does not have the functionality to keep up with modern (not to mention object-oriented) assemblers.
Magic Assembler	DOS	27656	version 1.10 : A freeware assembler that seems fairly limited. Its bonus points: it is tiny (74K for the whole package) and has a simple compiling function (with some succinct instructions) to code the boot sector on a floppy--i.e., write your own bootup routines.
MASM Help	DOS	16039	A collection of non-Microsoft tools to use with MASM (Makecom.bat, Makeexe.bat, Makesys.bat) as well as ASM templates (COM and EXE), 2 include files with pre- defined symbolic constants, and documentation of the DOS and BIOS services.
Microsoft Assembler	DOS	Size	version 6.11 : Includes Masm, Link, Make, CodeView, file header and compression utilities, and library manager.Down Version 5.1 available.
Netwide Assembler	DOS	189819	A freeware 32-bit assembler that supports Intel processors up to the P6, Pentium Pro, and MMX series. Comes with sufficient documentation and a disassembler; this seems a good tool--still in prototype stage, though--but as its syntax is different from MASM and TASM I'll admit I haven't spent much time testing it. Source code is available on the net and the program itself is designed to be "modular"--i.e., you can program it into your own utilities, change the source, etc.. Comes with good docs and some samples. The Netwide Assembler Project can be found here, including updates to the assembler and even a Linux disassembler!
Norton ASM	DOS	108633	Companion disk for Peter Norton's Assembly Language For The IBM PC (the classic). Contains step-by-step examples of how to build your own hex editor in assembly; with the book, a very good intro to programming in ASM that has been in publication so long it ought to become public domain.
Turbo Assembler 16-bit	DOS	299552	version 1.01: Includes the Tasm executable.
Turbo Assembler 32-bit	DOS	221561	version 5.0 : Includes the Tasm32 executable and a 32-bit DOS extender.
Turbo Linker	DOS	324884	version 2.0 : Includes the TLink executable.
Windows ASM	Win16/32	504408	The source code disk for Barry Kauler's Windows Assembly Language and Systems Programming book; contains good examples of 16/32-bit Windows Assembly Language programming. The book is excellent and highly recommended, but is hard to find and a little steep at its US$44.95 retail price. Source code for the first edition is available.

debuggers & disassemblers
Borland Resource Workshop	Win16/32	844469	Resource Editor for Win16/32 files; recompiles binary with new resource information.
Brand-X Debugger	DOS	24512	version 2.6 : Old (1987) but capable debugger; we can safely assume it will not handle protected mode, however as a quick-and-easy DOS debugger it does alright.
Build SYM	DOS	50841	Borland Symbol (SYM) file builder. Package includes buildsym, exemap, mapsym, and tmapsym.
Map2Map	Perl Script	2035	Version 2.0: A utility for converting IDA-output MAP files to mnsym.exe-input MAP files. Requires Perl. Courtesy of Gij. New! mm.zip is an executable version of Gij's Map2Map. Courtesy of Buldozer.
PES-2-IDC	DOS	94803	"PE-Strings-to-IDC-script" translator. Creates string enumerations in IDA for PE files. Courtesy of Spyder.
Resource Edito	Win16/32	1858427	Symantec Resource Studio is both 16 and 32-bit, plus it has virtually all of the essential functionality of BRW (some of it you may have to "hunt" for, the UI is different). Excellent for creating/ viewing/ modifying/ deleting icons, bitmaps, strings, dialog boxes, cursors, and fonts in existing binary files or in uncompiled resource scripts.
SoftDump	DOS	44090	Utility for dumping memory from Soft-Ice; courtesy of Quine.
Sourcer	DOS	264623	The "commenting disassembler." Some people like it, some people don't. I like it, but think W32DASM is better.
StepDOS	DOS	19088	An excellent file-monitoring utility that doubles as a poor man's debugger: this program loads an application and breaks at every system call, providing a pop-up window with a register dump and options to skip the current function, execute the function and display the return code, and continue executing the application non-stop.
