ARImpRec.DLL - 1.6.4 ---- Updated 2009 December, the 9th

+ An important bug fixed about IAT Size when rebuilding imports by relocations
+ Fixed a bug when rebuilding resources


ARImpRec.DLL - 1.6.3 ---- Updated 2009 December, the 6th

+ Improved detection of overlay offset
+ Fixed rebuilding resources from other section than .rsrc
+ Fixed a bug when rebuilding imports by relocations
+ Added a new type of compiled to rebuild properly all sections
+ Added more possibilities to rebuild overlay 


Previous versions
-----------------

ARImpRec.DLL - 1.6.2 ---- Updated 2009 October, the 17th

+ Improved detection of pdata section
+ Added some checks about PE header of dump
+ Fixed a bug when getting forwarded functions related to Wsock32.dll/ws2_32.dll
+ Fixed a bug that was destroying export table


ARImpRec.DLL - 1.6.1 ---- Updated 2009 October, the 11th

+ Fixed a bug related to pointers for PE header names
+ Improved the rebuilding of sections and relocations for Delphi and Borland C++ targets


ARImpRec.DLL - 1.6.0 ---- Updated 2009 October, the 11th

+ Recoded the Rebuild imports procedure to cover different compiled executables


ARImpRec.DLL - 1.5.2 ---- Updated 2009 October, the 8th

+ Fixed a bug when rebuilding original IT for VC++ targets


ARImpRec.DLL - 1.5.1 ---- Updated 2009 September, the 18th

+ Added support for UPX targets using overlay


ARImpRec.DLL - 1.5.0 ---- Updated 2009 September, the 1st

+ New approach to get overlay offsets


ARImpRec.DLL - 1.4.6 ---- Updated 2009 July, the 27th

+ Fixed a bug when rebuilding imports by using relocations
+ Added overlay detection for newest version of Armadillo


ARImpRec.DLL - 1.4.5 ---- Updated 2009 July, the 11th

+ Fixed a couple of bugs when searching for any possible overlay


ARImpRec.DLL - 1.4.4 ---- Updated 2009 June, the 20th

+ Improved code when rebuilding imports using relocations data


ARImpRec.DLL - 1.4.3 ---- Updated 2009 March, the 13th

+ Fixed bug when rebuilding imports using relocations data


ARImpRec.DLL - 1.4.2 ---- Updated 2009 February, the 26th

+ Fixed some bugs when rebuilding Visual Basic targets
+ Fixed a bug when rebuilding imports using relocations data


ARImpRec.DLL - 1.4.1 ---- Updated 2009 February, the 24th

+ Added analysis of imports using relocations data
+ Fixed some bugs when rebuilding imports


ARImpRec.DLL - 1.4.0 ---- Updated 2009 February, the 17th

+ Added support for zlib packed overlays
+ Improved rebuilding of imports, now based on relocations data, if they exist
+ Added rebuilding of VC++ 3.0 targets
+ Fixed rebuilding of Export Table


ARImpRec.DLL - 1.3.0 ---- Updated 2009 January, the 19th

+ Improved the speed of processing imports, changed the way of accessing the data and the algorithms.
+ Improved the rebuilding of section names for Armadillo 6 when using MinimizeSection.
+ Fixed some bugs for overlay targets.


ARImpRec.DLL - 1.2.2 ---- Updated 2008 November, the 29th

+ Fixed detection of code section of Armadillo for Minimized targets.


ARImpRec.DLL - 1.2.1 ---- Updated 2008 September, the 6th

+ Sorted imports
+ Fixed bug for UPX targets in the Armadillo 6 code.


ARImpRec.DLL - 1.1 ---- Released 2008 March, the 23rd
-----------------------------------------------------------------------
ARTeam Import Reconstructor
-----------------------------------------------------------------------

Abstract
-------

This tool has been coded for completing the tasks of the Armageddon tool by condzero.

The main feature is that it ignores all thunks not valid found between valid ones, and then it rearranges the imports found, rebuilding for every module an only array of thunks.

This is supposed to be in beta version, since it has been tested in a few targets.

Tested on the following compiled:
C++
Delphi
Visual Basic


How to use
----------
Two ways of proceeding:

Either:
call SearchAndRebuildImportsn@24

Or using a function from ARMinSiz.dll for repairing sections, as revirgin:

call RebuildSectionsFromArmadillo@16 function
if return is zero then
 call SearchAndRebuildImportsNoNewSection@24

New
---
It detects, when possible, the exact offset of the import table of virgin.exe. Then , the import table could be rebuilt in the same place where it was created in the first compilation by the developer.
This involves getting uniquely the functions used by the code section. So, it filters the imports found, choosing only the needed by the code section.
In this way the tool is providing a complete unwrapped target, free of protector code.
The import table gets rebuilt inside the existing sections.
These should have been fixed previously by the ARMinSiz.dll module.
It fixes relocation data in PE header, whatever the function called is.

Fixed
-----
Forwarding issues.

Known issues
------------
When using the SearchAndRebuildImportsNoNewSection@24 it takes considerably more time than using the SearchAndRebuildImports@24 function, because of the process of filtering all needed apis among all the ones found.

To be done
----------
Rebuilding import table by ordinal.

//////////////////////////////////////////////////////////////////////////////////////////////
EXPORTED FUNCTIONS
//////////////////////////////////////////////////////////////////////////////////////////////
function GetProcName(IRHModule : cardinal;IRAddress :Cardinal): PChar;stdcall;

exports GetProcName name 'GetProcName@8';


It works in a similar way as the well known GetProcAddress API, but in this case you are getting the name of the function.

