From Collaborative RCE Tool Library

Jump to: navigation, search

IAT Restore Tools


Tool name: Universal Import Fixer
Rating: 5.0 (1 vote)
Author: Magic_h2001                        
Website: http://magic.shabgard.org
Current version: 1.2
Last updated: February 23, 2009
Direct D/L link: Locally archived copy
License type: Free
Description: Universal Import Fixer
======================
Use this tool for fixing Import Elimination, Directly Imports and
Shuffled, Disordered, Scattered Imports (Just for 32 bit processes).

So you can use this tool for changing IAT Base Address and Sorting IATs
in New (other) Address.

Tested on:
==========
Armadillo
ASProtect
Enigma
ExeCryptor
eXPressor
PeSpin
RlPack
VMProtect
TheMida
WinLicense

and any protector with Import Elimination, Directly Imports and
Shuffled, Disordered, Scattered Imports.

Notes:
======
This tool is an Import Fixer (not Import Rebuilder ImpRec etc) and Just work
in memory of target process. dont tell me how to use this Tool...if you can
not use this Simple Tool plz DRAG IT TO THE RECYCLE BIN ok?

Always first use UIF then Dump target process.

UIF can fix actual APIs, dont use it for fixing Emulated/Redirected APIs to
protector's stub.you must use UIF After fixing Magic IAT jump
(or use any methods) to convert Emulated/Redirected APIs to Actual APIs.

Samples:
========
Armadillo  : Import Elimination
ASProtect  : Directly Imports
Enigma  : Shuffled, Disordered, Scattered Imports
ExeCryptor : Scattered Imports in Protector Stub
eXPressor  : Directly Imports
PeSpin  : Directly, Shuffled, Disordered, Scattered Imports
RlPack  : Shuffled, Disordered, Scattered Imports
VMProtect  : Directly Imports
TheMida  : Directly Imports
WinLicense : Directly Imports



How to use :
============
1.fill <Process ID> with target Process ID

2.fill <Code Start> with start address (Virtual Address) of code that you want to fix it.
if you fill it with ZERO, UIF will fill it automatically.

3.fill <Code End> with End address (Virtual Address) of code that you want to fix it.
if you fill it with ZERO, UIF will fill it automatically.

4.fill <New IAT VA> with address (Virtual Address) of Empty or unused area
(in Code section or Data section or any...) that IAT will repair to it.
if you fill it with ZERO, UIF will fill it automatically.

so you can fill <code Start> , <Code End> with a Dll address area, UIF will
detect it automatically.


for Fast Speed:
===============
-After Click on <Start> you can Minimize UIF to the taskbar.
-Just enter Code section start and end (.text section etc).
-Dont check "Fix Directly Imports" if you dont need to it.

History:
========
v1.2 FINAL update (2009.02.23):
===============================
+Speed Optimized again.
+Some methods added for better detecting ImageBase and ImageSize.
+UIF disassembler updated for other MOV opcodes (C7Cx). (Thx to LCF-AT)

v1.2 FINAL update (2008.12.31):
===============================
+Code improved for better processing invalid ImageBase,ImageSize and invalid PE.
+Some small changes for more Compatibility/Stability.
-PSAPI library removed from UIF engine (shit library with many bugs).

v1.2 FINAL update (2008.06.15):
===============================
+Code Optimized again for better result.
+UIF.dll released (for using UIF in other applications).
Coded with pure Api,very fast and small size.

v1.2 FINAL update (2008.04.24):
===============================
+Fast Speed option added.

v1.2 FINAL (2008.04.19):
========================
+Now UIF can process Ring0 Hooked APIs (KAV,ZoneAlarm,... etc).
-Minor Bugs fixed.

v1.2 Stable (2008.04.04):
=========================
+Algorithm improved for Fast Speed.
-Option 'Main exe Exports' removed (now UIF can detect it automatically)
-Option 'Fix NtDll to Kernel32' removed (now UIF can detect it automatically)
-Minor Bugs fixed.

v1.0 Final+ (2008.03.21):
=========================
+Code Optimized for Fast Speed.
+Always OnTop Added.
+Tested again on many targets:
(TheMida,WinLicense,Armadillo,ASProtect,Enigma,eXPressor,PeSpin,...)
-Bug fixed in Fixing Directly Imports in Delphi,BCB,VC(MFC) Applications.