Trace	DOS	98912	DOS debugger that claims to replace debug, symdebug, turbo debugger, codeview, and even softice. Has register, data, and code displays. Very nice.
Turbo Debugger	DOS/Win16/32	1611386	Console-mode application debugger from Borland. Supports DOS, Win16, and Win32 executables.
VB Disassembler	Win32	1350032	Visual Basic disassembler. Courtesy of Revolt.
Win32DASM	Win16/32	855747	16/32-bit Windows disassembler and a (limited) debugger: you can--if you feel so inclined--trace through the code. Put the output from this thing into a source-code-coloring editor like Multi-Edit and you will have a blast.
Windows CodeBack	Win16	103349	An excellent 3-pass disassembler for Windows 3.1 files. Provides imported/exported modules, GPF handlers, Windows API function calls, and a disassembled listing. Apparently there is a Win32 version in beta testing.
Windows Disassembler	Win16	102803	An OK Windows 3.1 disassembler; its main interest lies in the hilevel.exe utility that sometimes provides C-source for a 16-bit disassembled file (other times it just gives compiler errors).

file editors
Binary Editor	DOS	389222	Andy's Folding Binary Editor, courtesy of Andy.
EditPack	Win32	107702	Hutch's QEditor and the infamous Hiew bundled with a .REG file to tie them to the context (right-click) menu for any (.) file.
Game Wizard	DOS	271382	Game cheating/patching utility, runs in DOS only. A must for video game freaks...
Hacker's View	DOS	397139	An excellent Hex editor with text (ASCII) and code (disassembly) modes, search capability, show/hide carriage return and line feed toggle, and file header display.
HED	Win32	125519	A surprisingly good hex editor with an equally suprisingly horrible file-open dialogue box (files are not listed alphabetically...I recommend using drag-n-drop to load). In addition to the standard macros, ASCII table, and hex calculator, this file gets bonus points for its "Fixups" menu: listings of imported names/ordinals, exported names/ordinals, and internal references/ ordinals. As if this weren't enough, this editor provides a disassembled listing and excellent search/replace functions.
PS Edit	DOS	67308	Small DOS hex editor
QEditor	Win32 GUI	53216	Small, fast, with user-configured add-in tools and help files; a handy editor. Allows command-line and Explorer access, and comes with a tiny Notepad replacement. Courtesy of Hutch.
QuickView	DOS	169126	Quick View: Hex editor remarkable similar to Hiew, same inherent functionality.
UltraEdit	Win95 GUI	601918	A good hex/text editor with features such as Mac-UNIX-DOS conversion, user-added tools and help files, spell checking, searching and other useful functions. Fully customized version with opcodes.hlp replacing the standard (read: useless) uedit help file.
XED	DOS	168748	An even better (and bigger) Hex editor with improved functionality over HIEW and a much nicer interface.

file utilities
2M	DOS	403917	Utility to make all of your floppies store 2 Megabytes.
Data Crack Engine	DOS	16384	Excellent crack engine; allows you to include patches for multiple files in one crack.exe. Courtesy of Pirate1.
Debug File Dump	DOS	57265	Utilities for viewing debug file information. Includes dumpw4, dumppdb, and dumpcv.
Dump Bin	Win95 Console	522593	Useful file dumping utility from Microsoft VC++ 5.0 with requisite DLLs. Displays symbol, import, export, relocation, section, header, and summary data, as well as disassembly and other info. Package includes dumpbin, editbin, link, and remap.
DumpExe	DOS	39478	A TSR utility that can be used to unpack .exe files. Requires a bit of work to set up: input for the program includes the CS, IP, SS, SP, the size and name of the file, and the file's PSP. Once the file is dumped the included MAKEEXE program can be used to create an unpacked version of the file. The documentation includes instructions on using a debugger (in this case TD.EXE) to unpack an compressed executable.
Dump LX	Win16/32	42237	Utility for viewing the contents (modules, entry points, etc) of Linear Executables (VXDs) in Windows 3.1 and 95. Exactly like examining the VXD in Soft-Ice; output can be redirected.
