: What it is?
   RL!Weasle is an OllyDBG plugin that can help you reslove invalid ImpRec imports. It feautures unique specialized tracers and several different generic tracer levels for protections that copy data from dlls and store them to allocated space. This is done by obfuscation skipping and hashing correct instructions that are then compared to original .dll ones.

:: How to install?
If you have original and unmodified version of OllyDBG.exe just copy weasle.dll and dLDE.dll (deroko`s lenght disassm engine) to OllyDBG plugin folder. If you use modified OllyDBG version (like OllyICE or OllyShadow) then unpack weasle.dll file with upx -d option and then copy .dll files to OllyDBG plugin folder.

:: How to use it?
In Search filed enter the address which contains the API pointers (eg. 77xxxxxx) and the size of searching. Then press Search (+Search adds new APIs to the list and Search makes a new list). If API redirection is used use Trace Levels (from 1 to 3) and if it is a special API redirection you can use specialized tracers.

Trace Level 1 - traces until a long jump, or PUSH then RET, or until 0x00
Trace Level 2 - traces until a long jump, or PUSH then RET, or until 0x00, or until RETx
Trace Level 3 - traces until a long jump, or PUSH then RET, or until 0x00, or until RETx (ignores nil instuctions NOP, etc.)

Tutorial on plugin using: Unpacking PESpin 1.304
Tutorial on plugin using: Unpacking SLVc0deProtector 1.11

:: Can I report a bug or contact the autor?
   Here is the contact information which you can use to contact me:
     Handle:     ap0x
     WebSite:   http://ap0x.headcoders.net
     Email:       ap0x.rce(at)gmail(dot)(com)

:: History:

v.0.3 beta
+ Public release [protection myDeFeNCe/alfa NOT cracked, yet!]
+ Released on: xx/xx/200x
- Added Set API breakpoint option
- Added Select menu
- Added Go to menu
- Added Specialized tracer
- Added TraceLevel 1-3

http://ap0x.headcoders.net/weasle.rar

[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！