From Collaborative RCE Tool Library
IAT Restore Tools
| Tool name: | ImpREC |
| ||
|---|---|---|---|---|
| Author: | MackT | |||
| Website: | http://www.tuts4you.com/forum/index.php?showtopic=6410 | |||
| Current version: | Official version 1.6 - Unofficial version with misc. fixes 1.7c | |||
| Last updated: | March 10, 2008 | |||
| Direct D/L link: | Locally archived copy | |||
| License type: | Free | |||
| Description: | The world's most famous IAT rebuilder tool. NOTE: The last official version from MackT is still 1.6. The 1.7a update is a third-party patched version of 1.6, which contains the following patches: - Fixed RestoreLastError API set to SetLastError for WinXP/Vista compatibility (MaRKuS_TH-DJM) - user32.dll is always read from the system, prevents a crash from corrupted PE of user32.dll (MaRKuS_TH-DJM) - Latest version of psapi.dll (6.0.6000.16386) included - Fixed Vista64 crash bug (jstorme) - GUI modified and improved (based upon Fly's modification) - Updated/corrected plugins and deleted dups v. 1.7a added the following fixes: - Misc - Fixed Win2K crash, AllocConsole was replaced with ActivateActCtx (jstorme) Because of this, the local download here contains both the last official version 1.6, and the last unofficial patch, 1.7a. In addition to that, it also contains a big bunch of plugins, and also source code for many of these plugins (in all well-known programming languages, which is good for use as templates for new plugins etc). Changes in Version 1.7b: - Misc - Fixed invalid API bug in user32.dll on Windows 98 (jstorme) - Modified code to improve support for discardable/unreadable sections (jstorme) - Fixed ImageBase problem with DLL's when "Use PE Header from Disk" is checked (jstorme) - Added an "ImpREC Classic" looking version Changes in 1.7c: - Fixed bug introduced in 1.7b when DLL's have discardable sections (jstorme) | |||
| Also listed in: | Process Dumpers | |||
| More details: | Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry) | |||
| Tool name: | ACProtect 2.0 OEP Finder + IAT Repair OllyScript |
| ||
|---|---|---|---|---|
| Author: | ColdFever | |||
| Website: | N/A | |||
| Current version: | ||||
| Last updated: | February 10, 2007 | |||
| Direct D/L link: | Locally archived copy | |||
| License type: | Free | |||
| Description: | ACProtect 2.0 OEP Finder + IAT Repair | |||
| Also listed in: | OEP Finders, OllyScript Scripts | |||
| More details: | Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry) | |||
| Tool name: | CHimpREC |
| ||
|---|---|---|---|---|
| Author: | Sébastien Doucet (TiGa) | |||
| Website: | http://www.iitac.org | |||
| Current version: | ReCon Edition | |||
| Last updated: | June 23rd, 2008 | |||
| Direct D/L link: | Locally archived copy | |||
| License type: | Freeware | |||
| Description: | CHimpREC: The Cheap Imports Reconstructor by TiGa of ARTeam IITAC (http://www.iitac.org) This is the 32/64-bit imports rebuilder that I introduced at ReCon 2008 in Montreal. Made for the best compatibility with WoW64 on x64-based Windows XP or Vista. This is the same version that was used at the conference. The first official release will come soon. +Features The first universal 64-bit imports rebuilder 32-bit version included Interface similar to ImpREC Integrated 32/64-bit process dumper IAT AutoSearch from ImageBase or OEP Unshuffle thunks function Manual imports editor -Limitations No plugin support yet No AutoTrace feature No disassembler The Visual Studio 2005 SP1 redistributable package might be necessary too: x86: http://www.microsoft.com/downloads/details.aspx?familyid=200b2fd9-ae1a-4a14-984d-389c36f85647&displaylang=en x64: http://www.microsoft.com/downloads/details.aspx?familyid=EB4EBE2D-33C0-4A47-9DD4-B9A6D7BD44DA&displaylang=en | |||
| Also listed in: | Dump Fixers, Import Editors, Process Dumpers, Unpacking Tools | |||
| More details: | Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry) | |||
| Tool name: | Universal Import Fixer |
| ||
|---|---|---|---|---|
| Author: | Magic_h2001 | |||
| Website: | http://magic.shabgard.org | |||
| Current version: | 1.2 | |||
| Last updated: | July 6, 2008 | |||
| Direct D/L link: | Locally archived copy | |||
| License type: | Free | |||
| Description: | Use this tool for fixing Import Elimination, Directly Imports, Shuffled, Disordered, Scattered and Hashed Imports. So you can use this tool for changing IAT Base Address and Sorting IATs. Tested on: Armadillo ASProtect Enigma ExeCryptor eXPressor PeSpin RlPack TheMida WinLicense HyperUnpackMe and any protector with Import Elimination, Directly Imports and Hashed Imports. A Flash tutorial for unpacking eXPressor with Universal Import Fixer is included in the local download package. Use this tool for fixing Import Elimination, Directly Imports and Shuffled, Disordered, Scattered Imports. So you can use this tool for changing IAT Base Address and Sorting IATs in New (other) Address. Tested on: Armadillo ASProtect Enigma ExeCryptor eXPressor PeSpin RlPack TheMida WinLicense and any protector with Import Elimination, Directly Imports and Shuffled, Disordered, Scattered Imports. Notes: ====== This tool is an Import Fixer (not Import Rebuilder ImpRec etc) and Just work in memory of target process. Always first use UIF then Dump target process. UIF can fix actual APIs, dont use it for fixing Emulated/Redirected APIs to protector's stub.you must use UIF After fixing Magic IAT jump (or use any methods) to convert Emulated/Redirected APIs to Actual APIs. Samples: Armadillo : Import Elimination ASProtect : Directly Imports Enigma : Shuffled, Disordered, Scattered Imports ExeCryptor : Scattered Imports in Protector Stub eXPressor : Directly Imports PeSpin : Directly, Shuffled, Disordered, Scattered Imports RlPack : Shuffled, Disordered, Scattered Imports TheMida : Directly Imports WinLicense : Directly Imports | |||
| Also listed in: | (Not listed in any other category) | |||
| More details: | Click here for more details, screenshots, related URLs & comments for this tool! (or to update its entry) | |||
Feed containing all updates and additions for this category.
Feed containing all updates and additions for this category, including sub-categories.