Dump NE	Win16	50105	Utility for viewing the content (resources, modules, entry points, imports, exports, segmentation) of a 16-bit binary file. Successfully tested with Kernel386.exe, Moricons.dll, and winfile.exe.
Dump PE	Win32	25942	Utility for dumping the content (resources, modules, entry points, exports, imports) of a PE binary file (32-bit .EXE or .DLL). I successfully tested this with Kernel32.dll, Curves&Colors.scr, and mkcompat.exe.
Far Manager	DOS	472604	Console-mode File and Archive Manager for zip, arj, rar formats. This is a very useful util that allows you to browse directories and archives ina tree-view; files may be viewed in hex or text and editted in text, or can be configured to use an external viewer/editor.
Fast Zip Cracker	DOS	46676	PKZip file cracker for password-protected zip files.
File Sniffer	DOS	9699	A DOS application that provides a listing of the interrupt calls and scan/compare string byte calls in a file; output can be redirected.
FileDump	DOS	1093	Provides a hex dump of any file, but redirection to a file does not work so well. Unless you consider pages of hexidecimal numbers rolling up your screen to be high entertainment, use only for printing or if your hex editor is broken.
MiniChainer	DOS	40905	Chain/join files
Nowhere Utilities	DOS	106620	The old (1992) and famous set of Nowhere Man's h/c/v utilities! Files included are: cipher, cryptcom, dbgscrpt, decrypt, fakefile, fakeware, fixattr, fixtime, nolzexe, replace, resize, user2txt, and wipe. Most of these are mainly of interest to virus writers and may be a little dated, but they certainly have their uses...
NU	DOS	74346	That's right, the old (v 4.5) Norton Utilities for file editing/unerasing. An excellent utility for your obsolete DOS machine; this thing will give you disk error messages if you use it in 95.
PE Info	Win95 GUI	1439756	Utility for viewing Imports, Exports, Header, and Resources of PE files. Warning: resource functions can cause crashes.
Peek	Win32	11492	A file "peeker", like Quick-View.
PGP	DOS	236322	The unofficial standard for data encryption on the internet. This is version 2.62g, with full encryptive (4096) functionality.
PK-Zip Cracker	DOS	26280	PK-zip file cracker
Patch-Maker's Toolkit	Win95 GUI	47294	Patch creation utility that outputs in either binary data, an asm file of the patch, or in a functional .com file. Very good util, with a license better than GNU's! Courtesy of Hutch.
ReLoc	DOS	10262	Relocations handler: moves reolcation table to the end of an executable so that you can encrypt/compress the executable; with full source.
Resource Dump	Win16/32	11889	Lists the resources contained in a 16-bit (NE) binary file. Note that this may be a .DLL or .SYS file as well as a binary file, and that there are still 16-bit support files in Win95; I successfully dumped DriveSpace3, moricons.dll and user.exe with this file. Output redirection is suggested as the stuff scrolls by pretty fast.
RTV Reco	Win32	18000	Allows you to program buttons on an application to push themselves according to your instructions. Gets rid of very simple nag-screens.
Search and Replace	DOS	237312	A (somewhat) quick search/search and replace utility for finding files that contain a certain string. Allows file masking and "touching" (changing the file date/time) of masked files.
S-Tools	Win32	278774	Drag-and-drop steganography for the Win95 GUI: open an audio or graphics file in S-Tools, then drag data files in from the Windows Explorer to hide them in the open file. Very handy for sending passwords, source code, virii, cracks, you name it....
String Search	DOS/Win16/32	26960	Provides a listing of all of the strings present in a file. Useful for finding exports, functions, and string tables in an executable file.
Symbiote	DOS	10067	Symbiote: DOS executable loader, wrapper for an executable with user-programmed "payload" with full source. Courtesy of Greythorne.
TRON	DOS	32241	Unpacker for PKLite, TinyProg, Diet, LZExe, ExePack, and Protect-packed files.
VXDLib	Win16/32	19393	This utility allows you to decompress VXDs from within Windows 95's binary files so that you can take them apart at you leisure. Also allows you to recompress the VXDs into their standard files in cae any changes were made...