v1.0 Final update (2008.02.23):
===============================
+Algorithm improved for better fixing Directly imports.
+Show modules count and progress in StatusBar.
-GUI bug fixed on large fonts >=120 dpi.

v1.0 Final update (2008.01.15):
===============================
-Some small bugs fixed.
+Algorithm improved for very big IAT size.
+Auto fill improved for detecting dlls correctly.

v1.0 Public (2008.01.12):
=========================
First public release...

v1.0 Private (2005.02.23):
==========================
For personal use...
Also listed in: (Not listed in any other category)
More details: Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry)



Tool name: ImpREC
Rating: 4.0 (3 votes)
Author: MackT                        
Website: http://files.planet-dl.org/Cw2k/Tools/Import%20REConstructor%20v1.7f.7z
Current version: Official version 1.6 - Unofficial version with misc. fixes 1.7f
Last updated: June 1, 2011
Direct D/L link: Locally archived copy
License type: Free (^-Note: 'Direct D/L URL' is V1.7e !)
Description: The world's most famous IAT rebuilder tool.

The last official version from MackT is still 1.6. The 1.7f update is a third-party patched version of 1.6, which contains the following patches:

v1.7f FINAL (PUBLIC VERSION) fixes by cw2k
- Clean unpack of 'v1.6 FINAL (PUBLIC VERSION)'(UPX) + restoring header & imports
as close as possible to the original header
Short/stripped dos-Stub and other crap & dump grabage that make it to most AntiVirus proggies suspect
virustotal.com before: 33/42 hits now: 0/42 hits

- Reappling and documenting of patches (Scroll to the end of that file)
Improve patch #1 "RestoreLastError" -> SetLastError bugfix

- Adding Fly's GUI-modification

- doing some clean up of the plugins (unpack/removing duplicates)

--------
Also included in the archive:

CHimpREC: The Cheap Imports Reconstructor
by TiGa of ARTeam

This is the 32/64-bit imports rebuilder that I introduced at ReCon 2008 in Montreal.
Made for the best compatibility with WoW64 on x64-based Windows XP or Vista.

+Features
The first universal 64-bit imports rebuilder
32-bit version included
Interface similar to ImpREC
Integrated 32/64-bit process dumper
IAT AutoSearch from ImageBase or OEP
Unshuffle thunks function
Manual imports editor

-Limitations
No plugin support yet
No AutoTrace feature
No disassembler

--------


NOTE:
V1.7a

- Fixed RestoreLastError API set to SetLastError for WinXP/Vista compatibility (MaRKuS_TH-DJM)
- user32.dll is always read from the system, prevents a crash from corrupted PE of user32.dll (MaRKuS_TH-DJM)
- Latest version of psapi.dll (6.0.6000.16386) included
- Fixed Vista64 crash bug (jstorme)
- GUI modified and improved (based upon Fly's modification)
- Updated/corrected plugins and deleted dups

v. 1.7a added the following fixes:

- Misc
- Fixed Win2K crash, AllocConsole was replaced with ActivateActCtx (jstorme)

The local download here contains the last unofficial patch, 1.7e. In addition to that, it also contains a big bunch of plugins, and also source code for many of these plugins (in all well-known programming languages, which is good for use as templates for new plugins etc).

Changes in Version 1.7b:

- Misc
- Fixed invalid API bug in user32.dll on Windows 98 (jstorme)
- Modified code to improve support for discardable/unreadable sections (jstorme)
- Fixed ImageBase problem with DLL's when "Use PE Header from Disk" is checked (jstorme)
- Added an "ImpREC Classic" looking version

Changes in 1.7c:

- Fixed bug introduced in 1.7b when DLL's have discardable sections (jstorme)

Changes in 1.7d:

- Misc
- Fixed bug introduced in 1.7b which destroys IAT Autosearch feature in some packed targets, like eXpressor 1.8 (Newbie_Cracker).
- Fixed crash introduced in 1.7b when DLL's PE header has "NO Access" flag (Newbie_Cracker).


