=====================================================================================
Import REConstructor v0.6a beta by MackT/uCF2000 in 2001 - *tested on Win 98SE & 2K *
=====================================================================================

Disclaimer:
-----------
This program may crash, or in a worse case it may even reboot your computer, so please use
it with caution. (Do not run it 3 hours into an unsaved coding session for example)

I am *NOT* responsible for any damage caused by the use of it.


Purpose:
--------
This tool is designed to rebuild all new imports datas from an corrupted IAT (redirected
pointers or not by a PE-packer for example).
It reconstructs a new Image Import Descriptor, IAT and all ASCII functions names.
So it's not designed for newbies... sorry, you have to read PE docs first.

** FINALLY SUPPORT NT/2000. NEED TO TEST IT DEEPLY THOUGH **


What it needs?
--------------
- A full dump of the target

- A running process of your target (for the tracer engine)

- Range which contains the IAT (easy to find if you got the OEP)

- If you are under win9x, launch icedump 6.0.2.2 (http://icedump.tsx.org) before executing
  your target, to rebuild a 100% portable executable (or very very close, thanks to the
  icedump team ;-))

Note: you have to find OEP and fix it manually if the exe was PE-packed but it's not needed
      for rebuilding import


How it works?
-------------
1 - Select the target in the process list

2 - Enter the rva address and size of IAT

3 - Press Search and wait

4 - If you see some unresolved functions in IAT, try to solve them by clicking on the button
    "Trace all ????". If there's no result, double click on it in the "Imported Functions
    Found" list and change it manually so you must know what it is exactly.

5 - Repeat the 2nd step until you have all you want

6 - Enter an "available" space in your dump file to put the new import datas else click on
    the checkbox "Add new section"

7 - Press Fix to fix your dump file. You don't need to make a backup. If your filename is
    "Dump.exe", it will create "Dump_.exe"

8 - Enjoy ;-)


Notes and Advises
-----------------
- To find the IAT, try to use the tracer in the .rdata or .idata section. If it fails, try
  each section but it's not a good method. The best method is to trace at the OEP and look
  for the first API call, get the address and use the tracer into the section which
  contains this address.

- If the IAT is cutted in different sections, you can use the tracer in each section.
  (never seen at the moment...)

- If the "Trace all ????" failed. Try to grow up the "Max Recursion" or/and "Buffer Size"
  in the options.

  - The "Max Recursion" is the number of conditionnal jumps or calls it's allowed to
    follow. More this number is big and more you have to wait, use it carefully.
  - The "Buffer Size" is the size of the allocated memory block for tracing for each
    recursion.

- I advise you to put the new import datas into the last section if it was packed. Because
  all packers i know, put their garbage in the last section. Add a new section only if you
  don't care about the size of your rebuilded executable.

- DO NOT ACTIVATE 'import all by ordinal' because it's not portable.
  Use it ** IF AND ONLY IF ** you only want to rebuild the exe for your system and want a
  smaller file. You must be under win9x for activating it between.


Tested on
---------
- UPX (dunno versions...)
- ASPack, ASProtect
- More??? :-)


To do
-----
- An "Arrange" button which will delete all invalid thunk list (like a strict level)
- An auto original-IAT finder
- Improve the function editor for add and delete functions in IAT
- Make a 100% portable executable

- The tracer can be fool so its improvement is always to be done


Limitations
-----------
- Because of frequent accesses to memory of this tool, it can crash or even simply reboot
  your machine so use it carefully.
- The rebuilded executable is not 100% portable on any system because of several export
  API functions (in kernel32.dll and other) which point to the same address. Use icedump
  for solving that under win9x. On NT/2000, you have "less" export API functions which got
  this problem so "more" chance to have a compatible rebuilded executable.


Personal greeting:
------------------
Look at the 'About' dialog box. :-)


Special thanks to:
------------------
- Cronos for his Borg Disassembler source
- Tseph who got the idea the first and answering me even if i do a tool like him
  (-> Revirgin ;-))
- MoD, Titi, Yoda for their help and support
- The Owl for helping me with forwarding export functions ;-)
- Lightdruid for making me laugh (I'm still waiting to crush you in UT... :-))

Questions/Suggestions/Solutions:
--------------------------------
mackt@ucf2000.com