WinDiff	Win32	56654	WinDiff is the Windows version of the DOS utility FC: it compares files or directories with a (somewhat poor) graphic representation of the results.
Xenocide's Hacking Utilities	DOS	97986	Xenocide's hacking utilities including brute, dzip, fakelog, isprime, netware, passwd, permute, primes, and winsscrk.

network tools
GetAdmin	NT	48753	Utility to get admin rights on an NT 4.0 machine. Works only on local password tables. Updates avilable from NT Internals.
IP Prober	Win32 GUI	128906	Remote host port prober.
L0pht	NT Console	508913	NT password recovery utility. Updates available from www.l0pht.com.
Network Info	Win32 GUI	85399	Provides tabs for Local Info, Query (whois), Scanner (port scanner), and Service (status of ervice on remote host).
NTFS-DOS	DOS	46199	Mount NTFS partitions for reading from DOS environments. Updates avilable from NT Internals.
Spanner	Win16/32 GUI	243374	A near-legendary WinSock troubleshooting tool that allows you to create, open, and close sockets on the fly, as well as sending messages or testing functions over open sockets. Useful for testing out your WinSock theories, testing network connections, or as a "bare bones" network utility.
WS-Ping	Win32 GUI	69212	A very good network utility that has ping, host lookup (Whois), and trace (tracert) functions. Small, quick, easy to use.

reference material
Base Calculator	Win32	729659	Calculator with binary, octal, decimal, and hexadecimal functions; AND, OR, NOT, NEG, XOR, and EQV macros.
CrackPC	DOS	348923	The classic HelpPC program with the Soft-Ice Command Reference incorporated into it.
Edison'95	Win95	40637	Edison's famous Windows 95 cracking tutorial. Warning: sets off virus scanners (TBAV).
Help PC	DOS	260616	An on-line programmer's reference with the following sections: Assembler Programming Topics, C Programming Topics, Interrupt Services DOS * BIOS * EMS * Mouse, Tables & Formats use by DOS and BIOS, Miscellanoeus Topics. From 1991 but unbelievably useful. Highly recommended for the serious engineer, cracker, or programmer; not for "visual" developers.
Intel OpCodes List	N/A	3MB	This reference is a must-have! Every opcode supported by the Intel processors, plus their hexadecimal (machine code) equivalents, registers/flags affected, etc. This is actually volume two of the three volume Intel Architecture Software Developer's Manual, which consists of these three files: Volume 1: Basic Architecture , Volume 2: Instruction Set Reference , Volume 3: System Programming Guide in PDF format.
Win 95 Kernel Documentation	Win95	311698	From the Win95 DDK.
OpCodes Help	Win95 GUI	47294	Windows help-file format version of opcodes.txt. Suitable for browsing or for adding to your favorite Win95 hex editor (just rename it to the name of the Hex-editor's help file). Courtesy of Hutch.
OpCodes List	N/A	113054	Unfortunately, without the actual hex op-codes (machine code); this is more of a reference of assembly-language processor instructions.
Personal Bookshelf	Site Link	Site Link	MCP offers a "personal bookshelf" service that allows you to read (or snatch via Teleport Pro) 5 books online. Granted, this is not the best technical library one could hope for--all SAMS and QUE books, no meat on them--but really one gets what one pays for (and then some).
Soft-Ice Quick Reference	Win32	4747	Soft-Ice for 95/NT quick reference.
VxD Documentation	Win95	60066	From the Win95 DDK

system utilities
API Vision	Win95 GUI	1148729	API Vision API call logging. Function disabled.
API Vision Upgrade	Win95 GUI	98846	Adds COMMDLG trapping.
DiskSave	DOS	21770	backs up NT 4.0 volumes for future recovery.
DongleSpy	DOS	28534	A utility for viewing calls to .DLL files in SentinelSuperPro hardware key ("dongle") protection schemes. I have not yet tested this (I do not have anything protected by a dongle....).
