VAXD - lightweight PE EXE/DLL disassembler and patch-assistance tool for Windows

[Bicurico]

I built VAXD as a small Windows PE EXE/DLL disassembler and patch-assistance tool.

It supports separate x86 and x64 analysis, DLL export detection, function listing, visual jump/call flow, relative jump calculation, and simple patch planning.

It is not intended to replace IDA, Ghidra, Binary Ninja or x64dbg. The goal is a smaller and faster tool for quick PE inspection, learning, and simple analysis workflows.

I would appreciate honest feedback, especially from people who regularly inspect PE files.

Link: https://github.com/bicurico/VAXD

[Bicurico]

I have meanwhile greatly enhanced VAXD since the first version I posted here.

It is no longer just a small x86/x64 PE disassembler. The current version is now one integrated Windows PE/.NET patch-assistance workbench.

Main additions include:

- one integrated application for x86 and x64 PE files
- PE analyser with sections, imports, exports, resources and metadata
- native x86/x64 disassembly with function listing, jumps, calls and visual flow arrows
- opcode/hex bytes shown beside the disassembly
- strings, string references and xrefs
- native patch helpers such as NOP, invert jump, force jump and retarget jump
- integrated hex editor
- .NET assembly support
- C# decompilation for .NET methods
- IL editor with right-click patch helpers
- C# to IL navigation, with matching IL opcodes highlighted
- IL to C# navigation, with the matching C# line highlighted
- manual user comments in C# and IL views
- AI-assisted comments for native disassembly, C# and IL
- .NET WinForms/resource renderer
- editing of WinForms appearance properties such as BackColor, ForeColor, Font and images
- global Patch Manager covering native, hex, IL and resource/form patches
- enable, disable, delete and comment patches from one central patch list
- project save/load including patches and comments
- patched EXE/DLL export
- standalone patcher EXE generation

The main idea is still the same: VAXD is not intended to replace IDA, Ghidra, Binary Ninja, x64dbg or dnSpy. Those are much deeper tools.

The goal of VAXD is a faster and more focused workflow for practical inspection and patch planning:

open file → inspect native/.NET/resources/hex → understand the relevant code → add comments → create patches → review them in one Patch Manager → save project → export patched file or patcher.

One area I find particularly useful is old .NET/WinForms tools. VAXD can now render forms and patch visual properties, which makes it possible to fix unreadable or badly contrasted user interfaces without having the original source code.

The project is proprietary software, but there is an evaluation mode. Save/export/patcher functionality requires a license.

I would still appreciate honest feedback, especially from people who regularly inspect PE files, .NET tools, legacy utilities or firmware/helper executables.

Link:
https://github.com/bicurico/VAXD

[coromonadalix]

what would be the licence fees  if you can PM me ?  thks

one time - life time / a year ?

[Bicurico]

PM sent.

[Bicurico]

This video shows a simple native Windows PE patching workflow using VAXD.

I open a demo password challenge, inspect the PE file, search for useful strings, jump to the referenced code, comment the relevant instructions, and patch the conditional branch that controls the password check.

At the end, I create a standalone patcher executable that can apply the same patch automatically.

The purpose is educational: to demonstrate basic PE analysis and patching, and to show why sensitive validation logic should not be implemented only as a simple local check.

All steps are performed using VAXD.

[Bicurico]

This video shows how VAXD can be used to analyse a poorly implemented .NET licensing system.

In the demo, I show three common analysis workflows:

Patching the license check by inverting an IL conditional branch
Inspecting the decompiled C# code and identifying the license-generation routine
Editing .NET resources/forms directly inside the application

All steps are performed using VAXD.

The purpose of this demo is educational: to show how weak client-side licensing can be analysed, patched, or reverse engineered, and why software developers should avoid exposing license-generation logic inside the protected application.

[coromonadalix]

nice fella to talk to .... 

to @EEVBLOG people,  do try it,   he put lots of efforts in it  ...

[daisizhou]

Nice .good job

[Bicurico]

I updated v1.60 (if you downloaded before 09:37 UTC, download again - was too lazy to change version number).
This last version has some color scheme fixes.

[Bicurico]

I created a dedicated page for VAXD on my https://vma-broadcast.com website:

https://vma-broadcast.com/vaxd-vma-executable-disassembler/

This is easier to handle than a Github page.

[Bicurico]

Released VAXD - 2.0

It now supports direct C# patching.

https://vma-broadcast.com/vaxd-vma-executable-disassembler/