No OneTemporary
Actions

Size

139 KB

Subscribers

None

View Options

	diff --git a/Scylla/ConfigurationHolder.cpp b/Scylla/ConfigurationHolder.cpp
	index 37dad7d..3d7ef0c 100644
	--- a/Scylla/ConfigurationHolder.cpp
	+++ b/Scylla/ConfigurationHolder.cpp
	@@ -1,204 +1,205 @@
	#include "ConfigurationHolder.h"

	#include <shlwapi.h>
	#include "Architecture.h"

	const WCHAR ConfigurationHolder::CONFIG_FILE_SECTION_NAME[] = L"SCYLLA_CONFIG";

	//#define DEBUG_COMMENTS

	ConfigurationHolder::ConfigurationHolder(const WCHAR* fileName)
	{
	config[USE_PE_HEADER_FROM_DISK] = Configuration(L"USE_PE_HEADER_FROM_DISK", Configuration::Boolean);
	config[DEBUG_PRIVILEGE] = Configuration(L"DEBUG_PRIVILEGE", Configuration::Boolean);
	config[CREATE_BACKUP] = Configuration(L"CREATE_BACKUP", Configuration::Boolean);
	config[DLL_INJECTION_AUTO_UNLOAD] = Configuration(L"DLL_INJECTION_AUTO_UNLOAD", Configuration::Boolean);
	config[UPDATE_HEADER_CHECKSUM] = Configuration(L"UPDATE_HEADER_CHECKSUM", Configuration::Boolean);
	config[IAT_SECTION_NAME] = Configuration(L"IAT_SECTION_NAME", Configuration::String);
	config[REMOVE_DOS_HEADER_STUB] = Configuration(L"REMOVE_DOS_HEADER_STUB", Configuration::Boolean);
	config[IAT_FIX_AND_OEP_FIX] = Configuration(L"IAT_FIX_AND_OEP_FIX", Configuration::Boolean);
	config[SUSPEND_PROCESS_FOR_DUMPING] = Configuration(L"SUSPEND_PROCESS_FOR_DUMPING", Configuration::Boolean);
	config[OriginalFirstThunk_SUPPORT] = Configuration(L"OriginalFirstThunk_SUPPORT", Configuration::Boolean);
	config[USE_ADVANCED_IAT_SEARCH] = Configuration(L"USE_ADVANCED_IAT_SEARCH", Configuration::Boolean);
	config[SCAN_AND_FIX_DIRECT_IMPORTS] = Configuration(L"SCAN_AND_FIX_DIRECT_IMPORTS", Configuration::Boolean);
	+ config[CREATE_NEW_IAT_IN_SECTION] = Configuration(L"CREATE_NEW_IAT_IN_SECTION", Configuration::Boolean);
	buildConfigFilePath(fileName);
	}

	bool ConfigurationHolder::loadConfiguration()
	{
	std::map<ConfigOption, Configuration>::iterator mapIter;

	if (configPath[0] == '\0')
	{
	return false;
	}

	for (mapIter = config.begin() ; mapIter != config.end(); mapIter++)
	{
	Configuration& configObject = mapIter->second;
	loadConfig(configObject);
	}

	return true;
	}

	bool ConfigurationHolder::saveConfiguration() const
	{
	std::map<ConfigOption, Configuration>::const_iterator mapIter;

	if (configPath[0] == '\0')
	{
	return false;
	}

	for (mapIter = config.begin() ; mapIter != config.end(); mapIter++)
	{
	const Configuration& configObject = mapIter->second;
	if (!saveConfig(configObject))
	{
	return false;
	}
	}

	return true;
	}

	Configuration& ConfigurationHolder::operator[](ConfigOption option)
	{
	return config[option];
	}

	const Configuration& ConfigurationHolder::operator[](ConfigOption option) const
	{
	static const Configuration dummy;

	std::map<ConfigOption, Configuration>::const_iterator found = config.find(option);
	if(found != config.end())
	{
	return found->second;
	}
	else
	{
	return dummy;
	}
	}

	bool ConfigurationHolder::saveNumericToConfigFile(const Configuration & configObject, int nBase) const
	{
	WCHAR buf[21]; // UINT64_MAX in dec has 20 digits

	if (nBase == 16)
	{
	swprintf_s(buf, PRINTF_DWORD_PTR_FULL, configObject.getNumeric());
	}
	else
	{
	swprintf_s(buf, PRINTF_INTEGER, configObject.getNumeric());
	}

	BOOL ret = WritePrivateProfileString(CONFIG_FILE_SECTION_NAME, configObject.getName(), buf, configPath);
	return ret == TRUE;
	}

	bool ConfigurationHolder::readNumericFromConfigFile(Configuration & configObject, int nBase)
	{
	WCHAR buf[21]; // UINT64_MAX in dec has 20 digits
	DWORD read = GetPrivateProfileString(CONFIG_FILE_SECTION_NAME, configObject.getName(), L"", buf, _countof(buf), configPath);

	if (read > 0 && wcslen(buf) > 0)
	{
	#ifdef _WIN64
	configObject.setNumeric(_wcstoui64(buf, NULL, nBase));
	#else
	configObject.setNumeric(wcstoul(buf, NULL, nBase));
	#endif
	return true;
	}

	return false;
	}

	bool ConfigurationHolder::saveStringToConfigFile(const Configuration & configObject) const
	{
	BOOL ret = WritePrivateProfileString(CONFIG_FILE_SECTION_NAME, configObject.getName(), configObject.getString(), configPath);
	return ret == TRUE;
	}

	bool ConfigurationHolder::readStringFromConfigFile(Configuration & configObject)
	{
	WCHAR buf[Configuration::CONFIG_STRING_LENGTH];
	DWORD read = GetPrivateProfileString(CONFIG_FILE_SECTION_NAME, configObject.getName(), L"", buf, _countof(buf), configPath);
	if(read > 0 && wcslen(buf) > 0)
	{
	configObject.setString(buf);
	return true;
	}

	return false;
	}

	bool ConfigurationHolder::readBooleanFromConfigFile(Configuration & configObject)
	{
	UINT val = GetPrivateProfileInt(CONFIG_FILE_SECTION_NAME, configObject.getName(), 0, configPath);
	configObject.setBool(val != 0);
	return true;
	}

	bool ConfigurationHolder::saveBooleanToConfigFile(const Configuration & configObject) const
	{
	const WCHAR *boolValue = configObject.isTrue() ? L"1" : L"0";
	BOOL ret = WritePrivateProfileString(CONFIG_FILE_SECTION_NAME, configObject.getName(), boolValue, configPath);
	return ret == TRUE;
	}

	bool ConfigurationHolder::loadConfig(Configuration & configObject)
	{
	switch (configObject.getType())
	{
	case Configuration::String:
	return readStringFromConfigFile(configObject);
	case Configuration::Boolean:
	return readBooleanFromConfigFile(configObject);
	case Configuration::Decimal:
	return readNumericFromConfigFile(configObject, 10);
	case Configuration::Hexadecimal:
	return readNumericFromConfigFile(configObject, 16);
	default:
	return false;
	}
	}

	bool ConfigurationHolder::saveConfig(const Configuration & configObject) const
	{
	switch (configObject.getType())
	{
	case Configuration::String:
	return saveStringToConfigFile(configObject);
	case Configuration::Boolean:
	return saveBooleanToConfigFile(configObject);
	case Configuration::Decimal:
	return saveNumericToConfigFile(configObject, 10);
	case Configuration::Hexadecimal:
	return saveNumericToConfigFile(configObject, 16);
	default:
	return false;
	}
	}

	bool ConfigurationHolder::buildConfigFilePath(const WCHAR* fileName)
	{
	ZeroMemory(configPath, sizeof(configPath));

	if (!GetModuleFileName(0, configPath, _countof(configPath)))
	{
	#ifdef DEBUG_COMMENTS
	Scylla::debugLog.log(L"buildConfigFilePath :: GetModuleFileName failed %d", GetLastError());
	#endif
	return false;
	}

	PathRemoveFileSpec(configPath);
	PathAppend(configPath, fileName);

	return true;
	}
	diff --git a/Scylla/ConfigurationHolder.h b/Scylla/ConfigurationHolder.h
	index c0f3b1f..bd533ac 100644
	--- a/Scylla/ConfigurationHolder.h
	+++ b/Scylla/ConfigurationHolder.h
	@@ -1,54 +1,55 @@
	#pragma once

	#include <windows.h>
	#include <map>
	#include "Configuration.h"

	enum ConfigOption
	{
	USE_PE_HEADER_FROM_DISK,
	DEBUG_PRIVILEGE,
	CREATE_BACKUP,
	DLL_INJECTION_AUTO_UNLOAD,
	IAT_SECTION_NAME,
	UPDATE_HEADER_CHECKSUM,
	REMOVE_DOS_HEADER_STUB,
	IAT_FIX_AND_OEP_FIX,
	SUSPEND_PROCESS_FOR_DUMPING,
	OriginalFirstThunk_SUPPORT,
	USE_ADVANCED_IAT_SEARCH,
	- SCAN_AND_FIX_DIRECT_IMPORTS
	+ SCAN_AND_FIX_DIRECT_IMPORTS,
	+ CREATE_NEW_IAT_IN_SECTION
	};

	class ConfigurationHolder
	{
	public:

	ConfigurationHolder(const WCHAR* fileName);

	bool loadConfiguration();
	bool saveConfiguration() const;

	Configuration& operator[](ConfigOption option);
	const Configuration& operator[](ConfigOption option) const;

	private:

	static const WCHAR CONFIG_FILE_SECTION_NAME[];

	WCHAR configPath[MAX_PATH];
	std::map<ConfigOption, Configuration> config;

	bool buildConfigFilePath(const WCHAR* fileName);

	bool readStringFromConfigFile(Configuration & configObject);
	bool readBooleanFromConfigFile(Configuration & configObject);
	bool readNumericFromConfigFile(Configuration & configObject, int nBase);

	bool saveStringToConfigFile(const Configuration & configObject) const;
	bool saveBooleanToConfigFile(const Configuration & configObject) const;
	bool saveNumericToConfigFile(const Configuration & configObject, int nBase) const;

	bool loadConfig(Configuration & configObject);
	bool saveConfig(const Configuration & configObject) const;
	};
	diff --git a/Scylla/IATReferenceScan.cpp b/Scylla/IATReferenceScan.cpp
	index 439e25e..1a5ad03 100644
	--- a/Scylla/IATReferenceScan.cpp
	+++ b/Scylla/IATReferenceScan.cpp
	@@ -1,405 +1,437 @@
	#include "IATReferenceScan.h"
	#include "Scylla.h"
	#include "Architecture.h"