FAT Viewer	DOS	25709	Show File Allocation Table provides a visual representation of your hard drive. While it is not inherently useful--statistics on fragmentation and file locations can be obtained more easily using other utilities--it does provide a low-level view of your hard drive for the curious.
FHK95 SDK	Win95	107463	Demo SDK for hooking .DLL functions, includes sample code.
File Monitor	Win95 GUI	44368	This is a Win32 app that tracks file access on the local machine. Very useful for debugging, cracking, or reverse-engineering an application; also can be used to track system functions. Updates available from NT Internals.
Heap Walker	Win95 GUI	73164	Shows statistics about the local heaps allocated to every process currently running. Sorts by Process ID, Module (exectuable file) name, Heap ID, Object Count, and Bytes Free.
Install-Watch	Win95 GUI	493076	A utility that backs up your system files and registry brefore an install, then compares your system files, registry, and any user-specified directories to find the changes made by the install. Also works as an excellent un-installer.
KGB	DOS	6137	Resident system log utility that tracks calls made by an application.
Map	DOS	23959	Memory editor that allows code, hex, and text read/writes of memory locations; shows interrupt vectors, loaded files and their PSP s, and BIOS information, and also allows displayed information to be written to a file. The program remains resident in memory, can be activated with the F10 key. Also gives an overview "map" of system memory and has a simple calculator. Excelsior!
Memory Map	DOS	23921	A memory editor that displays memory in a "map" of allocation, allowing you to quickly jump to i/o addresses, loaded programs, system environment, etc.
MemScan	DOS GUI	9492	An interesting utility that allows you to visually scan your memory (the first 1MB, in 8K allotments), displaying a segment "map" with the offsets lines vertically (increasing "y"--vertical down--increases the offset by 1, increasing "x"--horizontal left--increases the offset by 128). Segment map represents 1 bit per pixel, and is 64 bits across and 128 bits tall--a "lit" bit (green?) indicates a "true" (1) bit; each byte is comprised of eight horizontal pixels. Controls allow you to coarse-tune (segment 0xxx - Fxxx) or fine-tune (segment +/- 0200h) the view. Have fun.
Norton RegEdit	Win95 GUI	116827	Huge if good Windows Registry Editor (expanded is >2MB). Bookmark functionality disabled (read: broken); full searching backup and restore capabilities included.
PC Watch	DOS	18150	A DOS monitoring utility that allows you to set breakpoints on interrupts individually or grouped by function (e.g., file access, video display, etc); splits the DOS screen and gives a register dump and a call listing when triggered.
Process Tree	Win95 GUI	522239	Excellent system monitor utility showing DLLs and windows used by all active processes, allows "Kill Gracefully" and "Kill Forcefully" actions. Combined with dumpbin.exe from MS VC++ (available above) this provides an excellent interface for viewing imports, exports, disassembled code, and other file info.
Process Viewer	Win95 GUI	270726	A tool from the Win95 SDK: allows you to monitor, view, and kill any process running on your system.
ProView	DOS GUI	231801	A disk/memory editor that allows absolute reads on memory locations and disks; very well done.
Registry Monitor	Win95 GUI	22172	The Windows 95 Registry Monitor logs all Registry accesses in a scrollable window or to a log file. Very handy for finding out what an install does to your system. Updates avilable from NT Internals.
Resource Spy	Win95 GUI	177838e	Hooks calls to Windows API registry functions.
Scout	Win16/95 GUI	62532	An excellent utility for monitoring Tasks, Modules, and Windows. Provides Load, Free ("kill"), Links, Liposuction (no kidding), and Function Exports actions for Modules; Load, Free, Links, and Liposuction actions for Tasks; and Parent, Child, Mail (send Windows Message--very useful!!!!), Mouser (pick with Mouse), and Metrics actions for Windows. Built for Win16, works great in Win95...truly an excellent tool.
Show DOS Calls	DOS	4321	Records DOS services calls.
Snoopy	Win16/95 GUI	7510	A windows task/message monitor that displays file, module, and process calls in 16-bit windows applications.
