Scylla x64/x86 Imports Reconstruction

[tenketsu]

Scylla Imports Reconstruction 0.6b tested on Win7 x64 and works nice, thanks!

[nikre]

Scylla v0.8

many changes

[WilliamElts]

The source code is now available at:

https://github.com/NtQuery/Scylla

Changelog for version 0.8:

added OriginalFirstThunk support. Thanks to p0c
fixed malformed dos header bug
NtCreateThreadEx added infos from waliedassar, thanks!

[WilliamElts]

Version 0.9 has been released.
Homepage:

https://github.com/NtQuery/Scylla

Changelog:

updated to distorm v3.3
added application exception handler
fixed bug in dump engine
improved "suspend process" feature, messagebox on exit

[cybercoder]

This works very well for me, just sometimes it may put the wrong import in place. This a great project looking forward to some extra features.

[ahmadmansoor]

this is a bug fix from Aguila

I noticed some problems with virtual devices.

thanks to him

[giv]

At least some news from Aguila. And from Ahmad too. :-)

[Carbon]

Version 0.9.1

- Fixed virtual device bug
- Fixed 2 minor bugs

[ahmadmansoor]

is there are any way for the Src for the new version? .
Thanks for ur great work

[sendersu]

Scylla author, could I ask you to pay some attention to this old issue please?

if import in form
libA.FnA
unknown func
libA.FnC

most probable the "unknown" is also from libA.
It means:
1. You can guess DLL name for "Select function" dialog
2. No need to split chunks on first unknown entry

Thanks

[Newbie_Cracker]

Today I tried to unpack a DLL and use Scylla, but it did not read its OEP from file/memory.

It seems that Scylla does not read DLL OEP in case of DLL Unpacking.

Am I right?

[Carbon]

@Newbie_Cracker
I don't get it. You need to find the OEP yourself?

@sendersu
I don't think this is a problem. I will think about it. It is because Scylla doesnt pay attention to the api order (like imprec). Scylla is using a different algorithm.

@ahmadmansoor
here: https://github.com/NtQuery/Scylla

[Newbie_Cracker]

Originally Posted by Carbon

@Newbie_Cracker
I don't get it. You need to find the OEP yourself?

In Scylla, like ImpRec, when you choose a process, the OEP is read from PE header and automatically is shown in OEP text box.

Imprec does the same for DLLs, but Scylla does not.

It seems that it reads the ImageBase and ImageSize from memory (I haven't debugged it to check), but it does not read the OEP from the disk/memory.

[ahmadmansoor]

just one thing pls upload the distorm 3.1 folder which u use .
I can't access it .
is there a problem to compile it with v10 instead of v9.0 of VS 2010
Thanks

[deepzero]

where do these new version come from? They are not mentioned on t4u, Scylla's home.