	//#define DEBUG_COMMENTS


	int IATReferenceScan::numberOfFoundDirectImports()
	{
	return (int)iatDirectImportList.size();
	}

	void IATReferenceScan::startScan(DWORD_PTR imageBase, DWORD imageSize, DWORD_PTR iatAddress, DWORD iatSize)
	{
	MEMORY_BASIC_INFORMATION memBasic = {0};

	IatAddressVA = iatAddress;
	IatSize = iatSize;
	ImageBase = imageBase;
	ImageSize = imageSize;

	iatReferenceList.clear();
	iatDirectImportList.clear();

	iatReferenceList.reserve(200);
	iatDirectImportList.reserve(50);

	DWORD_PTR section = imageBase;

	do
	{
	if (!VirtualQueryEx(ProcessAccessHelp::hProcess, (LPCVOID)section, &memBasic, sizeof(MEMORY_BASIC_INFORMATION)))
	{
	#ifdef DEBUG_COMMENTS
	Scylla::debugLog.log(L"VirtualQueryEx failed %d", GetLastError());
	#endif

	break;
	}
	else
	{
	if (isPageExecutable(memBasic.Protect))
	{
	//do read and scan
	scanMemoryPage(memBasic.BaseAddress, memBasic.RegionSize);
	}
	}

	section = (DWORD_PTR)((SIZE_T)section + memBasic.RegionSize);

	} while (section < (imageBase + imageSize));


	}

	-void IATReferenceScan::patchNewIatBaseMemory(DWORD_PTR newIatBaseAddress)
	-{
	- NewIatAddressVA = newIatBaseAddress;
	-
	- for (std::vector<IATReference>::iterator iter = iatReferenceList.begin(); iter != iatReferenceList.end(); iter++)
	- {
	- patchReferenceInMemory(&(*iter));
	- }
	-}
	-
	-void IATReferenceScan::patchNewIatBaseFile(DWORD_PTR newIatBaseAddress)
	-{
	- NewIatAddressVA = newIatBaseAddress;
	-
	- for (std::vector<IATReference>::iterator iter = iatReferenceList.begin(); iter != iatReferenceList.end(); iter++)
	- {
	- patchReferenceInFile(&(*iter));
	- }
	-}
	+//void IATReferenceScan::patchNewIatBaseMemory(DWORD_PTR newIatBaseAddress)
	+//{
	+// NewIatAddressVA = newIatBaseAddress;
	+//
	+// for (std::vector<IATReference>::iterator iter = iatReferenceList.begin(); iter != iatReferenceList.end(); iter++)
	+// {
	+// patchReferenceInMemory(&(*iter));
	+// }
	+//}
	+//
	+//void IATReferenceScan::patchNewIatBaseFile(DWORD_PTR newIatBaseAddress)
	+//{
	+// NewIatAddressVA = newIatBaseAddress;
	+//
	+// for (std::vector<IATReference>::iterator iter = iatReferenceList.begin(); iter != iatReferenceList.end(); iter++)
	+// {
	+// patchReferenceInFile(&(*iter));
	+// }
	+//}

	void IATReferenceScan::patchDirectImportsMemory()
	{
	for (std::vector<IATReference>::iterator iter = iatDirectImportList.begin(); iter != iatDirectImportList.end(); iter++)
	{
	patchDirectImportInMemory(&(*iter));
	}
	}


	bool IATReferenceScan::isPageExecutable( DWORD Protect )
	{
	if (Protect & PAGE_NOCACHE) Protect ^= PAGE_NOCACHE;

	if (Protect & PAGE_WRITECOMBINE) Protect ^= PAGE_WRITECOMBINE;

	switch(Protect)
	{
	case PAGE_EXECUTE:
	{
	return true;
	}
	case PAGE_EXECUTE_READ:
	{
	return true;
	}
	case PAGE_EXECUTE_READWRITE:
	{
	return true;
	}
	case PAGE_EXECUTE_WRITECOPY:
	{
	return true;
	}
	default:
	return false;
	}

	}

	void IATReferenceScan::scanMemoryPage( PVOID BaseAddress, SIZE_T RegionSize )
	{
	BYTE * dataBuffer = (BYTE *)calloc(RegionSize, 1);
	BYTE * currentPos = dataBuffer;
	int currentSize = (int)RegionSize;
	DWORD_PTR currentOffset = (DWORD_PTR)BaseAddress;
	_DecodeResult res;
	unsigned int instructionsCount = 0, next = 0;

	if (!dataBuffer)
	return;

	if (ProcessAccessHelp::readMemoryFromProcess((DWORD_PTR)BaseAddress, RegionSize, (LPVOID)dataBuffer))
	{
	while (1)
	{
	ZeroMemory(&ProcessAccessHelp::decomposerCi, sizeof(_CodeInfo));
	ProcessAccessHelp::decomposerCi.code = currentPos;
	ProcessAccessHelp::decomposerCi.codeLen = currentSize;
	ProcessAccessHelp::decomposerCi.dt = ProcessAccessHelp::dt;
	ProcessAccessHelp::decomposerCi.codeOffset = currentOffset;

	instructionsCount = 0;

	res = distorm_decompose(&ProcessAccessHelp::decomposerCi, ProcessAccessHelp::decomposerResult, sizeof(ProcessAccessHelp::decomposerResult)/sizeof(ProcessAccessHelp::decomposerResult[0]), &instructionsCount);

	if (res == DECRES_INPUTERR)
	{
	break;
	}

	for (unsigned int i = 0; i < instructionsCount; i++)
	{
	if (ProcessAccessHelp::decomposerResult[i].flags != FLAG_NOT_DECODABLE)
	{
	analyzeInstruction(&ProcessAccessHelp::decomposerResult[i]);
	}
	}

	if (res == DECRES_SUCCESS) break; // All instructions were decoded.
	else if (instructionsCount == 0) break;

	next = (unsigned long)(ProcessAccessHelp::decomposerResult[instructionsCount-1].addr - ProcessAccessHelp::decomposerResult[0].addr);

	if (ProcessAccessHelp::decomposerResult[instructionsCount-1].flags != FLAG_NOT_DECODABLE)
	{
	next += ProcessAccessHelp::decomposerResult[instructionsCount-1].size;
	}

	currentPos += next;
	currentOffset += next;
	currentSize -= next;
	}
	}

	free(dataBuffer);
	}

	void IATReferenceScan::analyzeInstruction( _DInst * instruction )
	{
	if (ScanForNormalImports)
	{
	findNormalIatReference(instruction);
	}

	if (ScanForDirectImports)
	{
	findDirectIatReference(instruction);
	}
	}

	void IATReferenceScan::findNormalIatReference( _DInst * instruction )
	{
	#ifdef DEBUG_COMMENTS
	_DecodedInst inst;
	#endif

	IATReference ref;


	if (META_GET_FC(instruction->meta) == FC_CALL \|\| META_GET_FC(instruction->meta) == FC_UNC_BRANCH)
	{
	if (instruction->size >= 5)
	{
	if (META_GET_FC(instruction->meta) == FC_CALL)
	{
	ref.type = IAT_REFERENCE_PTR_CALL;
	}
	else
	{
	ref.type = IAT_REFERENCE_PTR_JMP;
	}
	ref.addressVA = (DWORD_PTR)instruction->addr;

	#ifdef _WIN64
	if (instruction->flags & FLAG_RIP_RELATIVE)
	{

	#ifdef DEBUG_COMMENTS
	distorm_format(&ProcessAccessHelp::decomposerCi, instruction, &inst);
	Scylla::debugLog.log(PRINTF_DWORD_PTR_FULL L" " PRINTF_DWORD_PTR_FULL L" %S %S %d %d - target address: " PRINTF_DWORD_PTR_FULL, (DWORD_PTR)instruction->addr, ImageBase, inst.mnemonic.p, inst.operands.p, instruction->ops[0].type, instruction->size, INSTRUCTION_GET_RIP_TARGET(instruction));
	#endif

	if (INSTRUCTION_GET_RIP_TARGET(instruction) >= IatAddressVA && INSTRUCTION_GET_RIP_TARGET(instruction) < (IatAddressVA + IatSize))
	{
	ref.targetPointer = INSTRUCTION_GET_RIP_TARGET(instruction);

	getIatEntryAddress(&ref);

	//Scylla::debugLog.log(L"iat entry "PRINTF_DWORD_PTR_FULL,ref.targetAddressInIat);

	iatReferenceList.push_back(ref);
	}
	}
	#else

	if (instruction->ops[0].type == O_DISP)
	{
	//jmp dword ptr \|\| call dword ptr
	#ifdef DEBUG_COMMENTS
	distorm_format(&ProcessAccessHelp::decomposerCi, instruction, &inst);
	Scylla::debugLog.log(PRINTF_DWORD_PTR_FULL L" " PRINTF_DWORD_PTR_FULL L" %S %S %d %d - target address: " PRINTF_DWORD_PTR_FULL, (DWORD_PTR)instruction->addr, ImageBase, inst.mnemonic.p, inst.operands.p, instruction->ops[0].type, instruction->size, instruction->disp);
	#endif

	if (instruction->disp >= IatAddressVA && instruction->disp < (IatAddressVA + IatSize))
	{
	ref.targetPointer = (DWORD_PTR)instruction->disp;

	getIatEntryAddress(&ref);

	//Scylla::debugLog.log(L"iat entry "PRINTF_DWORD_PTR_FULL,ref.targetAddressInIat);

	iatReferenceList.push_back(ref);
	}
	}
	#endif
	}
	}
	}

	void IATReferenceScan::getIatEntryAddress( IATReference * ref )
	{
	if (!ProcessAccessHelp::readMemoryFromProcess(ref->targetPointer, sizeof(DWORD_PTR), &ref->targetAddressInIat))
	{
	ref->targetAddressInIat = 0;
	}
	}

	void IATReferenceScan::findDirectIatReference( _DInst * instruction )
	{
	#ifdef DEBUG_COMMENTS
	_DecodedInst inst;
	#endif