Changes in Version v1.7e

- Misc
- Fixed a bug which avoids ImpREC to fix JMP DWORD [...] if it is located at the end of code section (Newbie_Cracker)
( Thanks to Nexus6 for report the bug and provide samples)
Also listed in: Process Dumpers
More details: Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry)



Tool name: ACProtect 2.0 OEP Finder + IAT Repair OllyScript
Rating: 0.0 (0 votes)
Author: ColdFever                        
Website: N/A
Current version:
Last updated: February 10, 2007
Direct D/L link: Locally archived copy
License type: Free
Description: ACProtect 2.0 OEP Finder + IAT Repair
Also listed in: OEP Finders, OllyScript Scripts
More details: Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry)



Tool name: CHimpREC
Rating: 0.0 (0 votes)
Author: S├ębastien Doucet (TiGa)                        
Website: http://www.iitac.org
Current version: ReCon Edition
Last updated: June 23rd, 2008
Direct D/L link: Locally archived copy
License type: Freeware
Description: CHimpREC: The Cheap Imports Reconstructor
by TiGa of ARTeam
IITAC (http://www.iitac.org)

This is the 32/64-bit imports rebuilder that I introduced at ReCon 2008 in Montreal.
Made for the best compatibility with WoW64 on x64-based Windows XP or Vista.

This is the same version that was used at the conference.
The first official release will come soon.

+Features
The first universal 64-bit imports rebuilder
32-bit version included
Interface similar to ImpREC
Integrated 32/64-bit process dumper
IAT AutoSearch from ImageBase or OEP
Unshuffle thunks function
Manual imports editor

-Limitations
No plugin support yet
No AutoTrace feature
No disassembler

The Visual Studio 2005 SP1 redistributable package might be necessary too:
x86:
http://www.microsoft.com/downloads/details.aspx?familyid=200b2fd9-ae1a-4a14-984d-389c36f85647&displaylang=en
x64:
http://www.microsoft.com/downloads/details.aspx?familyid=EB4EBE2D-33C0-4A47-9DD4-B9A6D7BD44DA&displaylang=en
Also listed in: Dump Fixers, Import Editors, Process Dumpers, Unpacking Tools
More details: Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry)



Tool name: imp64
Rating: 0.0 (0 votes)
Author: deroko                        
Website: http://deroko.phearless.org/imp64.rar
Current version:
Last updated: 2008
Direct D/L link: Locally archived copy
License type: Free / Open Source
Description: Here is one tool to fix imports on x64 target (and to dump them as well). This tool was done almost a year ago. GUI really sucks as I'm not very experienced with GUI programming. However import fixing code should do just fine as it uses 1API = 1IID technique which I described in one of my Blog entries. Good thing is that import scanning/fixing code can be extracted from source without a problem as those are held in separate files.

Hope that someone will find this tool useful, at least source code.
Also listed in: (Not listed in any other category)
More details: Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry)



Tool name: Scylla
Rating: 0.0 (0 votes)
Author: Aguila                        
Website: http://forum.tuts4you.com/forum/132-scylla-imports-reconstruction/
Current version: 0.9.6b
Last updated: April 1, 2014
Direct D/L link: Locally archived copy
License type: GNU GPL v3
Description: Scylla - x64/x86 Imports Reconstruction
=======================================

ImpREC, CHimpREC, Imports Fixer... this are all great tools to rebuild an import table,
but they all have some major disadvantages, so I decided to create my own tool for this job.

Scylla's key benefits are:

- x64 and x86 support
- full unicode support (probably some russian or chinese will like this :-) )
- written in C/C++
- plugin support
- works great with Windows 7

This tool was designed to be used with Windows 7 x64, so it is recommend to use this operating system.
But it may work with XP and Vista, too.

Source code is licensed under GNU GENERAL PUBLIC LICENSE v3.0


Known Bugs
----------

### Windows 7 x64

Sometimes the API kernel32.dll GetProcAddress cannot be resolved, because the IAT has an entry from apphelp.dll
Solution? I don't know

### Only Windows XP x64:

Windows XP x64 has some API bugs. 100% correct imports reconstruction is impossible.
If you still want to use XP x64, here are some hints:

* EncodePointer/DecodePointer exported by kernel32.dll have both the same VA.
Scylla, CHimpREC and other tools cannot know which API is correct. You need to fix this manually.
Your fixed dump will probably run fine on XP but crash on Vista/7.

