IDA script to fix IAT virtualized/obfuscated by Winlicense/Themida

[Fyyre]

very nice scripts :)

btw, landing on OEP is simple with Winlicense (Windows apps) - bpx on GetSystemTimeAsFileTime. same method I introduce here:

https://github.com/Fyyre/proxy_dll

fyyre

Originally Posted by Carina0206

It doesn't need to fix OEP when dump image and fix IAT in Scylla.
You need to input only correct original IAT starting address and its size.
But if you want to restore dumped image into fully runnable executable, you have to find OEP and fix it in dumped image, and then when eip reached to OEP(by using method to write 2 bytes 0xEB, 0xFE in OEP for infinite looping in OEP) you have to dump image and fix IAT.

And as talking about resource, in most often cases, all resources are recovered after complete all operations in Scylla because all obfuscated resources are fully recovered on memory in run-time.