Scylla x64/x86 Imports Reconstruction

[ahmadmansoor]

I know this is not a good Idea or stupid Idea ,but for unpacker when he work on unpack he can do this :

when load apphelp.dll
search for
8B 4D 10 89 08 C7 45 E4 01 00 00 00 C7 45 FC FE FF FF FF 8B 45 E4
search for
75C63011 . 8B4D 10 mov ecx, dword ptr [ebp+0x10]
75C63014 8908 mov dword ptr [eax], ecx >>>> nop this
75C63016 . C745 E4 01000000 mov dword ptr [ebp-0x1C], 0x1
75C6301D > C745 FC FEFFFFFF mov dword ptr [ebp-0x4], -0x2
75C63024 . 8B45 E4 mov eax, dword ptr [ebp-0x1C]

and done . so no need to fix this .

[Carbon]

New version

Version 0.9.5

- improved process lister
- improved module lister
- improved dump name
- improved IAT parser

@Computer_Angel
I cannot reproduce the crash, tested with crysis and far cry.

[Computer_Angel]

Originally Posted by Carbon

New version


@Computer_Angel
I cannot reproduce the crash, tested with crysis and far cry.

1.Just test the new version, seem the module lister not list all the module in process.I'll check it more in next day.
2.I'll try to give you the examples about the crash.

[Carbon]

There was a bug with virtual devices...

[Computer_Angel]

Originally Posted by Carbon

There was a bug with virtual devices...

More buggy with lastest release. My binary is on Virtual devices and scylla could not define a correct pathname for it (it show unknow for path). When try to select the process with unknow path ---> crash happen

[Carbon]

Windows doesn't handle virtual devices like it should

This should work now, but the solution is bad...

[ahmadmansoor]

Hi Carbon :
about Computer_Angel target don't care about it, scylla is the best and it Does not need any fix for handle virtual devices.
this sample is an tricky Target it write false size for IMAGE_EXPORT_DIRECTORY which make it very very big so can't handle it with
bufferExportTable = new BYTE[readSize];
so Computer_Angel it is as an anti scylla (or other IAT re builder ) technique .

10001036 |. 50 push eax ; /pOldProtect
10001037 |. 6A 40 push 0x40 ; |NewProtect = PAGE_EXECUTE_READWRITE
10001039 |. 8B3E mov edi, dword ptr [esi] ; |
1000103B |. 6A 04 push 0x4 ; |Size = 0x4
1000103D |. 56 push esi ; |Address
1000103E |. FF15 0>call near dword ptr [<&KERNEL32.VirtualP>; \VirtualProtect
10001044 |. E8 AE0>call scyllacr.100010F7
10001049 |. 0FB6C0 movzx eax, al
1000104C |. 69C0 0>imul eax, eax, 0x1010101
10001052 |. 8906 mov dword ptr [esi], eax
10001054 |. 8946 0>mov dword ptr [esi+0x4], eax <<<<<< very bad

Computer_Angel just one thing ,pls where u get like this targets ,every time u surprise us with this kind of targets ,I work with a lot of targets never get my hand on targets like which u bring it to us .....
Computer_Angel

[Computer_Angel]

Ahmadmansoor , i get this problem when unpack warface game.

[Carbon]

Thanks for the file Computer_Angel and thanks for the help ahmadmansoor.

I added an option to read the export table always from disk. This is slower than reading it from the target process. I guess this is a rare case, so people should only enable it if needed.

Version 0.9.6

- improved iat search
- fixed bug in api resolve engine
- new option: parse APIs always from disk -> slower, useful against pe header modifications

[Syoma]

Very good release )
Could you please collapse all nodes after chunks merge at the end?
Also, if possible add option to set image header flag "relocations stripped" on Dump.
May be also option to automatically save tree on Dump as ModuleName-Tree.xml

[Syoma]

Bug report:
Missed entries in the chunks. Check image.
http://rghost.ru/53312007/image.png

[Carbon]

Originally Posted by Syoma

Bug report:
Missed entries in the chunks. Check image.
http://rghost.ru/53312007/image.png

Thanks for the report. Are you sure that this is a mistake? What entry did scylla miss? Can you please show me the spot in olly with dump view "Long -> address with ascii dump".

[Syoma]

Yes, I am sure it is mistake. The missed import entries are data-related, not functions. Like __declspec(dllexport) int i; and the same for structures instances.

Also, the same problem with msvcr90.dll import
150 __CppXcptFilter dd ?
154 _adjust_fdiv dd ? // <<----- this one was missed in chunk
158 _amsg_exit dd ?

I do not use Olly. So, not sure what you asking for.

[Carbon]

Thanks, I forgot that data exports exist... this should fix it.

[Syoma]

Bug report:
Consequent chunks merged to single branch (check attached image)

Feature request:
Often, especially in Delphi, you can see multiple kernel32.dll chunks with the same functions (which may be stolen). Could you please add extra loop to check all entries with the same address and fix them at once?
For example: suppose GetProcAddress stolen and we have 3 chunks where function redirected to stub 00112233. Select 00112233 entry in Scylla, resolve function manually - get it resolved in all 3 chunks.

Initialize function select dialog with default module name value.
For example: we process kernel32.dll chunk. DLL module name with very high probability would be the same as any chunk entry above current. For the first entry some heuristic possible by module names frequency calculation for all entries in the chunk.

Add option 'Save tree on exit' or Exit confirmation dialog.
It is quite terrible to find Scylla window closed by extra ESC when over 50 entries already processed.