Locked ARTeam Import Reconstructor

[sQuo]

This is the hidden content, please

• Sign In
• or
• Sign Up

 

ARTeam Import Reconstructor - ARImpRec.dll - 32-byte Import Rebuilder

 

This is a project that was created specifically for rebuilding imports for Armageddon tool.

But it can be used for any other goal if needed.

 

It allows rebulding any scattered IAT, you now, valid handles between lots of zeroes or garbage dwords, providing a clean IAT. As you probably are guessing, this involves fixing every address in the code pointing to these handles, and the tool allows it.

 

There is also the way of rebuilding as very well known ImpRec tool does, without modifying any address at the code and leaving at the same address every handle, it depends on your needs.

 

There is a GUI tool to perform also this tasks, very similar in appearance to ImpRec tool. The difference with that tool is this selects automatically valid handles, so no valid ones won't appear in the list.

 

There is also ARImpRec.dll that can be used to rebuild imports of any loaded process.

 

Attached two simple launchers that I use to test ARImpRec.dll, one of then for minimizing Armadillo dumps.

 

common.arg file included to see parameters information of functions when debugging with OllyDbg.

 

Check the Readme.txt for more information.

 

If you find any inconsistent info or some bug, please report here to let me improve the tool.

 

Thanks a lot! Special thanks go to LCF-AT for his help on improving lots of features.

 

 

This is the hidden content, please

• Sign In
• or
• Sign Up