	IATReference ref;
	ref.targetPointer = 0;


	if (META_GET_FC(instruction->meta) == FC_CALL \|\| META_GET_FC(instruction->meta) == FC_UNC_BRANCH)
	{
	if ((instruction->size >= 5) && (instruction->ops[0].type == O_PC)) //CALL/JMP 0x00000000
	{
	if (META_GET_FC(instruction->meta) == FC_CALL)
	{
	ref.type = IAT_REFERENCE_DIRECT_CALL;
	}
	else
	{
	ref.type = IAT_REFERENCE_DIRECT_JMP;
	}
	ref.addressVA = (DWORD_PTR)instruction->addr;
	ref.targetAddressInIat = (DWORD_PTR)INSTRUCTION_GET_TARGET(instruction);

	if ((ref.targetAddressInIat < ImageBase) \|\| (ref.targetAddressInIat > (ImageBase+ImageSize))) //call/JMP outside pe image
	{
	if (isAddressValidMemory(ref.targetAddressInIat))
	{
	#ifdef DEBUG_COMMENTS
	distorm_format(&ProcessAccessHelp::decomposerCi, instruction, &inst);
	Scylla::debugLog.log(PRINTF_DWORD_PTR_FULL L" " PRINTF_DWORD_PTR_FULL L" %S %S %d %d - target address: " PRINTF_DWORD_PTR_FULL,(DWORD_PTR)instruction->addr, ImageBase, inst.mnemonic.p, inst.operands.p, instruction->ops[0].type, instruction->size, INSTRUCTION_GET_TARGET(instruction));
	#endif

	iatDirectImportList.push_back(ref);
	}
	}
	}
	}
	}

	bool IATReferenceScan::isAddressValidMemory( DWORD_PTR address )
	{
	MEMORY_BASIC_INFORMATION memBasic = {0};

	if (!VirtualQueryEx(ProcessAccessHelp::hProcess, (LPCVOID)address, &memBasic, sizeof(MEMORY_BASIC_INFORMATION)))
	{
	return false;
	}

	return (memBasic.Type == MEM_IMAGE);
	}

	void IATReferenceScan::patchReferenceInMemory( IATReference * ref )
	{
	- DWORD_PTR newIatAddressPointer = ref->targetPointer - IatAddressVA + NewIatAddressVA;
	+ DWORD_PTR newIatAddressPointer = ref->targetPointer - IatAddressVA + NewIatAddressRVA;

	DWORD patchBytes = 0;

	#ifdef _WIN64
	patchBytes = (DWORD)(newIatAddressPointer - ref->addressVA - 6);
	#else
	patchBytes = newIatAddressPointer;
	#endif
	ProcessAccessHelp::writeMemoryToProcess(ref->addressVA + 2, sizeof(DWORD), &patchBytes);
	}

	void IATReferenceScan::patchReferenceInFile( IATReference * ref )
	{
	DWORD_PTR newIatAddressPointer = (ref->targetPointer - IatAddressVA) + NewIatAddressRVA + standardImageBase;

	DWORD patchBytes = 0;

	#ifdef _WIN64
	patchBytes = (DWORD)(newIatAddressPointer - (ref->addressVA - ImageBase + standardImageBase) - 6);
	#else
	patchBytes = newIatAddressPointer;
	#endif


	}

	void IATReferenceScan::patchDirectImportInMemory( IATReference * ref )
	{
	DWORD patchBytes = 0;
	BYTE patchPreBytes[2];

	ref->targetPointer = lookUpIatForPointer(ref->targetAddressInIat);
	if (ref->targetPointer)
	{
	patchPreBytes[0] = 0xFF;

	if (ref->type == IAT_REFERENCE_DIRECT_CALL) //FF15
	{
	patchPreBytes[1] = 0x15;
	}
	else if (ref->type == IAT_REFERENCE_DIRECT_JMP) //FF25
	{
	patchPreBytes[1] = 0x25;
	}
	else
	{
	return;
	}

	ProcessAccessHelp::writeMemoryToProcess(ref->addressVA, 2, patchPreBytes);

	#ifdef _WIN64
	patchBytes = (DWORD)(ref->targetPointer - ref->addressVA - 6);
	#else
	patchBytes = ref->targetPointer;
	#endif
	ProcessAccessHelp::writeMemoryToProcess(ref->addressVA + 2, sizeof(DWORD), &patchBytes);
	}
	}

	DWORD_PTR IATReferenceScan::lookUpIatForPointer( DWORD_PTR addr )
	{
	if (!iatBackup)
	{
	- iatBackup = (DWORD_PTR *)calloc(IatSize + 1, 1);
	+ iatBackup = (DWORD_PTR *)calloc(IatSize + sizeof(DWORD_PTR), 1);
	if (!iatBackup)
	{
	return 0;
	}
	if (!ProcessAccessHelp::readMemoryFromProcess(IatAddressVA, IatSize, iatBackup))
	{
	free(iatBackup);
	iatBackup = 0;
	return 0;
	}
	}

	for (int i = 0; i < ((int)IatSize / (int)sizeof(DWORD_PTR));i++)
	{
	if (iatBackup[i] == addr)
	{
	return (DWORD_PTR)&iatBackup[i] - (DWORD_PTR)iatBackup + IatAddressVA;
	}
	}

	return 0;
	}
	+
	+void IATReferenceScan::patchNewIat(DWORD_PTR stdImagebase, DWORD_PTR newIatBaseAddress, PeParser * peParser)
	+{
	+ NewIatAddressRVA = newIatBaseAddress;
	+ DWORD patchBytes = 0;
	+
	+ for (std::vector<IATReference>::iterator iter = iatReferenceList.begin(); iter != iatReferenceList.end(); iter++)
	+ {
	+ IATReference * ref = &(*iter);
	+
	+ DWORD_PTR newIatAddressPointer = (ref->targetPointer - IatAddressVA) + NewIatAddressRVA + stdImagebase;
	+
	+#ifdef _WIN64
	+ patchBytes = (DWORD)(newIatAddressPointer - (ref->addressVA - ImageBase + standardImageBase) - 6);
	+#else
	+ patchBytes = newIatAddressPointer;
	+#endif
	+ DWORD_PTR patchOffset = peParser->convertRVAToOffsetRelative(ref->addressVA - ImageBase);
	+ int index = peParser->convertRVAToOffsetVectorIndex(ref->addressVA - ImageBase);
	+ BYTE * memory = peParser->getSectionMemoryByIndex(index);
	+ DWORD memorySize = peParser->getSectionMemorySizeByIndex(index);
	+
	+
	+ Scylla::debugLog.log(L"address %X old %X new %X",ref->addressVA, ref->targetPointer, newIatAddressPointer);
	+
	+ memory += patchOffset + 2;
	+ //Scylla::debugLog.log(L"%X %X %X %X %X %X",memory[0],memory[1],memory[2],memory[3],memory[4],memory[5] );
	+
	+
	+ ((DWORD )memory) = patchBytes;
	+ }
	+}
	\ No newline at end of file
	diff --git a/Scylla/IATReferenceScan.h b/Scylla/IATReferenceScan.h
	index a024b89..4d3c8a2 100644
	--- a/Scylla/IATReferenceScan.h
	+++ b/Scylla/IATReferenceScan.h
	@@ -1,101 +1,103 @@
	#pragma once
	#include <vector>
	#include "ProcessAccessHelp.h"
	+#include "PeParser.h"

	enum IATReferenceType {
	IAT_REFERENCE_PTR_JMP,
	IAT_REFERENCE_PTR_CALL,
	IAT_REFERENCE_DIRECT_JMP,
	IAT_REFERENCE_DIRECT_CALL
	};

	class IATReference
	{
	public:
	DWORD_PTR addressVA; //Address of reference
	DWORD_PTR targetPointer; //Place inside IAT
	DWORD_PTR targetAddressInIat; //WIN API?
	IATReferenceType type;
	};


	class IATReferenceScan
	{
	public:

	IATReferenceScan()
	{
	IatAddressVA = 0;
	IatSize = 0;
	ImageBase = 0;
	ImageSize = 0;
	iatBackup = 0;
	ScanForDirectImports = false;
	ScanForNormalImports = true;
	}

	~IATReferenceScan()
	{
	iatReferenceList.clear();
	iatDirectImportList.clear();

	if (iatBackup)
	{
	free(iatBackup);
	}
	}

	bool ScanForDirectImports;
	bool ScanForNormalImports;


	void startScan(DWORD_PTR imageBase, DWORD imageSize, DWORD_PTR iatAddress, DWORD iatSize);
	- void patchNewIatBaseMemory(DWORD_PTR newIatBaseAddress);
	- void patchNewIatBaseFile(DWORD_PTR newIatBaseAddress);
	+ //void patchNewIatBaseMemory(DWORD_PTR newIatBaseAddress);
	+ //void patchNewIatBaseFile(DWORD_PTR newIatBaseAddress);
	+
	+ void patchNewIat(DWORD_PTR stdImagebase, DWORD_PTR newIatBaseAddress, PeParser * peParser);
	void patchDirectImportsMemory();
	int numberOfFoundDirectImports();
	private:
	- DWORD_PTR NewIatAddressVA;
	DWORD_PTR NewIatAddressRVA;

	DWORD_PTR IatAddressVA;
	DWORD IatSize;
	DWORD_PTR ImageBase;
	DWORD ImageSize;

	DWORD_PTR standardImageBase;

	DWORD_PTR * iatBackup;

	std::vector<IATReference> iatReferenceList;
	std::vector<IATReference> iatDirectImportList;

	bool isPageExecutable( DWORD Protect );
	void scanMemoryPage( PVOID BaseAddress, SIZE_T RegionSize );
	void analyzeInstruction( _DInst * instruction );
	void findNormalIatReference( _DInst * instruction );
	void getIatEntryAddress( IATReference* ref );
	void findDirectIatReference( _DInst * instruction );
	bool isAddressValidMemory( DWORD_PTR address );
	void patchReferenceInMemory( IATReference * ref );
	void patchReferenceInFile( IATReference* ref );
	void patchDirectImportInMemory( IATReference * iter );
	DWORD_PTR lookUpIatForPointer( DWORD_PTR addr );
	};

	/*
	PE64
	----------
	000000013FF82D87 FF15 137C0A00 CALL QWORD [RIP+0xA7C13]
	Result: 000000014002A9A0

	000000013F65C952 FF25 F8EA0B00 JMP QWORD [RIP+0xBEAF8]
	Result: 000000013F71B450

	PE32
	----------
	0120FFA5 FF15 8C6D2601 CALL DWORD [0x01266D8C]

