Hello,
I was reading Harlan Carvey's book (Harlan I know you are listening) ) and there was the mention of a tool called Showbinarymfr.exe. I have learned by looking around that the tool is no longer support by Microsoft and has been recalled. Does anyone know of a similar type tool or where I can get a copy of Showbinarymfr.exe?
To quote from Harlan, the tool does the following
This is an excellent little tool that takes a file or directory as an argument (defaults to the current directory that it resides in) and will display the version number, product name, and company name of binary files (i.e., .exe, .dll, .scr, etc., if available). It will also list whether or not the file is protected by WFP. Since WFP is not available on Windows NT, this is not a good tool to run on that platform. However, it is an excellent tool to run on Windows 2000, XP, and 2003. When the tool has finished, it will display the total number of binaries scanned, how many are protected by WFP, how many are Microsoft binaries, and how many are non-Microsoft binaries. This can be extremely useful for locating suspicious files on a system.
Showbinarymfr.exe has several switches that can make the investigator's job easier by reducing the amount of data she must pour through. The -m switch tells the tool to scan for only Microsoft binaries, while the -n switch tells it to scan for non-Microsoft binaries. The -p switch instructs the tool to search all of the directories listed in the PATH statement (which usually includes the %SYSTEMROOT%\system32 directory). The tool will also take wildcard statements such as *.dll to look for all DLL files. For example, the following command will scan for all non Microsoft Dll files in the System32 dir.
Thanks
This tool is trivial to replicate in Perl…
Thanks for the input, unfortunately I do not currently know how to use Perl and while I am not against picking up a book and learning it, that will have to happen after I solve my immediate problem.
So again with the question, does anyone know of an existing perl script or other similar tool to Showbinarymfr.exe, or where to obtain the Showbinarymfr.exe tool.
Thanks.
Alan