### ImpREC plugin support:

Some ImpREC Plugins don't work with Windows Vista/7 because they don't "return 1" in the DllMain function.


Keyboard Shortcuts
------------------

- CTRL + D: [D]ump
- CTRL + F: [F]ix Dump
- CTRL + R: PE [R]ebuild
- CTRL + O: L[o]ad Tree
- CTRL + S: [S]ave Tree
- CTRL + T: Auto[t]race
- CTRL + G: [G]et Imports
- CTRL + I: [I]AT Autosearch


Changelog
---------

Version 0.9.6b

- fixed math problem with special sections
- fixed windows 8 bug
- fixed data export bug
- improved iat search
- fixed bug in api resolve engine
- new option: parse APIs always from disk -> slower, useful against pe header modifications

Version 0.9.5

- Fixed virtual device bug caused by QueryDosDeviceW bug
- improved process lister
- improved module lister
- improved dump name
- improved IAT parser

Version 0.9.4 Final

- direct import scanner (LEA, MOV, PUSH, CALL, JMP) + fixer with 2 fix methods
- create new iat in section
- fixed various bugs

Version 0.9.3

- new dll function: iat search
- new dll function: iat fix auto

Version 0.9.2

- Pick DLL -> Set DLL Entrypoint
- Advanced IAT Search Algorithm (Enable/Disable it in Options), thanks to ahmadmansoor
- Fixed bug in Options
- Added donate information, please feel free to donate some BTC to support this project

Version 0.9.1

- Fixed virtual device bug
- Fixed 2 minor bugs

Version 0.9

- updated to distorm v3.3
- added application exception handler
- fixed bug in dump engine
- improved "suspend process" feature, messagebox on exit

Version 0.8

- added OriginalFirstThunk support. Thanks to p0c
- fixed malformed dos header bug
- NtCreateThreadEx added infos from waliedassar, thanks!

Version 0.7 Beta

- fixed bug Overlapped Headers: http://forum.tuts4you.com/topic/30213-scylla-overlapped-headers/
- fixed bug SizeOfOptionalHeader: http://forum.tuts4you.com/topic/30060-bug-when-fixing-dump/
- added feature: suspend process for dumping, more information: http://waleedassar.blogspot.com/2012/09/anti-dumping-part-3.html

Version 0.7 Beta

- improved disassembler
- fixed various bugs

Version 0.6b

- internal code changes
- added option: fix iat and oep

Version 0.6a

- fixed buffer to small bug in dump memory

Version 0.6

- added dump memory regions
- added dump pe sections -> you can edit some values in the dialog
- improved dump engine with intelligent dumping
- improved pe rebuild engine -> removed yoda's code
- fixed various bugs

Version 0.5a:

- fixed memory leak
- improved IAT search

Version 0.5:

- added save/load import tree feature
- multi-select in tree view
- fixed black icons problem in tree view
- added keyboard shortcuts
- dll dump + dll dump fix now working
- added support for scattered IATs
- pre select target path in open file dialogs
- improved import resolving engine with api scoring
- api selection dialog
- minor bug fixes and improvements

Version 0.4:

- GUI code improvements
- bug fixes
- imports by ordinal

Version 0.3a:

- Improved import resolving
- fixed buffer overflow errors

Version 0.3:

- ImpREC plugin support
- minor bug fix

Version 0.2a:

- improved disassembler dialog
- improved iat search

Version 0.2:

- improved process detection
- added some options
- new options dialog
- improved source code
Also listed in: Dump Fixers, Process Dumpers
More details: Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry)


RSS feed Feed containing all updates and additions for this category.

RSS feed Feed containing all updates and additions for this category, including sub-categories.





Views
Category Navigation Tree
   Code Coverage Tools  (13)
   Code Ripping Tools  (2)
   Helper Tools  (3)
   Hex Editors  (13)
   Memory Patchers  (7)
   Packers  (19)
   Profiler Tools  (11)
   String Finders  (10)
   Tool Hiding Tools  (7)
   Tracers  (20)
   Needs New Category  (3)