	0120FF52 FF25 D4722601 JMP DWORD [0x012672D4]
	*/

	diff --git a/Scylla/ImportRebuilder.cpp b/Scylla/ImportRebuilder.cpp
	index 8ebe9d5..30f02fd 100644
	--- a/Scylla/ImportRebuilder.cpp
	+++ b/Scylla/ImportRebuilder.cpp
	@@ -1,366 +1,422 @@

	#include "ImportRebuilder.h"
	#include "Scylla.h"
	#include "StringConversion.h"

	//#define DEBUG_COMMENTS


	bool ImportRebuilder::rebuildImportTable(const WCHAR * newFilePath, std::map<DWORD_PTR, ImportModuleThunk> & moduleList)
	{
	bool retValue = false;

	if (isValidPeFile())
	{
	if (readPeSectionsFromFile())
	{
	setDefaultFileAlignment();

	retValue = buildNewImportTable(moduleList);

	if (retValue)
	{
	alignAllSectionHeaders();
	fixPeHeader();
	+
	+ if (newIatInSection)
	+ {
	+ patchFileForNewIatLocation();
	+ }
	+
	retValue = savePeFileToDisk(newFilePath);
	}
	}
	}

	return retValue;
	}

	bool ImportRebuilder::buildNewImportTable(std::map<DWORD_PTR, ImportModuleThunk> & moduleList)
	{
	createNewImportSection(moduleList);

	importSectionIndex = listPeSection.size() - 1;

	+ if (newIatInSection)
	+ {
	+ changeIatBaseAddress(moduleList);
	+ }
	+
	DWORD dwSize = fillImportSection(moduleList);

	if (!dwSize)
	{
	return false;
	}

	setFlagToIATSection((*moduleList.begin()).second.firstThunk);

	DWORD vaImportAddress = listPeSection[importSectionIndex].sectionHeader.VirtualAddress;

	if (useOFT)
	{
	//OFT array is at the beginning of the import section
	vaImportAddress += (DWORD)sizeOfOFTArray;
	}
	+ if (newIatInSection)
	+ {
	+ vaImportAddress += (DWORD)IatSize;
	+ }

	if (isPE32())
	{
	pNTHeader32->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress = vaImportAddress;
	pNTHeader32->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].Size = (DWORD)(numberOfImportDescriptors * sizeof(IMAGE_IMPORT_DESCRIPTOR));
	}
	else
	{
	pNTHeader64->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress = vaImportAddress;
	pNTHeader64->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].Size = (DWORD)(numberOfImportDescriptors * sizeof(IMAGE_IMPORT_DESCRIPTOR));
	}


	return true;
	}

	bool ImportRebuilder::createNewImportSection(std::map<DWORD_PTR, ImportModuleThunk> & moduleList)
	{
	char sectionName[IMAGE_SIZEOF_SHORT_NAME + 1] = {0};

	const WCHAR * sectionNameW = Scylla::config[IAT_SECTION_NAME].getString();

	calculateImportSizes(moduleList);

	if (wcslen(sectionNameW) > IMAGE_SIZEOF_SHORT_NAME)
	{
	strcpy_s(sectionName, ".SCY");
	}
	else
	{
	StringConversion::ToASCII(sectionNameW, sectionName, _countof(sectionName));
	}
	+
	+ if (newIatInSection)
	+ {
	+ sizeOfImportSection += IatSize;
	+ }

	return addNewLastSection(sectionName, (DWORD)sizeOfImportSection, 0);
	}

	void ImportRebuilder::setFlagToIATSection(DWORD_PTR iatAddress)
	{
	for (size_t i = 0; i < listPeSection.size(); i++)
	{
	if ((listPeSection[i].sectionHeader.VirtualAddress <= iatAddress) && ((listPeSection[i].sectionHeader.VirtualAddress + listPeSection[i].sectionHeader.Misc.VirtualSize) > iatAddress))
	{
	//section must be read and writeable
	listPeSection[i].sectionHeader.Characteristics \|= IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE;
	}
	}
	}

	DWORD ImportRebuilder::fillImportSection(std::map<DWORD_PTR, ImportModuleThunk> & moduleList)
	{
	std::map<DWORD_PTR, ImportModuleThunk>::iterator mapIt;
	std::map<DWORD_PTR, ImportThunk>::iterator mapIt2;
	PIMAGE_IMPORT_DESCRIPTOR pImportDesc = 0;
	PIMAGE_IMPORT_BY_NAME pImportByName = 0;
	PIMAGE_THUNK_DATA pThunk = 0;
	ImportModuleThunk * importModuleThunk = 0;
	ImportThunk * importThunk = 0;

	size_t stringLength = 0;
	DWORD_PTR lastRVA = 0;

	BYTE * sectionData = listPeSection[importSectionIndex].data;
	- DWORD offset;
	+ DWORD offset = 0;
	DWORD offsetOFTArray = 0;

	if (useOFT)
	{
	//OFT Array is always at the beginning of the import section
	offset = (DWORD)sizeOfOFTArray; //size includes null termination
	}
	- else
	+
	+ if (newIatInSection)
	{
	- offset = 0;
	+ offset += IatSize; //new iat at the beginning
	}

	pImportDescriptor = (PIMAGE_IMPORT_DESCRIPTOR)((DWORD_PTR)sectionData + offset);

	//skip the IMAGE_IMPORT_DESCRIPTOR
	offset += (DWORD)(numberOfImportDescriptors * sizeof(IMAGE_IMPORT_DESCRIPTOR));

	for ( mapIt = moduleList.begin() ; mapIt != moduleList.end(); mapIt++ )
	{
	importModuleThunk = &((*mapIt).second);

	stringLength = addImportDescriptor(importModuleThunk, offset, offsetOFTArray);

	#ifdef DEBUG_COMMENTS
	Scylla::debugLog.log(L"fillImportSection :: importDesc.Name %X", pImportDescriptor->Name);
	#endif

	offset += (DWORD)stringLength; //stringLength has null termination char

	pImportByName = (PIMAGE_IMPORT_BY_NAME)((DWORD_PTR)sectionData + offset);

	//pThunk = (PIMAGE_THUNK_DATA)(getMemoryPointerFromRVA(importModuleThunk->firstThunk));

	lastRVA = importModuleThunk->firstThunk - sizeof(DWORD_PTR);

	for ( mapIt2 = (mapIt).second.thunkList.begin() ; mapIt2 != (mapIt).second.thunkList.end(); mapIt2++ )
	{
	importThunk = &((*mapIt2).second);

	if (useOFT)
	{
	//OFT Array is always at the beginning of the import section
	pThunk = (PIMAGE_THUNK_DATA)((DWORD_PTR)sectionData + offsetOFTArray);
	offsetOFTArray += sizeof(DWORD_PTR); //increase OFT array index
	}
	else
	{
	pThunk = (PIMAGE_THUNK_DATA)(getMemoryPointerFromRVA(importThunk->rva));
	}

	//check wrong iat pointer
	if (!pThunk)
	{
	#ifdef DEBUG_COMMENTS
	Scylla::debugLog.log(L"fillImportSection :: Failed to get pThunk RVA: %X", importThunk->rva);
	#endif
	return 0;
	}

	if ((lastRVA + sizeof(DWORD_PTR)) != importThunk->rva)
	{
	//add additional import desc
	addSpecialImportDescriptor(importThunk->rva, offsetOFTArray);
	if (useOFT)
	{
	pThunk = (PIMAGE_THUNK_DATA)((DWORD_PTR)sectionData + offsetOFTArray);
	offsetOFTArray += sizeof(DWORD_PTR); //increase OFT array index, next module
	}
	}
	lastRVA = importThunk->rva;

	#ifdef DEBUG_COMMENTS
	Scylla::debugLog.log(L"fillImportSection :: importThunk %X pThunk %X pImportByName %X offset %X", importThunk,pThunk,pImportByName,offset);
	#endif
	stringLength = addImportToImportTable(importThunk, pThunk, pImportByName, offset);

	offset += (DWORD)stringLength; //is 0 bei import by ordinal
	pImportByName = (PIMAGE_IMPORT_BY_NAME)((DWORD_PTR)pImportByName + stringLength);
	}

	offsetOFTArray += sizeof(DWORD_PTR); //increase OFT array index, next module
	pImportDescriptor++;
	}

	return offset;
	}

	size_t ImportRebuilder::addImportDescriptor(ImportModuleThunk * pImportModule, DWORD sectionOffset, DWORD sectionOffsetOFTArray)
	{
	char dllName[MAX_PATH];

	StringConversion::ToASCII(pImportModule->moduleName, dllName, _countof(dllName));
	size_t stringLength = strlen(dllName) + 1;

	/*
	Warning: stringLength MUST include null termination char
	*/

	memcpy((listPeSection[importSectionIndex].data + sectionOffset), dllName, stringLength); //copy module name to section

	pImportDescriptor->FirstThunk = (DWORD)pImportModule->firstThunk;
	pImportDescriptor->Name = (DWORD)convertOffsetToRVAVector(listPeSection[importSectionIndex].sectionHeader.PointerToRawData + sectionOffset);

	if (useOFT)
	{
	pImportDescriptor->OriginalFirstThunk = (DWORD)convertOffsetToRVAVector(listPeSection[importSectionIndex].sectionHeader.PointerToRawData + sectionOffsetOFTArray);
	}

	return stringLength;
	}

	void ImportRebuilder::addSpecialImportDescriptor(DWORD_PTR rvaFirstThunk, DWORD sectionOffsetOFTArray)
	{
	PIMAGE_IMPORT_DESCRIPTOR oldID = pImportDescriptor;
	pImportDescriptor++;

	pImportDescriptor->FirstThunk = (DWORD)rvaFirstThunk;
	pImportDescriptor->Name = oldID->Name;

	if (useOFT)
	{
	pImportDescriptor->OriginalFirstThunk = (DWORD)convertOffsetToRVAVector(listPeSection[importSectionIndex].sectionHeader.PointerToRawData + sectionOffsetOFTArray);
	}
	}

	void ImportRebuilder::calculateImportSizes(std::map<DWORD_PTR, ImportModuleThunk> & moduleList)
	{
	std::map<DWORD_PTR, ImportModuleThunk>::iterator mapIt;
	std::map<DWORD_PTR, ImportThunk>::iterator mapIt2;
	DWORD_PTR lastRVA = 0;


	sizeOfImportSection = 0;
	sizeOfApiAndModuleNames = 0;
	sizeOfOFTArray = 0;

	numberOfImportDescriptors = moduleList.size() + 1; //last is zero'd

	for ( mapIt = moduleList.begin() ; mapIt != moduleList.end(); mapIt++ )
	{
	lastRVA = (*mapIt).second.firstThunk - sizeof(DWORD_PTR);

	sizeOfApiAndModuleNames += (DWORD)(wcslen((*mapIt).second.moduleName) + 1);

	for ( mapIt2 = (mapIt).second.thunkList.begin() ; mapIt2 != (mapIt).second.thunkList.end(); mapIt2++ )
	{
	if ((lastRVA + sizeof(DWORD_PTR)) != (*mapIt2).second.rva)
	{
	numberOfImportDescriptors++; //add additional import desc
	sizeOfOFTArray += sizeof(DWORD_PTR) + sizeof(DWORD_PTR);
	}

	if((*mapIt2).second.name[0] != '\0')
	{
	sizeOfApiAndModuleNames += sizeof(WORD); //Hint from IMAGE_IMPORT_BY_NAME
	sizeOfApiAndModuleNames += (DWORD)(strlen((*mapIt2).second.name) + 1);
	}

