Scylla x64/x86 Imports Reconstruction

Killboy · #1 10-04-2011, 04:33

Quote:

ImpREC, CHimpREC, Imports Fixer... this are all great tools to rebuild an import table, but they all have some major disadvantages, so I decided to create my own tool for this job.

Scylla's key benefits are:

- x64 and x86 support
- full unicode support (probably some russian or chinese will like this :-) )
- written in C/C++
- plugin support
- works great with Windows 7

And the best, Scylla is open source under the GNU GPL v3.

Basically, it's ImpRec on speed

If you miss a feature or want to report a bug, head on over to the support forum on Tuts4You.

Links:
Official support forum
Download page
Source code download

I attached the current version (0.4) here:

orfei · #2 10-05-2011, 15:45

Works great Windows 7 x64.
Thanks for info.

copyleft · #3 10-08-2011, 11:30

Two main features "Save Tree" & "Load Tree" are disabled in both X86 & x64.
very difficult to use without Saving/Loading capability .

giv · #4 10-08-2011, 14:43

I tryed this software. It's a good one. But is not as good as Imprec 1.7
As i said before on other forums. It needs some improvements.
Example:
I found OEP on a target protected by PECompact 2.xx
Dumped and tried to reconstruct IAT.
With ImpREc completed the OEP -> get imports all valid. The dump is fixed alright.
With this not all impots are valid and so on....

Killboy · #5 10-09-2011, 04:51

Well, if you have any bug reports or suggestions you can post them at Tuts4You. I'm sure the author can't browse every single RE forum looking for posts with bugs.

Unlike ImpRec this tool is in active development and open source at that, so chances are these bugs will get fixed. You just have to clearly state what's wrong, what you expect instead and a test sample that can be used for bug hunting.

Killboy · #6 10-20-2011, 07:53

Version 0.5:

Quote:

- added save/load import tree feature
- multi-select in tree view
- fixed black icons problem in tree view
- added keyboard shortcuts
- dll dump + dll dump fix now working
- added support for scattered IATs
- pre select target path in open file dialogs
- improved import resolving engine with api scoring
- api selection
- minor bug fixes and improvements

cracker[PYG] · #7 10-20-2011, 17:50

Works great my Windows 7 x86.
Thanks you very much

JeRRy · #8 03-17-2012, 01:33

Scylla 0.6 Beta

Quote:

Here is a new beta version of Scylla. Please test it.

Changelog:
- Dump memory feature
- Bugfixes
- Many core and source code improvements

Download
http://www.mediafire.com/?yy43wzb2if2ar7i

JeRRy · #9 03-17-2012, 06:22

Scylla 0.6 Beta 2

Quote:

-Fixed "Cannot dump image" bug.
-Added a "force dump" switch.

deepzero · #10 03-18-2012, 23:01

careful, this beta is apparently broken:

Quote:

Ah damn, the api resolving function is totally broken. The "source code improvements" created a problem somehow. Don't know yet. The 0.6 beta versions should not be used to rebuild an IAT...

giv · #11 03-19-2012, 14:32

Yes indeed..
I tryed to restore some IAT but the proggy has found nothing.
ImpRec works fine instead.
I will wait for further bug repairs....

deepzero · #12 03-19-2012, 15:38

Quote:

Thanks NikolayD and LCF-AT for the bug report.

Here you have a fixed version. This version should work fine again. Sorry for the broken app Posted Image

I am just working on a pe section dump function. This will be awesome. You can easily defeat protectors with the "big virtual size" anti dump protection (like asprotect). Big virtual sizes will be highlighted and you can correct the virtual size, so you can dump a small exe without any problems :crazy:

Big thanks to Aguila for his great work.

asterix · #13 03-31-2012, 16:48

Thanks for the source code

nikre · #14 04-05-2012, 09:24

where the source code?

metr0 · #15 04-06-2012, 07:36

See first post, thanks.

Thread Tools
Show Printable Version Email this Page
Display Modes
Switch to Linear Mode Hybrid Mode Switch to Threaded Mode

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Scylla IAT finder and Dumper	Storm Shadow	Source Code	6	05-05-2015 02:22
More Armadillo - import reconstruction	FEARHQ	General Discussion	8	09-19-2005 16:46

The Following 13 Users Gave Reputation+1 to Killboy For This Useful Post:
apex (10-05-2011), chessgod101 (10-04-2011), copyleft (10-04-2011), cracker[PYG] (10-20-2011), danger_end (10-06-2011), giv (10-04-2011), henry_y (10-07-2011), N0P (10-06-2011), nulli (10-04-2011), quygia128 (10-09-2011), zementmischer (10-04-2011), \|roe (10-07-2011)

The Following 3 Users Gave Reputation+1 to Killboy For This Useful Post:
chessgod101 (10-20-2011), cracker[PYG] (10-20-2011), henry_y (10-20-2011)

The Following 3 Users Gave Reputation+1 to JeRRy For This Useful Post:
chessgod101 (03-17-2012), giv (03-17-2012), memcpy (03-17-2012)

The Following 5 Users Gave Reputation+1 to JeRRy For This Useful Post:
chessgod101 (03-17-2012), giv (03-18-2012), kjms (03-17-2012), oVERfLOW (03-17-2012)

The Following 2 Users Gave Reputation+1 to deepzero For This Useful Post:
chessgod101 (03-20-2012), Ember (03-20-2012)