Exetools - Scylla x64/x86 Imports Reconstruction

Page 1 of 3

Show 40 post(s) from this thread on one page

Exetools (https://forum.exetools.com/index.php)

- Community Tools (https://forum.exetools.com/forumdisplay.php?f=47)

- - Scylla x64/x86 Imports Reconstruction (https://forum.exetools.com/showthread.php?t=13792)

Killboy

10-04-2011 04:33

Scylla x64/x86 Imports Reconstruction

2 Attachment(s)

Quote:

ImpREC, CHimpREC, Imports Fixer... this are all great tools to rebuild an import table, but they all have some major disadvantages, so I decided to create my own tool for this job.

Scylla's key benefits are:

- x64 and x86 support
- full unicode support (probably some russian or chinese will like this :-) )
- written in C/C++
- plugin support
- works great with Windows 7

And the best, Scylla is open source under the GNU GPL v3.

Basically, it's ImpRec on speed :) If you miss a feature or want to report a bug, head on over to the support forum on Tuts4You.

Links:
Official support forum
Download page
Source code download

I attached the current version (0.4) here:

orfei

10-05-2011 15:45

Works great Windows 7 x64.
Thanks for info.

copyleft

10-08-2011 11:30

Two main features "Save Tree" & "Load Tree" are disabled in both X86 & x64.
very difficult to use without Saving/Loading capability .

giv	10-08-2011 14:43

I tryed this software. It's a good one. But is not as good as Imprec 1.7
As i said before on other forums. It needs some improvements.
Example:
I found OEP on a target protected by PECompact 2.xx
Dumped and tried to reconstruct IAT.
With ImpREc completed the OEP -> get imports all valid. The dump is fixed alright.
With this not all impots are valid and so on....

Killboy

10-09-2011 04:51

Well, if you have any bug reports or suggestions you can post them at Tuts4You. I'm sure the author can't browse every single RE forum looking for posts with bugs.

Unlike ImpRec this tool is in active development and open source at that, so chances are these bugs will get fixed. You just have to clearly state what's wrong, what you expect instead and a test sample that can be used for bug hunting.

Killboy

10-20-2011 07:53

2 Attachment(s)

Version 0.5:

Quote:

- added save/load import tree feature
- multi-select in tree view
- fixed black icons problem in tree view
- added keyboard shortcuts
- dll dump + dll dump fix now working
- added support for scattered IATs
- pre select target path in open file dialogs
- improved import resolving engine with api scoring
- api selection
- minor bug fixes and improvements

cracker[PYG]

10-20-2011 17:50

Works great my Windows 7 x86.
Thanks you very much

JeRRy

03-17-2012 01:33

Scylla 0.6 Beta

Quote:

Here is a new beta version of Scylla. Please test it.

Changelog:
- Dump memory feature
- Bugfixes
- Many core and source code improvements

Download
http://www.mediafire.com/?yy43wzb2if2ar7i

JeRRy

03-17-2012 06:22

1 Attachment(s)

Scylla 0.6 Beta 2

Quote:

-Fixed "Cannot dump image" bug.
-Added a "force dump" switch.

deepzero

03-18-2012 23:01

careful, this beta is apparently broken:

Quote:

Ah damn, the api resolving function is totally broken. The "source code improvements" created a problem somehow. Don't know yet. The 0.6 beta versions should not be used to rebuild an IAT...

giv	03-19-2012 14:32

Yes indeed..
I tryed to restore some IAT but the proggy has found nothing.
ImpRec works fine instead.
I will wait for further bug repairs....

deepzero

03-19-2012 15:38

Scylla_v0.6_Beta_3

1 Attachment(s)

Quote:

Thanks NikolayD and LCF-AT for the bug report.

Here you have a fixed version. This version should work fine again. Sorry for the broken app Posted Image

I am just working on a pe section dump function. This will be awesome. You can easily defeat protectors with the "big virtual size" anti dump protection (like asprotect). Big virtual sizes will be highlighted and you can correct the virtual size, so you can dump a small exe without any problems :crazy:

Big thanks to Aguila for his great work. :)

asterix

03-31-2012 16:48

Thanks for the source code

nikre

04-05-2012 09:24

where the source code?

metr0

04-06-2012 07:36

See first post, thanks.

nikre

04-06-2012 08:09

for release 0.6 no source?

JeRRy

04-15-2012 02:21

1 Attachment(s)

Scylla v0.6 Beta 4

Quote:

Originally Posted by Aguila (Post 78219)

Here is a new beta with some bug fixes.