	//OriginalFirstThunk Array in Import Section: value
	sizeOfOFTArray += sizeof(DWORD_PTR);

	lastRVA = (*mapIt2).second.rva;
	}

	//OriginalFirstThunk Array in Import Section: NULL termination
	sizeOfOFTArray += sizeof(DWORD_PTR);
	}

	sizeOfImportSection = sizeOfOFTArray + sizeOfApiAndModuleNames + (numberOfImportDescriptors * sizeof(IMAGE_IMPORT_DESCRIPTOR));
	}

	size_t ImportRebuilder::addImportToImportTable( ImportThunk * pImport, PIMAGE_THUNK_DATA pThunk, PIMAGE_IMPORT_BY_NAME pImportByName, DWORD sectionOffset)
	{
	size_t stringLength = 0;

	if(pImport->name[0] == '\0')
	{
	pThunk->u1.AddressOfData = (IMAGE_ORDINAL(pImport->ordinal) \| IMAGE_ORDINAL_FLAG);
	}
	else
	{
	pImportByName->Hint = pImport->hint;

	stringLength = strlen(pImport->name) + 1;
	memcpy(pImportByName->Name, pImport->name, stringLength);

	pThunk->u1.AddressOfData = convertOffsetToRVAVector(listPeSection[importSectionIndex].sectionHeader.PointerToRawData + sectionOffset);

	if (!pThunk->u1.AddressOfData)
	{
	#ifdef DEBUG_COMMENTS
	Scylla::debugLog.log(L"addImportToImportTable :: failed to get AddressOfData %X %X", listPeSection[importSectionIndex].sectionHeader.PointerToRawData, sectionOffset);
	#endif
	}

	//next import should be nulled
	pThunk++;
	pThunk->u1.AddressOfData = 0;

	#ifdef DEBUG_COMMENTS
	Scylla::debugLog.log(L"addImportToImportTable :: pThunk->u1.AddressOfData %X %X %X", pThunk->u1.AddressOfData, pThunk, listPeSection[importSectionIndex].sectionHeader.PointerToRawData + sectionOffset);
	#endif
	stringLength += sizeof(WORD);
	}

	return stringLength;
	}

	BYTE * ImportRebuilder::getMemoryPointerFromRVA(DWORD_PTR dwRVA)
	{
	int peSectionIndex = convertRVAToOffsetVectorIndex(dwRVA);

	if (peSectionIndex == -1)
	{
	return 0;
	}

	DWORD rvaPointer = ((DWORD)dwRVA - listPeSection[peSectionIndex].sectionHeader.VirtualAddress);
	DWORD minSectionSize = rvaPointer + (sizeof(DWORD_PTR) * 2); //add space for 1 IAT address

	if (listPeSection[peSectionIndex].data == 0 \|\| listPeSection[peSectionIndex].dataSize == 0)
	{
	listPeSection[peSectionIndex].dataSize = minSectionSize;
	listPeSection[peSectionIndex].normalSize = minSectionSize;
	listPeSection[peSectionIndex].data = new BYTE[listPeSection[peSectionIndex].dataSize];

	listPeSection[peSectionIndex].sectionHeader.SizeOfRawData = listPeSection[peSectionIndex].dataSize;
	}
	else if(listPeSection[peSectionIndex].dataSize < minSectionSize)
	{
	BYTE * temp = new BYTE[minSectionSize];
	memcpy(temp, listPeSection[peSectionIndex].data, listPeSection[peSectionIndex].dataSize);
	delete [] listPeSection[peSectionIndex].data;

	listPeSection[peSectionIndex].data = temp;
	listPeSection[peSectionIndex].dataSize = minSectionSize;
	listPeSection[peSectionIndex].normalSize = minSectionSize;

	listPeSection[peSectionIndex].sectionHeader.SizeOfRawData = listPeSection[peSectionIndex].dataSize;
	}

	return (BYTE *)((DWORD_PTR)listPeSection[peSectionIndex].data + rvaPointer);
	}

	void ImportRebuilder::enableOFTSupport()
	{
	useOFT = true;
	}

	+void ImportRebuilder::enableNewIatInSection(DWORD_PTR iatAddress, DWORD iatSize)
	+{
	+ newIatInSection = true;
	+ IatAddress = iatAddress;
	+ IatSize = iatSize;
	+
	+ iatRefScan.ScanForDirectImports = false;
	+ iatRefScan.ScanForNormalImports = true;
	+
	+ iatRefScan.startScan(ProcessAccessHelp::targetImageBase, (DWORD)ProcessAccessHelp::targetSizeOfImage, IatAddress, IatSize);
	+}
	+
	+void ImportRebuilder::patchFileForNewIatLocation()
	+{
	+ iatRefScan.patchNewIat(getStandardImagebase(), listPeSection[importSectionIndex].sectionHeader.VirtualAddress, (PeParser *)this);
	+}
	+
	+void ImportRebuilder::changeIatBaseAddress( std::map<DWORD_PTR, ImportModuleThunk> & moduleList )
	+{
	+ std::map<DWORD_PTR, ImportModuleThunk>::iterator mapIt;
	+ std::map<DWORD_PTR, ImportThunk>::iterator mapIt2;
	+
	+ DWORD_PTR oldIatRva = IatAddress - ProcessAccessHelp::targetImageBase;
	+
	+ for ( mapIt = moduleList.begin() ; mapIt != moduleList.end(); mapIt++ )
	+ {
	+ (mapIt).second.firstThunk = (mapIt).second.firstThunk - oldIatRva + listPeSection[importSectionIndex].sectionHeader.VirtualAddress;
	+
	+ for ( mapIt2 = (mapIt).second.thunkList.begin() ; mapIt2 != (mapIt).second.thunkList.end(); mapIt2++ )
	+ {
	+ (mapIt2).second.rva = (mapIt2).second.rva - oldIatRva + listPeSection[importSectionIndex].sectionHeader.VirtualAddress;
	+ }
	+ }
	+}
	+
	diff --git a/Scylla/ImportRebuilder.h b/Scylla/ImportRebuilder.h
	index cc08bbc..d4bfa9d 100644
	--- a/Scylla/ImportRebuilder.h
	+++ b/Scylla/ImportRebuilder.h
	@@ -1,52 +1,60 @@
	#pragma once

	#include <map>
	#include "PeParser.h"
	#include "Thunks.h"
	+#include "IATReferenceScan.h"


	class ImportRebuilder : public PeParser {
	public:
	ImportRebuilder(const WCHAR * file) : PeParser(file, true)
	{
	pImportDescriptor = 0;
	pThunkData = 0;
	pImportByName = 0;

	numberOfImportDescriptors = 0;
	sizeOfImportSection = 0;
	sizeOfApiAndModuleNames = 0;
	importSectionIndex = 0;
	useOFT = false;
	sizeOfOFTArray = 0;
	}

	bool rebuildImportTable(const WCHAR * newFilePath, std::map<DWORD_PTR, ImportModuleThunk> & moduleList);
	void enableOFTSupport();
	+ void enableNewIatInSection(DWORD_PTR iatAddress, DWORD iatSize);
	private:
	PIMAGE_IMPORT_DESCRIPTOR pImportDescriptor;
	PIMAGE_THUNK_DATA pThunkData;
	PIMAGE_IMPORT_BY_NAME pImportByName;

	size_t numberOfImportDescriptors;
	size_t sizeOfImportSection;
	size_t sizeOfApiAndModuleNames;
	size_t importSectionIndex;

	//OriginalFirstThunk Array in Import Section
	size_t sizeOfOFTArray;
	bool useOFT;
	+ bool newIatInSection;
	+ DWORD_PTR IatAddress;
	+ DWORD IatSize;
	+ IATReferenceScan iatRefScan;

	DWORD fillImportSection(std::map<DWORD_PTR, ImportModuleThunk> & moduleList);
	BYTE * getMemoryPointerFromRVA(DWORD_PTR dwRVA);

	bool createNewImportSection(std::map<DWORD_PTR, ImportModuleThunk> & moduleList);
	bool buildNewImportTable(std::map<DWORD_PTR, ImportModuleThunk> & moduleList);
	void setFlagToIATSection(DWORD_PTR iatAddress);
	size_t addImportToImportTable( ImportThunk * pImport, PIMAGE_THUNK_DATA pThunk, PIMAGE_IMPORT_BY_NAME pImportByName, DWORD sectionOffset);
	size_t addImportDescriptor(ImportModuleThunk * pImportModule, DWORD sectionOffset, DWORD sectionOffsetOFTArray);

	void calculateImportSizes(std::map<DWORD_PTR, ImportModuleThunk> & moduleList);

	void addSpecialImportDescriptor(DWORD_PTR rvaFirstThunk, DWORD sectionOffsetOFTArray);
	+ void patchFileForNewIatLocation();
	+ void changeIatBaseAddress( std::map<DWORD_PTR, ImportModuleThunk> & moduleList );
	};
	\ No newline at end of file
	diff --git a/Scylla/ImportsHandling.cpp b/Scylla/ImportsHandling.cpp
	index c571def..6275be1 100644
	--- a/Scylla/ImportsHandling.cpp
	+++ b/Scylla/ImportsHandling.cpp
	@@ -1,816 +1,822 @@
	#include "ImportsHandling.h"

