=======================================================================================
              Import REConstructor v1.2 beta1 by MackT/uCF2000 in 2001

                       - *Tested on Win 98SE, NT4 SP3 & 2K* -
=======================================================================================

Disclaimer:
-----------
This program may crash, or in a worse case it may even reboot your computer, so please use
it with caution. (Do not run it 3 hours into an unsaved coding session for example)

I am *NOT* responsible for any damage caused by the use of it.


Purpose:
--------
This tool is designed to rebuild all new imports datas from a corrupted IAT (redirected
pointers or not by a PE-packer for example).
It reconstructs a new Image Import Descriptor, IAT and all ASCII functions names.
So it's not designed for newbies... sorry, you have to read PE docs first.

** SUPPORT NT/2000! **


What it needs?
--------------
- A full dump of the target

- A running process of your target (for the tracer engine)

- You have to find OEP manually for using the Original IAT auto finder (button
  'IAT AutoSearch')
  Else you need the range which contains the Original IAT

- If you are under win9x, launch icedump 6.0.2.2 (http://icedump.tsx.org) before executing
  your target, to rebuild a better portable executable (thanks to the icedump team ;-))
  (You must have soft ice loaded of course for icedump)


How it works?
-------------
1 - Select the target in the process list

2 - If you have the OEP:
	- Enter it in the appropriate editbox and press "IAT AutoSearch" button to get
	  possible rva address and size values which can contain the original IAT
    Else:
	- Enter the rva address and size of IAT

3 - Press "Get Import" button and wait

4 - If you see some unresolved functions in IAT, try to solve them by clicking on the
    "Trace all ????" button. If there's no result, try to trace manually in it. If you
    found it, double click on it in the "Imported Functions Found" list and change it
    manually.

    ** It's possible that it does not "really" belong to the original IAT so let it as it
       is, the 6th step will delete it **

5 - Repeat the 2nd step until you have all you want

6 - Press on "Ultra Arrange" to delete all "incorrect" thunks arrays (the tracer could find
    some wrong imported functions... nobody is perfect :-))

7 - Enter an "available" space in your dump file to put the new import datas else click on
    the "Add new section" checkbox to add a new section for new import

8 - Press Fix to fix your dump file. You don't need to make a backup. If your filename is
    "Dump.exe", it will create "Dump_.exe". Moreover the OEP of your dump will be fixed on
    the value you have entered in the editbox so check it before fixing any dump.

9 - Enjoy ;-)


Options:
--------
- "Import all by ordinal" : this function only works under Win9x. It needs less size than
  the usual import (by name and ordinal) but is not portable.
  Use it ** IF AND ONLY IF ** you only want to rebuild the exe only for your system and
  want a smaller file.

- The "Max Recursion" is the number of conditionnal jumps or calls it's allowed to follow.
  More this number is big and more you have to wait, use it CAREFULLY.

- The "Buffer Size" is the size of the allocated memory block for tracing for EACH
  recursion.


Notes and Advises:
------------------
- If the Original IAT AutoFinder fails, several method can be tried:

	- Try to play with "Max Recursion" or/and "Buffer Size" in the options.

	- Try to use the tracer in the .rdata or .idata section.

	- If it fails, try each section but it's not a good method

	- The best method (which the Original IAT AutoFinder tries to do) is to trace at
	  the OEP and look for the first API call, get the address and use the tracer into
	  the WHOLE section which contains this address. (Be ready to crash between!
          because of invalid pointers... You're warned)

- If the IAT is cutted in different sections, you can use the tracer in each section.
  (never seen at the moment but who knows...)

- If the "Trace all ????" failed. Try to play with the "Max Recursion" or/and "Buffer Size"
  in the options.

- I advise you to put the new import datas into the last section if it was packed. Because
  all packers i know, put their garbage in the last section. Add a new section only if you
  don't care about the size of your rebuilded executable.

- Visual Basic application which was packed, does not work for NT/2K, need to know why ...


Tested on
---------
- UPX (dunno versions...)
- CDilla1!!! (YEAH! ;-))
- PECompact
- PKLite32
- Shrinker
- ASPack, ASProtect (still need to find a way to emulate own ASProtect APIs)
- More??? :-)


To do
-----
- A button for showing all invalid pointers in the tree (by selecting them)
- Tracer Level3
- Load and Save Trees
- An ini file which contains selected options
- Make a 100% portable executable (do what icedump does but for all exports :-))
- The tracer can be fool so its improvement is always to be done


Limitations
-----------
- Because of frequent accesses to memory of this tool, it can crash or even simply reboot
  your machine so use it carefully.
- The rebuilded executable is not 100% portable on any system because of several export
  API functions (in kernel32.dll and other) which point to the same address (we do not have
  a bijection). Use icedump for solving a part under win9x. On NT/2000, you have "less"
  export API functions which got this problem so you will have "more" chance to get a
  compatible rebuilded executable (it's only based on chance :-P).
- The original-IAT auto finder will not work if this one is not "enough" contigous (cutted
  in different part of the exe for each thunks) so you will have to put RVA and size
  manually, sorry.


Personal greeting:
------------------
Look at the 'About' dialog box. :-)


Special thanks to:
------------------
- Cronos for his Borg Disassembler source
- Tseph who got the idea the first and answering me even if i do a tool like him
  (-> Revirgin ;-))
- Titi and Yoda for their help and support
- The Owl for helping me with forwarding export functions ;-)
- Lightdruid for making me laugh (I'm still waiting to crush you in UT... :-))
- Thigo for beta testing... Thanks a lot m8 ;-)
- Christoph G. for his precious advises and support (without him, i would give up i think)
- EliCZ for ApiHooks
- Quantico who is waiting for v1.0... erm, no comments! :-D


Questions/Suggestions/Solutions:
--------------------------------
mackt@ucf2000.com