Spray	DOS	6513	Source code (ASM) for a utility to dump some or all of the first 640K after an application crash. Useful in Win16 systems.
System Info	Win95 GUI	63302	An excellent utility task manager/system monitor utility. Built-in process viewer shows all running processes and allows you to view their associated threads, modules, and windows, and provides an option to kill the process. Built-in window viewer shows all open windows and allows you to view information on each window such as process, module, class, parent, and handle; provides options to destroy windows. The task manager is standard and the program also includes a screen capture utility with a functionality reminiscent of SnagIt.
TechFacts95	Win95 GUI	73524	A system monitor brought to you by the same guys who did Infospy. Allows you to monitor processes, modules, threads, windows, heaps, and atoms; to search for files, .DLLs, icons, and strings; to kill a process, unload a module, save/restore CMOS, capture the screen, and ove applications (with full directory structure and Registry keys intact); to view the Registry, edit system/.INI files, and dump your CMOS; to watch disk usage and program access. Very good tools, but I have to admit I really hate the interface: lots of big windows with the MSIE-style toolbar. I'll stick with SysInfo...
Track Memory	DOS	9591	Tracks the memory used by an application. This program takes the target application's name as a parameter and returns (when you exit the application) the starting DOS memory, the lowest available memory during the course of the application, and the maximum memory used by the target (i.e., the last two values add up to provide the first one). Output redirection is not possible.
Unauthorized 95	Win95	804994	The disk of utilities and source code for the Unauthorized Windows 95 book, the Developer's Resource edition. The book is largely concerned with interaction between 32-bit Windows, 16-bit Windows, and DOS, and is therefore only of interest to those who want intimate knowledge of their operating systems. I am presenting the utilities and sample source code here as a collection of learning material for reverse engineers.
Undocumented PC	DOS	209094	A collection of interesting utilities that comes with the old Addison-Wesley Undocumented PC book, part of the Schulman "Undocumented" series. The file UnPCList.txt describes all of the included programs, but the highlights are : cmosview (displays CMOS registers), cputest (looks for undocumented PC opcodes), disktest (for BIOS problems), iospy (monitor I/O port states), irqredir (re-redirect irqs), sspy (monitor serial port states), and unpc (general system overview). Also included are a number of .ASM files and .SUB subroutine examples to demonstrate how to apply the principles of the book (i.e., how to find out EVERYTHING about your PC). The book itself I highly recommend; the inclusion of these utilities is not meant to discourage you from buying the book, but rather is part of an attempt to provide a comprehensive set of tools for reverse-engineering.
Undocumented Windows	Win16	1043071	The disk of utilities and source code that comes with the old Addison-Wesley Undocumented Windows book, part of the Schulman "Undocumented" series. Included are a number of excellent utilities for monitoring the goings-on of an operating system, as well as the WINIO library for writing quick, "on-the-fly" windows programs (using the old stdio routines from C rather than the complex Windows API). Once again, I highly recommend the book and would require all would-be reverse engineers to read it; the inclusion of these utilities is not at all meant to discourage you from buying the book, but rather is part of my attempt to provide a tools for reverse-engineering.
VXD Monitor	Win95 GUI	60260	Very interesting tool, shows exactly what the system is doing behind your back. Allows you to hook any number of VXDs and monitor how many times they are called, who called them, etc...very powerful, but then again you kind of hope you will never need it.
Watch	DOS	19890	This program monitors your computer while other applications run. It creates a file called REPORT that contains a log of system events such as interrupt vectoring, file access, memory allocation, and OS queries. Very thorough, but it doesn't work with the Windows 95 GUI running.

virus/antivirus utilities
Anti-Virus Toolkit Pro	Dos/Win16/32	Site Link	I like their DOS utility much better than their 95 one, mostly because of the poor windows interface on the latter. AVPro is slightly heuristic, with brief info on file compression, memory model, etc, but like McAfee relies mostly on a virus database. Also available for (free) download are the Virus Encyclopedia (info on virii) and the AVPro Macro Virus Killer.
