Scylla x64/x86 Imports Reconstruction

[Syoma]

Bug report:
---------------------------
Exception! Please report it!
---------------------------
ExceptionCode C0000005
ExceptionFlags 00000000
NumberParameters 00000002
ExceptionAddress VA 77437419
ExceptionAddress RVA 77037419

eax=0x0012EE14, ebx=0x00000000, edx=0x00670601, ecx=0x7E429340, esi=0x0012EE14, edi=0x001AF5A8, ebp=0x0012EDF0, esp=0x0012EDB0, eip=0x77437419
---------------------------
OK
---------------------------

Got it on last chunk entry after manual GetProcAddress fix and press OK. WinXP/x86 SP3, Scylla 0.9.6a

[Syoma]

Feature request:
Add Re-scan names button. Check attached image.
Add Export Tree for ImpRec.

[Carbon]

Sorry for the late reply. I was busy with the ScyllaHide project.

How do you produce the view in NamesBug.png‎? Do you think this are valid api addresses?

Add Export Tree for ImpRec.

I dont want to add this feature directly to scylla, but I coded a small standalone tool for this purpose. I thought about using the imprec format, but it is really terrible so I chose the "right way".


C#.NET, can convert scylla xml to imprec (crap) txt.
https://bitbucket.org/NtQuery/scyllatoimprectree
https://bitbucket.org/NtQuery/scyllatoimprectree/downloads/ScyllaToImprecTree.rar

[Syoma]

Hi, it was some time ago. So, I forgot how I did that. But I think it was done in usual way using some protected application. Yes, that are valid API addresses. I think they are always the same for WinXP SP3/x86. So, you can check by yourself.
Most probable next few days I will do new version of that app and provide more details.
Do you have any information on other reports?

[Utshiha]

great tool to rebuild an import table same ImpREC, CHimpREC, Imports Fixer

Scylla's key benefits are:

x64 and x86 support
full unicode support
written in C/C++
plugin support (ImpREC plugins are supported)
works great with Windows 7
Currently there are only 2 plugins (PECompact, PESpin x64) in this release, full sourcecode for both is included.

................................

[xtiaoshi]

Scylla 0.9.7c

[Carbon]

Version 0.9.8

- Bugfixes for x64, IAT Search
- diStorm3 update from Jan 3rd 2015

[DMichael]

i have made aquick patch till Aguila it self will fix the issues i mentioned:
1.Freeze bug under exe32protector
2.Crash bug under PEP protector
(more details in PM since im dont sure im can post other forum link)

[dnvthv]

Version 0.11.0

- Update `ScyllaIatFixAutoW` and `ScyllaIatSearch` to allow dumping DLLs
- `pyscylla.dump_pe` and `pyscylla.rebuild_pe` now return None and throw
exceptions on failure
- Generate Python bindings for Python 3.8+ (i.e., drop Python 3.7 support)

Version 0.10.0

- Update default configuration
- Add support for Windows 8.1 and Windows 10
- Switch build system to CMake
- Add bindings for Python 3
- Add a new `createNewIat` parameter to `ScyllaIatFixAutoW`
- Fix bad handling of instructions with a REX prefix in `IATReferenceScan:atchNewIat`
- Handle multiple imports that have the same address in `ApiReader::getApiByVirtualAddress`
- Add a Sphinx-generated documentation
- Update distorm to version 3.5.2
- Update WTL to version 10

https://github.com/ergrelet/Scylla
https://github.com/ergrelet/Scylla/releases

[blue_devil]

Version 0.11.2

Changes

• Generate Python bindings for Python 3.12

Download Only Source

https://github.com/ergrelet/Scylla/releases/tag/v0.11.2

Version 0.11.1

Changes

• Fix readMemoryFromProcess to only reprotect to PAGE_READONLY
• Generate Python bindings for Python 3.11

Download (Including binaries)

https://github.com/ergrelet/Scylla/releases/tag/v0.11.1