	#include "Thunks.h"
	#include "Architecture.h"

	#include <atlmisc.h>
	#include <atlcrack.h>
	#include "multitree.h" // CMultiSelectTreeViewCtrl

	#include "resource.h"

	//#define DEBUG_COMMENTS

	void ImportThunk::invalidate()
	{
	ordinal = 0;
	hint = 0;
	valid = false;
	suspect = false;
	moduleName[0] = 0;
	name[0] = 0;
	}

	bool ImportModuleThunk::isValid() const
	{
	std::map<DWORD_PTR, ImportThunk>::const_iterator iterator = thunkList.begin();
	while (iterator != thunkList.end())
	{
	if (iterator->second.valid == false)
	{
	return false;
	}
	iterator++;
	}

	return true;
	}

	DWORD_PTR ImportModuleThunk::getFirstThunk() const
	{
	if (thunkList.size() > 0)
	{
	const std::map<DWORD_PTR, ImportThunk>::const_iterator iterator = thunkList.begin();
	return iterator->first;
	}
	else
	{
	return 0;
	}
	}

	ImportsHandling::ImportsHandling(CMultiSelectTreeViewCtrl& TreeImports) : TreeImports(TreeImports)
	{
	hIconCheck.LoadIcon(IDI_ICON_CHECK, 16, 16);
	hIconWarning.LoadIcon(IDI_ICON_WARNING, 16, 16);
	hIconError.LoadIcon(IDI_ICON_ERROR, 16, 16);

	CDCHandle dc = CWindow(::GetDesktopWindow()).GetDC();
	int bits = dc.GetDeviceCaps(BITSPIXEL);

	const UINT FLAGS = bits > 16 ? ILC_COLOR32 : (ILC_COLOR24 \| ILC_MASK);

	TreeIcons.Create(16, 16, FLAGS, 3, 1);
	TreeIcons.AddIcon(hIconCheck);
	TreeIcons.AddIcon(hIconWarning);
	TreeIcons.AddIcon(hIconError);

	m_thunkCount = m_invalidThunkCount = m_suspectThunkCount = 0;
	}

	ImportsHandling::~ImportsHandling()
	{
	TreeIcons.Destroy();
	}

	bool ImportsHandling::isModule(CTreeItem item)
	{
	return (0 != getModuleThunk(item));
	}

	bool ImportsHandling::isImport(CTreeItem item)
	{
	return (0 != getImportThunk(item));
	}

	ImportModuleThunk * ImportsHandling::getModuleThunk(CTreeItem item)
	{
	stdext::hash_map<HTREEITEM, TreeItemData>::const_iterator it;
	it = itemData.find(item);
	if(it != itemData.end())
	{
	const TreeItemData * data = &it->second;
	if(data->isModule)
	{
	return data->module;
	}
	}
	return NULL;
	}

	ImportThunk * ImportsHandling::getImportThunk(CTreeItem item)
	{
	stdext::hash_map<HTREEITEM, TreeItemData>::const_iterator it;
	TreeItemData * data = getItemData(item);
	if(data && !data->isModule)
	{
	return data->import;
	}
	return NULL;
	}

	void ImportsHandling::setItemData(CTreeItem item, const TreeItemData * data)
	{
	itemData[item] = *data;
	}

	ImportsHandling::TreeItemData * ImportsHandling::getItemData(CTreeItem item)
	{
	stdext::hash_map<HTREEITEM, TreeItemData>::iterator it;
	it = itemData.find(item);
	if(it != itemData.end())
	{
	return &it->second;
	}
	return NULL;
	}

	void ImportsHandling::updateCounts()
	{
	std::map<DWORD_PTR, ImportModuleThunk>::iterator it_module;
	std::map<DWORD_PTR, ImportThunk>::iterator it_import;

	m_thunkCount = m_invalidThunkCount = m_suspectThunkCount = 0;

	it_module = moduleList.begin();
	while (it_module != moduleList.end())
	{
	ImportModuleThunk &moduleThunk = it_module->second;

	it_import = moduleThunk.thunkList.begin();
	while (it_import != moduleThunk.thunkList.end())
	{
	ImportThunk &importThunk = it_import->second;

	m_thunkCount++;
	if(!importThunk.valid)
	m_invalidThunkCount++;
	else if(importThunk.suspect)
	m_suspectThunkCount++;

	it_import++;
	}

	it_module++;
	}
	}

	/bool ImportsHandling::addImport(const WCHAR moduleName, const CHAR * name, DWORD_PTR va, DWORD_PTR rva, WORD ordinal, bool valid, bool suspect)
	{
	ImportThunk import;
	ImportModuleThunk * module = 0;
	std::map<DWORD_PTR, ImportModuleThunk>::iterator iterator1;

	if (moduleList.size() > 1)
	{
	iterator1 = moduleList.begin();
	while (iterator1 != moduleList.end())
	{
	if (rva >= iterator1->second.firstThunk)
	{
	iterator1++;
	if (iterator1 == moduleList.end())
	{
	iterator1--;
	module = &(iterator1->second);
	break;
	}
	else if (rva < iterator1->second.firstThunk)
	{
	iterator1--;
	module = &(iterator1->second);
	break;
	}
	}
	}
	}
	else
	{
	iterator1 = moduleList.begin();
	module = &(iterator1->second);
	}

	if (!module)
	{
	Scylla::debugLog.log(L"ImportsHandling::addFunction module not found rva " PRINTF_DWORD_PTR_FULL, rva);
	return false;
	}

	//TODO
	import.suspect = true;
	import.valid = false;
	import.va = va;
	import.rva = rva;
	import.ordinal = ordinal;

	wcscpy_s(import.moduleName, MAX_PATH, moduleName);
	strcpy_s(import.name, MAX_PATH, name);

	module->thunkList.insert(std::pair<DWORD_PTR,ImportThunk>(import.rva, import));

	return true;
	}
	*/

	/*
	bool ImportsHandling::addModule(const WCHAR * moduleName, DWORD_PTR firstThunk)
	{
	ImportModuleThunk module;

	module.firstThunk = firstThunk;
	wcscpy_s(module.moduleName, MAX_PATH, moduleName);

	moduleList.insert(std::pair<DWORD_PTR,ImportModuleThunk>(firstThunk,module));

	return true;
	}
	*/

	void ImportsHandling::displayAllImports()
	{
	std::map<DWORD_PTR, ImportModuleThunk>::iterator it_module;
	std::map<DWORD_PTR, ImportThunk>::iterator it_import;

	TreeImports.DeleteAllItems();
	itemData.clear();
	TreeImports.SetImageList(TreeIcons);

	it_module = moduleList.begin();
	while (it_module != moduleList.end())
	{
	ImportModuleThunk &moduleThunk = it_module->second;

	moduleThunk.key = moduleThunk.firstThunk; // This belongs elsewhere...
	moduleThunk.hTreeItem = addDllToTreeView(TreeImports, &moduleThunk);

	it_import = moduleThunk.thunkList.begin();
	while (it_import != moduleThunk.thunkList.end())
	{
	ImportThunk &importThunk = it_import->second;

	importThunk.key = importThunk.rva; // This belongs elsewhere...
	importThunk.hTreeItem = addApiToTreeView(TreeImports, moduleThunk.hTreeItem, &importThunk);

	it_import++;
	}

	it_module++;
	}

	updateCounts();
	}

	void ImportsHandling::clearAllImports()
	{
	TreeImports.DeleteAllItems();
	itemData.clear();
	moduleList.clear();
	updateCounts();
	}

	CTreeItem ImportsHandling::addDllToTreeView(CMultiSelectTreeViewCtrl& idTreeView, ImportModuleThunk * moduleThunk)
	{
	CTreeItem item = idTreeView.InsertItem(L"", NULL, TVI_ROOT);

	item.SetData(itemData.size());

	TreeItemData data;
	data.isModule = true;
	data.module = moduleThunk;

	setItemData(item, &data);

	updateModuleInTreeView(moduleThunk, item);
	return item;
	}

	CTreeItem ImportsHandling::addApiToTreeView(CMultiSelectTreeViewCtrl& idTreeView, CTreeItem parentDll, ImportThunk * importThunk)
	{
	CTreeItem item = idTreeView.InsertItem(L"", parentDll, TVI_LAST);

	item.SetData(itemData.size());

	TreeItemData data;
	data.isModule = false;
	data.import = importThunk;

	setItemData(item, &data);

	updateImportInTreeView(importThunk, item);
	return item;
	}

	void ImportsHandling::selectImports(bool invalid, bool suspect)
	{
	std::map<DWORD_PTR, ImportModuleThunk>::iterator it_module;
	std::map<DWORD_PTR, ImportThunk>::iterator it_import;