Input parameters:
 IRHModule - Handle of a module previously loaded in memory.
 IRAddress - Address of buffer contaning the Virtual Address of the function from what you want to get the Function Name.

Ouptut parameters:
 Return of function is the Name of the API.


#############################################################################################
function GetProcOrdinal(IRHModule : cardinal;IRAddress :Cardinal) : Cardinal;stdcall;

exports GetProcOrdinal name 'GetProcOrdinal@8';

It works in a similar way as the well known GetProcAddress API, but in this case you are getting the ordinal.

Input parameters:
 IRHModule - Handle of a module previously loaded in memory.
 IRAddress - Address of buffer contaning the Virtual Address of the function from what you want to get the Function Name.

Ouptut parameters:
 Return of function is the ordinal.


#############################################################################################
function GetProcNameAndOrdinal(IRHModule : cardinal;IRAddress :Cardinal; var IROrdinal : Cardinal): PChar;stdcall;


exports GetProcNameAndOrdinal name 'GetProcNameAndOrdinal@12';

It works in a similar way as the well known GetProcAddress API, but in this case you are getting the name of the function and the ordinal.

Input parameters:
 IRHModule - Handle of a module previously loaded in memory.
 IRAddress - Address of buffer contaning the Virtual Address of the function from what you want to get the Function Name.

Ouptut parameters:
 IROrdinal returns the ordinal.
 Return of function is the Name of the API.


#############################################################################################
function SearchAndRebuildImports (IRProcessId : Cardinal;
                                  IRNameOfDumped : PChar;
                                  IROEP : Cardinal; // In VAddress
                                  var IRIATRVA : Cardinal;
                                  var IRIATSize : Cardinal;
                                  var IRWarning : PChar) : Integer;stdcall;

exports SearchAndRebuildImports name 'SearchAndRebuildImports@24';

It rebuilds imports in a file previously dumped. IAT gets rebuilt in the same place where it has been found, and Import Table is built in a new section, pasted at the end of the file.
The PE header is fixed for some needed data.

Input parameters:
 IRProcessId - Identifier of a process loaded in memory.
 IRNameOfDumped - Pointer to a string containing the complete name of a file: directory + name of file. This is the dumped from which the rebuilt is going to be generated.
 IROEP - Virtual Address of the Original Entry Point. Note that it cannot come as RVA.
 IRIATRVA - Start address of IAT, as RVA. Zero indicates a search in the entire file.
 IRIATRVA - Size of IAT, as RVA. Zero indicates a search in the entire file.

Ouptut parameters:
 IRIATRVA - Start address of IAT, as RVA.
 IRIATRVA - Size of IAT, as RVA.
 IRWarning - Message of error, if any has been produced. When it happens, it comes with
 Return - 0 if all has gone right. If an error has been produced, it comes with a number associated to the message returned by IRWarning.


#############################################################################################
function SearchAndRebuildImportsNoNewSection (IRProcessId : Cardinal;
                                              IRNameOfDumped : PChar;
                                              IROEP : Cardinal; // In VAddress
                                              var IRIATRVA : Cardinal;
                                              var IRIATSize : Cardinal;
                                              var IRWarning : PChar) : Integer;stdcall;

exports SearchAndRebuildImportsNoNewSection name 'SearchAndRebuildImportsNoNewSection@24';

It rebuilds imports in a file previously dumped. IAT gets rebuilt in the place where it was in the virgin.exe, and Import Table is built in the same place where it was in virgin.exe, too. So, no new section is appended.
This has been coded in that way to let the flash and macromedia overlays get in their exact offset. This wouldn't be possible keeping all sections added by Armadillo.

The PE header is fixed for some needed data.

Input parameters:
 IRProcessId - Identifier of a process loaded in memory.
 IRNameOfDumped - Pointer to a string containing the complete name of a file: directory + name of file. This is the dumped from which the rebuilt is going to be generated.
 IROEP - Virtual Address of the Original Entry Point. Note that it cannot come as RVA.
 IRIATRVA - Start address of IAT, as RVA. Zero indicates a search in the entire file.
 IRIATRVA - Size of IAT, as RVA. Zero indicates a search in the entire file.

Ouptut parameters:
 IRIATRVA - Start address of IAT, as RVA.
 IRIATRVA - Size of IAT, as RVA.
 IRWarning - Message of error, if any has been produced. When it happens, it comes with
 Return - 0 if all has gone right. If an error has been produced, it comes with a number associated to the message returned by IRWarning.


You should invoke any of the previous functions from your code as is indicated in exports line.

For instance, you would code this:
call GetProcName@8 


-----------------------------------------------------------------------------------------
- History -
ARTeam Import Reconstructor 1.0 - Released 2008/02/26

For support in rebuilding DLL's, now OEP should come in Virtual Address (not RVA as before).

Release 2008/01/30
This tool has been coded for completing the tasks of the Armageddon tool by condzero.

The main feature is that it ignores all thunks not valid found between valid ones, and then it rearranges the imports found, rebuilding for every module an only array of thunks.

This is supposed to be in beta version, since it has been tested in a few targets.


I hope all of you could use it for a width range of uses and protections.

I know, speed could be improved, just let me play a little with the tool to find the way.

If you find useful, please report all bugs and desiderable improvement.


This tool is devoted to all my friends of ARTeam.

Coded in Delphi 7 Enterprise.

Nacho_dj / ARteam