IDA script to fix IAT virtualized/obfuscated by Winlicense/Themida

[kernel]

Hi, thank you for the script. First time i see IDA script for fixing IAT. The script looks very simple. Are you sure it works without landing at OEP and fixing OEP or you have to enter OEP manually after fixing IAT? Themida also obfuscates the resources. They also have to be fixed.

[Carina0206]

Originally Posted by kernel

Hi, thank you for the script. First time i see IDA script for fixing IAT. The script looks very simple. Are you sure it works without landing at OEP and fixing OEP or you have to enter OEP manually after fixing IAT? Themida also obfuscates the resources. They also have to be fixed.

It doesn't need to fix OEP when dump image and fix IAT in Scylla.
You need to input only correct original IAT starting address and its size.
But if you want to restore dumped image into fully runnable executable, you have to find OEP and fix it in dumped image, and then when eip reached to OEP(by using method to write 2 bytes 0xEB, 0xFE in OEP for infinite looping in OEP) you have to dump image and fix IAT.

And as talking about resource, in most often cases, all resources are recovered after complete all operations in Scylla because all obfuscated resources are fully recovered on memory in run-time.

[Fyyre]

very nice scripts :)

btw, landing on OEP is simple with Winlicense (Windows apps) - bpx on GetSystemTimeAsFileTime. same method I introduce here:

https://github.com/Fyyre/proxy_dll

fyyre

Originally Posted by Carina0206

It doesn't need to fix OEP when dump image and fix IAT in Scylla.
You need to input only correct original IAT starting address and its size.
But if you want to restore dumped image into fully runnable executable, you have to find OEP and fix it in dumped image, and then when eip reached to OEP(by using method to write 2 bytes 0xEB, 0xFE in OEP for infinite looping in OEP) you have to dump image and fix IAT.

And as talking about resource, in most often cases, all resources are recovered after complete all operations in Scylla because all obfuscated resources are fully recovered on memory in run-time.