	TreeImports.SelectAllItems(FALSE); //remove selection

	it_module = moduleList.begin();
	while (it_module != moduleList.end())
	{
	ImportModuleThunk &moduleThunk = it_module->second;

	it_import = moduleThunk.thunkList.begin();
	while (it_import != moduleThunk.thunkList.end())
	{
	ImportThunk &importThunk = it_import->second;

	if ((invalid && !importThunk.valid) \|\| (suspect && importThunk.suspect))
	{
	TreeImports.SelectItem(importThunk.hTreeItem, TRUE);
	importThunk.hTreeItem.EnsureVisible();
	}

	it_import++;
	}

	it_module++;
	}
	}

	bool ImportsHandling::invalidateImport(CTreeItem item)
	{
	ImportThunk * import = getImportThunk(item);
	if(import)
	{
	CTreeItem parent = item.GetParent();
	if(!parent.IsNull())
	{
	const ImportModuleThunk * module = getModuleThunk(parent);
	if(module)
	{
	import->invalidate();

	updateImportInTreeView(import, import->hTreeItem);
	updateModuleInTreeView(module, module->hTreeItem);

	updateCounts();
	return true;
	}
	}
	}
	return false;
	}

	bool ImportsHandling::invalidateModule(CTreeItem item)
	{
	ImportModuleThunk * module = getModuleThunk(item);
	if(module)
	{
	std::map<DWORD_PTR, ImportThunk>::iterator it_import;

	it_import = module->thunkList.begin();
	while(it_import != module->thunkList.end())
	{
	ImportThunk * import = &it_import->second;
	import->invalidate();
	updateImportInTreeView(import, import->hTreeItem);
	it_import++;
	}

	updateModuleInTreeView(module, module->hTreeItem);

	updateCounts();
	return true;
	}
	return false;
	}

	bool ImportsHandling::setImport(CTreeItem item, const WCHAR * moduleName, const CHAR * apiName, WORD ordinal, WORD hint, bool valid, bool suspect)
	{
	ImportThunk * import = getImportThunk(item);
	if(import)
	{
	CTreeItem parent = item.GetParent();
	if(!parent.IsNull())
	{
	ImportModuleThunk * module = getModuleThunk(parent);
	if(module)
	{

	wcscpy_s(import->moduleName, moduleName);
	strcpy_s(import->name, apiName);
	import->ordinal = ordinal;
	//import->apiAddressVA = api->va; //??
	import->hint = hint;
	import->valid = valid;
	import->suspect = suspect;

	updateImportInTreeView(import, item);

	if (module->isValid() && module->moduleName[0] == L'?')
	{
	//update module name
	wcscpy_s(module->moduleName, module->thunkList.begin()->second.moduleName);
	+ scanAndFixModuleList();
	+ displayAllImports();
	+ }
	+ else
	+ {
	+ //updateModuleInTreeView(module, module->hTreeItem);
	+
	+ updateCounts();
	}

	- updateModuleInTreeView(module, module->hTreeItem);

	- updateCounts();
	return true;
	}
	}
	}
	return false;
	}

	void ImportsHandling::updateImportInTreeView(const ImportThunk * importThunk, CTreeItem item)
	{
	if (importThunk->valid)
	{
	WCHAR tempString[300];

	if (importThunk->name[0] != 0x00)
	{
	swprintf_s(tempString, L"ord: %04X name: %S", importThunk->ordinal, importThunk->name);
	}
	else
	{
	swprintf_s(tempString, L"ord: %04X", importThunk->ordinal);
	}

	swprintf_s(stringBuffer, L" rva: " PRINTF_DWORD_PTR_HALF L" mod: %s %s", importThunk->rva, importThunk->moduleName, tempString);
	}
	else
	{
	swprintf_s(stringBuffer, L" rva: " PRINTF_DWORD_PTR_HALF L" ptr: " PRINTF_DWORD_PTR_FULL, importThunk->rva, importThunk->apiAddressVA);
	}

	item.SetText(stringBuffer);
	Icon icon = getAppropiateIcon(importThunk);
	item.SetImage(icon, icon);
	}

	void ImportsHandling::updateModuleInTreeView(const ImportModuleThunk * importThunk, CTreeItem item)
	{
	swprintf_s(stringBuffer, L"%s (%d) FThunk: " PRINTF_DWORD_PTR_HALF, importThunk->moduleName,importThunk->thunkList.size(), importThunk->firstThunk);

	item.SetText(stringBuffer);
	Icon icon = getAppropiateIcon(importThunk->isValid());
	item.SetImage(icon, icon);
	}

	ImportsHandling::Icon ImportsHandling::getAppropiateIcon(const ImportThunk * importThunk)
	{
	if(importThunk->valid)
	{
	if(importThunk->suspect)
	{
	return iconWarning;
	}
	else
	{
	return iconCheck;
	}
	}
	else
	{
	return iconError;
	}
	}

	ImportsHandling::Icon ImportsHandling::getAppropiateIcon(bool valid)
	{
	if(valid)
	{
	return iconCheck;
	}
	else
	{
	return iconError;
	}
	}

	bool ImportsHandling::cutImport(CTreeItem item)
	{
	ImportThunk * import = getImportThunk(item);
	if(import)
	{
	CTreeItem parent = item.GetParent();
	if(!parent.IsNull())
	{
	ImportModuleThunk * module = getModuleThunk(parent);
	if(module)
	{
	itemData.erase(item);
	import->hTreeItem.Delete();
	module->thunkList.erase(import->key);
	import = 0;

	if (module->thunkList.empty())
	{
	itemData.erase(parent);
	module->hTreeItem.Delete();
	moduleList.erase(module->key);
	module = 0;
	}
	else
	{
	if (module->isValid() && module->moduleName[0] == L'?')
	{
	//update module name
	wcscpy_s(module->moduleName, module->thunkList.begin()->second.moduleName);
	}

	module->firstThunk = module->thunkList.begin()->second.rva;
	updateModuleInTreeView(module, module->hTreeItem);
	}

	updateCounts();
	return true;
	}
	}
	}
	return false;
	}

	bool ImportsHandling::cutModule(CTreeItem item)
	{
	ImportModuleThunk * module = getModuleThunk(item);
	if(module)
	{
	CTreeItem child = item.GetChild();
	while(!child.IsNull())
	{
	itemData.erase(child);
	child = child.GetNextSibling();
	}
	itemData.erase(item);
	module->hTreeItem.Delete();
	moduleList.erase(module->key);
	module = 0;
	updateCounts();
	return true;
	}
	return false;
	}

	DWORD_PTR ImportsHandling::getApiAddressByNode(CTreeItem item)
	{
	const ImportThunk * import = getImportThunk(item);
	if(import)
	{
	return import->apiAddressVA;
	}
	return 0;
	}

	void ImportsHandling::scanAndFixModuleList()
	{
	std::map<DWORD_PTR, ImportModuleThunk>::iterator it_module;
	std::map<DWORD_PTR, ImportThunk>::iterator it_import;

	it_module = moduleList.begin();
	while (it_module != moduleList.end())
	{
	ImportModuleThunk &moduleThunk = it_module->second;

	it_import = moduleThunk.thunkList.begin();
	while (it_import != moduleThunk.thunkList.end())
	{
	ImportThunk &importThunk = it_import->second;

	if (importThunk.moduleName[0] == 0 \|\| importThunk.moduleName[0] == L'?')
	{
	addNotFoundApiToModuleList(&importThunk);
	}
	else
	{
	if (isNewModule(importThunk.moduleName))
	{
	addModuleToModuleList(importThunk.moduleName, importThunk.rva);
	}

	addFunctionToModuleList(&importThunk);
	}

	it_import++;
	}

	moduleThunk.thunkList.clear();

	it_module++;
	}

	moduleList = moduleListNew;
	moduleListNew.clear();
	}

	bool ImportsHandling::findNewModules(std::map<DWORD_PTR, ImportThunk> & thunkList)
	{
	throw std::exception("The method or operation is not implemented.");
	}

	bool ImportsHandling::addModuleToModuleList(const WCHAR * moduleName, DWORD_PTR firstThunk)
	{
	ImportModuleThunk module;

	module.firstThunk = firstThunk;
	wcscpy_s(module.moduleName, moduleName);

	module.key = module.firstThunk;
	moduleListNew[module.key] = module;
	return true;
	}

	bool ImportsHandling::isNewModule(const WCHAR * moduleName)
	{
	std::map<DWORD_PTR, ImportModuleThunk>::iterator it_module;

	it_module = moduleListNew.begin();
	while (it_module != moduleListNew.end())
	{
	if (!_wcsicmp(it_module->second.moduleName, moduleName))
	{
	return false;
	}

	it_module++;
	}

	return true;
	}

	void ImportsHandling::addUnknownModuleToModuleList(DWORD_PTR firstThunk)
	{
	ImportModuleThunk module;

	module.firstThunk = firstThunk;
	wcscpy_s(module.moduleName, L"?");

	module.key = module.firstThunk;
	moduleListNew[module.key] = module;
	}

	bool ImportsHandling::addNotFoundApiToModuleList(const ImportThunk * apiNotFound)
	{
	ImportThunk import;
	ImportModuleThunk * module = 0;
	std::map<DWORD_PTR, ImportModuleThunk>::iterator it_module;
	DWORD_PTR rva = apiNotFound->rva;

	if (moduleListNew.size() > 0)
	{
	it_module = moduleListNew.begin();
	while (it_module != moduleListNew.end())
	{
	if (rva >= it_module->second.firstThunk)
	{
	it_module++;
	if (it_module == moduleListNew.end())
	{
	it_module--;
	//new unknown module
	if (it_module->second.moduleName[0] == L'?')
	{
	module = &(it_module->second);
	}
	else
	{
	addUnknownModuleToModuleList(apiNotFound->rva);
	module = &(moduleListNew.find(rva)->second);
	}

	break;
	}
	else if (rva < it_module->second.firstThunk)
	{
	it_module--;
	module = &(it_module->second);
	break;
	}
	}
	else
	{
	#ifdef DEBUG_COMMENTS
	Scylla::debugLog.log(L"Error iterator1 != (*moduleThunkList).end()");
	#endif
	break;
	}
	}
	}
	else
	{
	//new unknown module
	addUnknownModuleToModuleList(apiNotFound->rva);
	module = &(moduleListNew.find(rva)->second);
	}

	if (!module)
	{
	#ifdef DEBUG_COMMENTS
	Scylla::debugLog.log(L"ImportsHandling::addFunction module not found rva " PRINTF_DWORD_PTR_FULL, rva);
	#endif
	return false;
	}


	import.suspect = true;
	import.valid = false;
	import.va = apiNotFound->va;
	import.rva = apiNotFound->rva;
	import.apiAddressVA = apiNotFound->apiAddressVA;
	import.ordinal = 0;

	wcscpy_s(import.moduleName, L"?");
	strcpy_s(import.name, "?");

	import.key = import.rva;
	module->thunkList[import.key] = import;
	return true;
	}

	bool ImportsHandling::addFunctionToModuleList(const ImportThunk * apiFound)
	{
	ImportThunk import;
	ImportModuleThunk * module = 0;
	std::map<DWORD_PTR, ImportModuleThunk>::iterator it_module;

	if (moduleListNew.size() > 1)
	{
	it_module = moduleListNew.begin();
	while (it_module != moduleListNew.end())
	{
	if (apiFound->rva >= it_module->second.firstThunk)
	{
	it_module++;
	if (it_module == moduleListNew.end())
	{
	it_module--;
	module = &(it_module->second);
	break;
	}
	else if (apiFound->rva < it_module->second.firstThunk)
	{
	it_module--;
	module = &(it_module->second);
	break;
	}
	}
	else
	{
	#ifdef DEBUG_COMMENTS
	Scylla::debugLog.log(L"Error iterator1 != moduleListNew.end()");
	#endif
	break;
	}
	}
	}
	else
	{
	it_module = moduleListNew.begin();
	module = &(it_module->second);
	}

