首页
社区
课程
招聘
[推荐]Scylla - x64/x86 Imports Reconstruction 0.9.1
发表于: 2013-9-20 15:23 3141

[推荐]Scylla - x64/x86 Imports Reconstruction 0.9.1

2013-9-20 15:23
3141
05cK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6%4N6%4N6Q4x3X3g2$3M7$3y4W2L8W2)9J5k6h3y4G2L8g2)9J5c8W2)9K6c8Y4y4Z5j5i4u0W2i4K6y4p5L8p5#2z5c8f1A6V1
ImpREC, CHimpREC, Imports Fixer... this are all great tools to rebuild an import table, but they all have some major disadvantages, so I decided to create my own tool for this job.

Scylla's key benefits are:

- x64 and x86 support
- full unicode support (probably some Russian or Chinese will like this :-) )
- written in C/C++
- plugin support
- works great with Windows 7

This tool was designed to be used with Windows 7 x64, so it is recommend to use this operating system. But it may work with XP and Vista, too.

Source code is licensed under GNU GENERAL PUBLIC LICENSE v3.0


Known Bugs
----------

### Only Windows XP x64:

Windows XP x64 has some API bugs. 100% correct imports reconstruction is impossible. If you still want to use XP x64, here are some hints:

* EncodePointer/DecodePointer exported by kernel32.dll have both the same VA.
Scylla, CHimpREC and other tools cannot know which API is correct. You need to fix this manually.
Your fixed dump will probably run fine on XP but crash on Vista/7.

### ImpREC plugin support:

Some ImpREC Plugins don't work with Windows Vista/7 because they don't "return 1" in the DllMain function.

[培训]科锐软件逆向54期预科班、正式班开始火爆招生报名啦!!!

收藏
免费 0
支持
分享
最新回复 (2)
雪    币: 239
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
2
没更新日记?
2013-9-20 16:22
0
雪    币: 202
活跃值: (61)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
3
好消息,下一个用用先。
2013-9-20 17:44
0
游客
登录 | 注册 方可回帖
返回