Dump pe section still doesn't work, because I need to do some code refactoring first. Removing crap code

Download
Mediafire
Direct Link

nikre

05-02-2012 11:20

2 Attachment(s)

Scylla v0.6 Final

Quote:

- added dump memory regions
- added dump pe sections -> you can edit some values in the dialog
- improved dump engine with intelligent dumping
- improved pe rebuild engine -> removed yoda's code
- fixed various bugs

LaDidi

05-06-2012 03:36

@KillBoy:
A great idea... moreover with source code.
I will try with next unpack...

nikre

05-06-2012 23:10

1 Attachment(s)

Scylla version 0.7 Beta

Quote:

Main difference between v0.6 is the more powerful disassembler. Can be accessed via Misc -> Disassembler. Try right click -> Follow

ahmadmansoor

05-10-2012 05:28

Bug

Hi Killboy :I think there r a bug .
for UPX (new release) - targets ( example uTorrent) .
It can't get the IAT by AutoSearch (after I enter the OEP)
and It can't get the IAT even I enter IAT manually .
reason The text section is Read only -Access =R-
why it is bug ( ImpRec wrok fine and find the IAT -AutoSearch and manually )

Quote:

hxxp://i50.tinypic.com/2dbvvqd.jpg

JeRRy

05-10-2012 15:38

@ahmadmansoor

You have to enter "VA" in the OEP, not RVA.

Quote:

http://i.imgur.com/brSDO.png

ahmadmansoor

05-10-2012 17:25

Lolllllllllll,I didn't note this ,Thanks JeRRy for clarify this ,as u know most old tools use RVA.

JeRRy

05-10-2012 18:38

Quote:

as u know most old tools use RVA.

Indeed, i was confused too when using Scylla first time :p

BiT-H@cK

05-12-2012 02:39

nikre, big thx 4 release, greate tool, long been the replacement for the ImpRec

WilliamElts

07-20-2012 10:46

Scylla 0.7 beta 5

1 Attachment(s)

Scylla as DLL/EXE Version has been released.

Thanks to Aguila.

deroko

07-21-2012 19:11

Nice tool :) Much nicer than my imp64 :P

WilliamElts

07-23-2012 19:35

Scylla 0.7 beta 6

1 Attachment(s)

Scylla 0.7 beta 6 has been released

WilliamElts

10-02-2012 13:18

1 Attachment(s)

Scylla x64/x86 Imports Reconstruction 0.7 Beta 7

Changelog

Code:

- fixed bug in the dump engine: more details here http://forum.tuts4you.com/topic/30060-bug-when-fixing-dump/

- added "suspend process option", look in options dialog: more details here http://waleedassar.blogspot.com/2012/09/anti-dumping-part-3.html

Download : attachment

xtiaoshi

10-18-2012 20:23

1 Attachment(s)

Scylla_v0.7 beta8
Thanks to Aguila.

tenketsu

10-22-2012 02:30

Scylla Imports Reconstruction 0.6b tested on Win7 x64 and works nice, thanks!

nikre

12-01-2012 04:23

1 Attachment(s)

Scylla v0.8

Quote:

many changes

WilliamElts

12-03-2012 15:34

The source code is now available at:

Quote:

https://github.com/NtQuery/Scylla

Changelog for version 0.8:

Quote:

added OriginalFirstThunk support. Thanks to p0c
fixed malformed dos header bug
NtCreateThreadEx added infos from waliedassar, thanks!

WilliamElts

02-11-2013 21:03

Version 0.9 has been released.
Homepage:

Quote:

https://github.com/NtQuery/Scylla

Changelog:

Quote:

updated to distorm v3.3
added application exception handler
fixed bug in dump engine
improved "suspend process" feature, messagebox on exit

cybercoder

05-05-2013 07:22

This works very well for me, just sometimes it may put the wrong import in place. This a great project looking forward to some extra features. :)

ahmadmansoor

09-01-2013 00:06

Bug fix

1 Attachment(s)

this is a bug fix from Aguila

Quote:

I noticed some problems with virtual devices.

thanks to him

giv	09-01-2013 01:39

At least some news from Aguila. And from Ahmad too. :-)

Carbon

09-03-2013 01:45

Code:

Version 0.9.1



- Fixed virtual device bug

- Fixed 2 minor bugs

ahmadmansoor

09-03-2013 19:52

is there are any way for the Src for the new version? .
Thanks for ur great work

sendersu

09-03-2013 20:11

Scylla author, could I ask you to pay some attention to this old issue please?

if import in form
libA.FnA
unknown func
libA.FnC

most probable the "unknown" is also from libA.
It means:
1. You can guess DLL name for "Select function" dialog
2. No need to split chunks on first unknown entry

Thanks

All times are GMT +8. The time now is 23:55.

Page 1 of 3

Show 40 post(s) from this thread on one page