From Collaborative RCE Tool Library

Jump to: navigation, search


Tool name: ImpREC
Rating: 4.0 (3 votes)
Author: MackT                        
Current version: Official version 1.6 - Unofficial version with misc. fixes 1.7f
Last updated: June 1, 2011
Direct D/L link: Locally archived copy
License type: Free (^-Note: 'Direct D/L URL' is V1.7e !)
Description: The world's most famous IAT rebuilder tool.

The last official version from MackT is still 1.6. The 1.7f update is a third-party patched version of 1.6, which contains the following patches:

v1.7f FINAL (PUBLIC VERSION) fixes by cw2k
- Clean unpack of 'v1.6 FINAL (PUBLIC VERSION)'(UPX) + restoring header & imports
as close as possible to the original header
Short/stripped dos-Stub and other crap & dump grabage that make it to most AntiVirus proggies suspect before: 33/42 hits now: 0/42 hits

- Reappling and documenting of patches (Scroll to the end of that file)
Improve patch #1 "RestoreLastError" -> SetLastError bugfix

- Adding Fly's GUI-modification

- doing some clean up of the plugins (unpack/removing duplicates)

Also included in the archive:

CHimpREC: The Cheap Imports Reconstructor
by TiGa of ARTeam

This is the 32/64-bit imports rebuilder that I introduced at ReCon 2008 in Montreal.
Made for the best compatibility with WoW64 on x64-based Windows XP or Vista.

The first universal 64-bit imports rebuilder
32-bit version included
Interface similar to ImpREC
Integrated 32/64-bit process dumper
IAT AutoSearch from ImageBase or OEP
Unshuffle thunks function
Manual imports editor

No plugin support yet
No AutoTrace feature
No disassembler



- Fixed RestoreLastError API set to SetLastError for WinXP/Vista compatibility (MaRKuS_TH-DJM)
- user32.dll is always read from the system, prevents a crash from corrupted PE of user32.dll (MaRKuS_TH-DJM)
- Latest version of psapi.dll (6.0.6000.16386) included
- Fixed Vista64 crash bug (jstorme)
- GUI modified and improved (based upon Fly's modification)
- Updated/corrected plugins and deleted dups

v. 1.7a added the following fixes:

- Misc
- Fixed Win2K crash, AllocConsole was replaced with ActivateActCtx (jstorme)

The local download here contains the last unofficial patch, 1.7e. In addition to that, it also contains a big bunch of plugins, and also source code for many of these plugins (in all well-known programming languages, which is good for use as templates for new plugins etc).

Changes in Version 1.7b:

- Misc
- Fixed invalid API bug in user32.dll on Windows 98 (jstorme)
- Modified code to improve support for discardable/unreadable sections (jstorme)
- Fixed ImageBase problem with DLL's when "Use PE Header from Disk" is checked (jstorme)
- Added an "ImpREC Classic" looking version

Changes in 1.7c:

- Fixed bug introduced in 1.7b when DLL's have discardable sections (jstorme)

Changes in 1.7d:

- Misc
- Fixed bug introduced in 1.7b which destroys IAT Autosearch feature in some packed targets, like eXpressor 1.8 (Newbie_Cracker).
- Fixed crash introduced in 1.7b when DLL's PE header has "NO Access" flag (Newbie_Cracker).

Changes in Version v1.7e

- Misc
- Fixed a bug which avoids ImpREC to fix JMP DWORD [...] if it is located at the end of code section (Newbie_Cracker)
( Thanks to Nexus6 for report the bug and provide samples)
Related URLs:
Library of good ImpREC extensions:

RSS feed Feed containing all updates for this tool.

You are welcome to add your own useful notes about this tool, for others to see!

If you find that any information for the tool above is missing, outdated or incorrect, please edit it!
(please also edit it if you think it fits well in some additional category, since this can also be controlled)

Category Navigation Tree
   Code Coverage Tools  (13)
   Code Ripping Tools  (2)
   Helper Tools  (3)
   Hex Editors  (13)
   Memory Patchers  (7)
   Packers  (20)
   Profiler Tools  (11)
   String Finders  (10)
   Tool Hiding Tools  (8)
   Tracers  (23)
   Dump Fixers  (5)
   IAT Restore Tools  (6)
   .NET MSIL Dumpers  (2)
   Process Dumpers  (12)
   OEP Finders  (6)
   Needs New Category  (3)