From Collaborative RCE Tool Library
|Current version:||Official version 1.6 - Unofficial version with misc. fixes 1.7f|
|Last updated:||June 1, 2011|
|Direct D/L link:||Locally archived copy|
|License type:||Free (^-Note: 'Direct D/L URL' is V1.7e !)|
|Description:||The world's most famous IAT rebuilder tool.
The last official version from MackT is still 1.6. The 1.7f update is a third-party patched version of 1.6, which contains the following patches:
v1.7f FINAL (PUBLIC VERSION) fixes by cw2k
- Clean unpack of 'v1.6 FINAL (PUBLIC VERSION)'(UPX) + restoring header & imports
as close as possible to the original header
Short/stripped dos-Stub and other crap & dump grabage that make it to most AntiVirus proggies suspect
virustotal.com before: 33/42 hits now: 0/42 hits
- Reappling and documenting of patches (Scroll to the end of that file)
Improve patch #1 "RestoreLastError" -> SetLastError bugfix
- Adding Fly's GUI-modification
- doing some clean up of the plugins (unpack/removing duplicates)
Also included in the archive:
CHimpREC: The Cheap Imports Reconstructor
by TiGa of ARTeam
This is the 32/64-bit imports rebuilder that I introduced at ReCon 2008 in Montreal.
Made for the best compatibility with WoW64 on x64-based Windows XP or Vista.
The first universal 64-bit imports rebuilder
32-bit version included
Interface similar to ImpREC
Integrated 32/64-bit process dumper
IAT AutoSearch from ImageBase or OEP
Unshuffle thunks function
Manual imports editor
No plugin support yet
No AutoTrace feature
- Fixed RestoreLastError API set to SetLastError for WinXP/Vista compatibility (MaRKuS_TH-DJM)
- user32.dll is always read from the system, prevents a crash from corrupted PE of user32.dll (MaRKuS_TH-DJM)
- Latest version of psapi.dll (6.0.6000.16386) included
- Fixed Vista64 crash bug (jstorme)
- GUI modified and improved (based upon Fly's modification)
- Updated/corrected plugins and deleted dups
v. 1.7a added the following fixes:
- Fixed Win2K crash, AllocConsole was replaced with ActivateActCtx (jstorme)
The local download here contains the last unofficial patch, 1.7e. In addition to that, it also contains a big bunch of plugins, and also source code for many of these plugins (in all well-known programming languages, which is good for use as templates for new plugins etc).
Changes in Version 1.7b:
- Fixed invalid API bug in user32.dll on Windows 98 (jstorme)
- Modified code to improve support for discardable/unreadable sections (jstorme)
- Fixed ImageBase problem with DLL's when "Use PE Header from Disk" is checked (jstorme)
- Added an "ImpREC Classic" looking version
Changes in 1.7c:
- Fixed bug introduced in 1.7b when DLL's have discardable sections (jstorme)
Changes in 1.7d:
- Fixed bug introduced in 1.7b which destroys IAT Autosearch feature in some packed targets, like eXpressor 1.8 (Newbie_Cracker).
- Fixed crash introduced in 1.7b when DLL's PE header has "NO Access" flag (Newbie_Cracker).
Changes in Version v1.7e
- Fixed a bug which avoids ImpREC to fix JMP DWORD [...] if it is located at the end of code section (Newbie_Cracker)
( Thanks to Nexus6 for report the bug and provide samples)
You are welcome to add your own useful notes about this tool, for others to see!
(please also edit it if you think it fits well in some additional category, since this can also be controlled)