Biological Warfare	DOS	39876	Virus creation kit by Mnemonix from 1994. Useful for educational purposes only; nothing made with this kit will past Thunderbyte or even McAfee.
Bizatch	Win95	96674	Demonstration Windows 95 virus.
Macro Killer	DOS	22049	From the Anti-Virus Toolkit designers: a utility that selectively eliminates macros from files.
Nuke Random Life Generator	DOS	140811	Another virus creation kit from 1994, this one by Azrael. Again, useful only for learning the finer points of assembly language.
Thunderbyte	Dos/Win16/32	Site Link	The best for detection, although the TBClean utility has had some weaknesses in the past. Thunderbyte uses "heuristic scanning": basically it decompiles every executable on your hard drive and checks for opcodes/services that viruses commonly use. As a result, you will get a lot of false alarms if you have--like I do--many TSRs, boot sector utilities, key stroke captures, etc.. It also does a good job on macro viruses, for those of you unfortunate enough to have to rely on MS-Office for your daily tasks (are there any macro viruses for non-MS products?). To sum up: very good for the experienced, horrible for the consumer.
Virus Sort	DOS	14437	Tool for collectors of infectious viruses and rare diseases.

software libraries
1001 Best Downloads Chiba City Computing Supershop DaveCentral Filez OAK Software Repository Silicon Toad's Tucows Webside Story WinSite
		Ziff Davis/PC Computing's site for the 1001 best free downloads (the actual count may vary...), updated monthly. When it started out it was pretty good; now it is rather commercial and requires a lot more time to browse through.
		The File Archives of the Chiba City Blues page. A lot of interesting utilities, with links to their Cyberpunk Applications and Virus Research Center pages.
		This site has a number of trial versions of commerical software--usually from companies like Microsoft and Symantec, as well as some smaller companies. The collection is not too extensive, and doesn't seem to be updated frequently.
		"Shareware, Freeware, Demos and Betas"...that pretty much describes it. This is a pretty decent site, all things considered; navigation is simple if somewhat slow, and the site has many files to offer. Most of the stuff here is more "to be reverse-engineered" than to reverse-engineer with.
		Filez.com is a shareware/freeware site that links to a number of others, amking them easy to browse. The programming section in particular is very useful (though they are short on ASM).
		A great resource, with links to the Virtual Software Library (see Searches, below), Simtel, IRC, OS/2, and even CPM archives.
		Silicon Toad maintains an excellent site with highly commendable links, files, and tutorials: good design, and well worth the visit.
		Tucows is a decent source of Internet-oriented applications. All of the applications are rather commerical and most of them focus on HTML or the World Wide Web (I could not, for example, find an SMTP server), but as far as these go the selection is pretty good.
		Webside Story maintains a "Top 1000" list for a number of categories; this link leads to the Hacking/Phreaking section, the majority of which points to warez sites. A couple of these sites will tace your IP; be sure to go in with an applet-killer and through a firewall, if you have one.
		One of the best sites for downloading shareware and freeware. Winsite has a number of categories, from games and utilities to drivers and programming tools--for DOS, Win16, and Win95.

software searches
AltaVista FTPSearch Shareware.com Snoopie Virtual Software Library
		Alta-Vista is one of the few search engines that allows you to search for a file by filename; simply enclose the DOS 8.3 name in quotes (e.g., "hiew560.zip") and you're on your way... Also can be used to search for .GIFs, .WAVs, etc.. Wildcards are not accepted.
		This is the "Norway" FTP search; it works very well, veen taking wildcards, so you do not have to have the whole name of the target file in order to find it.
		A site with a simple search engine for tracking down shareware. There are better, and there are worse.
		Snoopie claims to have one of the largest indexes of files on the Internet; I personally have found only one file using this search. The FTPSearch listed above is much better.
		The VSL contains a simple search, power search, archive search, new arrivals, most popular, and browse. This is the search that I use the most when searching for software; the things you can find here--especially the older programs--are incredibly. In addition, the browse option is pretty powerful, providing a listing of the servers which the VSL searches and a list of their subdirectories (i.e., \games, \apps, \prog, etc.).