	if (!module)
	{
	#ifdef DEBUG_COMMENTS
	Scylla::debugLog.log(L"ImportsHandling::addFunction module not found rva " PRINTF_DWORD_PTR_FULL, apiFound->rva);
	#endif
	return false;
	}


	import.suspect = apiFound->suspect;
	import.valid = apiFound->valid;
	import.va = apiFound->va;
	import.rva = apiFound->rva;
	import.apiAddressVA = apiFound->apiAddressVA;
	import.ordinal = apiFound->ordinal;
	import.hint = apiFound->hint;

	wcscpy_s(import.moduleName, apiFound->moduleName);
	strcpy_s(import.name, apiFound->name);

	import.key = import.rva;
	module->thunkList[import.key] = import;
	return true;
	}

	void ImportsHandling::expandAllTreeNodes()
	{
	changeExpandStateOfTreeNodes(TVE_EXPAND);
	}

	void ImportsHandling::collapseAllTreeNodes()
	{
	changeExpandStateOfTreeNodes(TVE_COLLAPSE);
	}

	void ImportsHandling::changeExpandStateOfTreeNodes(UINT flag)
	{
	std::map<DWORD_PTR, ImportModuleThunk>::iterator it_module;

	it_module = moduleList.begin();
	while (it_module != moduleList.end())
	{
	ImportModuleThunk &moduleThunk = it_module->second;

	moduleThunk.hTreeItem.Expand(flag);

	it_module++;
	}
	}

	diff --git a/Scylla/MainGui.cpp b/Scylla/MainGui.cpp
	index 4451b2b..107665f 100644
	--- a/Scylla/MainGui.cpp
	+++ b/Scylla/MainGui.cpp
	@@ -1,1607 +1,1615 @@
	#include "MainGui.h"

	#include "Architecture.h"
	//#include "PluginLoader.h"
	//#include "ConfigurationHolder.h"
	#include "PeParser.h"
	#include "DllInjectionPlugin.h"
	#include "DisassemblerGui.h"
	#include "PickApiGui.h"
	//#include "NativeWinApi.h"
	#include "ImportRebuilder.h"
	#include "SystemInformation.h"
	#include "Scylla.h"
	#include "AboutGui.h"
	#include "DonateGui.h"
	#include "OptionsGui.h"
	#include "TreeImportExport.h"
	#include "IATReferenceScan.h"

	extern CAppModule _Module; // o_O

	const WCHAR MainGui::filterExe[] = L"Executable (.exe)\0.exe\0All files\0.\0";
	const WCHAR MainGui::filterDll[] = L"Dynamic Link Library (.dll)\0.dll\0All files\0.\0";
	const WCHAR MainGui::filterExeDll[] = L"Executable (.exe)\0.exe\0Dynamic Link Library (.dll)\0.dll\0All files\0.\0";
	const WCHAR MainGui::filterTxt[] = L"Text file (.txt)\0.txt\0All files\0.\0";
	const WCHAR MainGui::filterXml[] = L"XML file (.xml)\0.xml\0All files\0.\0";
	const WCHAR MainGui::filterMem[] = L"MEM file (.mem)\0.mem\0All files\0.\0";

	MainGui::MainGui() : selectedProcess(0), isProcessSuspended(false), importsHandling(TreeImports), TreeImportsSubclass(this, IDC_TREE_IMPORTS)
	{
	/*
	Logger::getDebugLogFilePath();
	ConfigurationHolder::loadConfiguration();
	PluginLoader::findAllPlugins();
	NativeWinApi::initialize();
	SystemInformation::getSystemInformation();

	if(ConfigurationHolder::getConfigObject(DEBUG_PRIVILEGE)->isTrue())
	{
	processLister.setDebugPrivileges();
	}


	ProcessAccessHelp::getProcessModules(GetCurrentProcessId(), ProcessAccessHelp::ownModuleList);
	*/

	hIcon.LoadIcon(IDI_ICON_SCYLLA);
	hMenuImports.LoadMenu(IDR_MENU_IMPORTS);
	hMenuLog.LoadMenu(IDR_MENU_LOG);
	accelerators.LoadAccelerators(IDR_ACCELERATOR_MAIN);

	hIconCheck.LoadIcon(IDI_ICON_CHECK, 16, 16);
	hIconWarning.LoadIcon(IDI_ICON_WARNING, 16, 16);
	hIconError.LoadIcon(IDI_ICON_ERROR, 16, 16);
	}

	BOOL MainGui::PreTranslateMessage(MSG* pMsg)
	{
	if(accelerators.TranslateAccelerator(m_hWnd, pMsg))
	{
	return TRUE; // handled keyboard shortcuts
	}
	else if(IsDialogMessage(pMsg))
	{
	return TRUE; // handled dialog messages
	}

	return FALSE;
	}

	void MainGui::InitDllStartWithPreSelect( PGUI_DLL_PARAMETER guiParam )
	{
	ComboProcessList.ResetContent();
	std::vector<Process>& processList = Scylla::processLister.getProcessListSnapshot();
	int newSel = -1;
	for (size_t i = 0; i < processList.size(); i++)
	{
	if (processList[i].PID == guiParam->dwProcessId)
	newSel = (int)i;
	swprintf_s(stringBuffer, L"0x%04X - %s - %s", processList[i].PID, processList[i].filename, processList[i].fullPath);
	ComboProcessList.AddString(stringBuffer);
	}
	if (newSel != -1)
	{
	ComboProcessList.SetCurSel(newSel);
	processSelectedActionHandler(newSel);

	if (guiParam->mod) //init mod
	{
	//select DLL
	size_t len = ProcessAccessHelp::moduleList.size();
	newSel = -1;
	for (size_t i = 0; i < len; i++)
	{
	if (ProcessAccessHelp::moduleList.at(i).modBaseAddr == (DWORD_PTR)guiParam->mod)
	{
	newSel = (int)i;
	break;
	}
	}
	if (newSel != -1)
	{
	//get selected module
	ProcessAccessHelp::selectedModule = &ProcessAccessHelp::moduleList.at(newSel);

	ProcessAccessHelp::targetImageBase = ProcessAccessHelp::selectedModule->modBaseAddr;
	ProcessAccessHelp::targetSizeOfImage = ProcessAccessHelp::getSizeOfImageProcess(ProcessAccessHelp::hProcess, ProcessAccessHelp::targetImageBase);

	DWORD modEntryPoint = ProcessAccessHelp::getEntryPointFromFile(ProcessAccessHelp::selectedModule->fullPath);

	EditOEPAddress.SetValue(modEntryPoint + ProcessAccessHelp::targetImageBase);

	Scylla::windowLog.log(L"->>> Module %s selected.", ProcessAccessHelp::selectedModule->getFilename());
	Scylla::windowLog.log(L"Imagebase: " PRINTF_DWORD_PTR_FULL L" Size: %08X EntryPoint: %08X", ProcessAccessHelp::selectedModule->modBaseAddr, ProcessAccessHelp::selectedModule->modBaseSize, modEntryPoint);
	}
	}
	}
	}

	BOOL MainGui::OnInitDialog(CWindow wndFocus, LPARAM lInitParam)
	{
	if (SystemInformation::currenOS == UNKNOWN_OS)
	{
	if(IDCANCEL == MessageBox(L"Operating System is not supported\r\nContinue anyway?", L"Scylla", MB_ICONWARNING \| MB_OKCANCEL))
	{
	SendMessage(WM_CLOSE);
	return FALSE;
	}
	}

	// register ourselves to receive PreTranslateMessage
	CMessageLoop* pLoop = _Module.GetMessageLoop();
	pLoop->AddMessageFilter(this);

	setupStatusBar();

	DoDataExchange(); // attach controls
	DlgResize_Init(true, true); // init CDialogResize

	Scylla::windowLog.setWindow(ListLog);

	appendPluginListToMenu(hMenuImports.GetSubMenu(0));
	appendPluginListToMenu(CMenuHandle(GetMenu()).GetSubMenu(MenuImportsOffsetTrace));

	enableDialogControls(FALSE);
	setIconAndDialogCaption();

	if (lInitParam)
	{
	InitDllStartWithPreSelect((PGUI_DLL_PARAMETER)lInitParam);
	}
	return TRUE;
	}


	void MainGui::OnDestroy()
	{
	PostQuitMessage(0);
	}

	void MainGui::OnSize(UINT nType, CSize size)
	{
	StatusBar.SendMessage(WM_SIZE);
	SetMsgHandled(FALSE);
	}

	void MainGui::OnContextMenu(CWindow wnd, CPoint point)
	{
	switch(wnd.GetDlgCtrlID())
	{
	case IDC_TREE_IMPORTS:
	DisplayContextMenuImports(wnd, point);
	return;
	case IDC_LIST_LOG:
	DisplayContextMenuLog(wnd, point);
	return;
	}

	SetMsgHandled(FALSE);
	}

	void MainGui::OnCommand(UINT uNotifyCode, int nID, CWindow wndCtl)
	{
	// Handle plugin trace menu selection
	if(uNotifyCode == 0 && !wndCtl.IsWindow()) // make sure it's a menu
	{
	if ((nID >= PLUGIN_MENU_BASE_ID) && (nID <= (int)(Scylla::plugins.getScyllaPluginList().size() + Scylla::plugins.getImprecPluginList().size() + PLUGIN_MENU_BASE_ID)))
	{
	pluginActionHandler(nID);
	return;
	}
	}
	SetMsgHandled(FALSE);
	}

	LRESULT MainGui::OnTreeImportsDoubleClick(const NMHDR* pnmh)
	{
	if(TreeImports.GetCount() < 1)
	return 0;

	// Get item under cursor
	CTreeItem over = findTreeItem(CPoint(GetMessagePos()), true);
	if(over && importsHandling.isImport(over))
	{
	pickApiActionHandler(over);
	}

	return 0;
	}

	LRESULT MainGui::OnTreeImportsKeyDown(const NMHDR* pnmh)
	{
	const NMTVKEYDOWN * tkd = (NMTVKEYDOWN *)pnmh;
	switch(tkd->wVKey)
	{
	case VK_RETURN:
	{
	CTreeItem selected = TreeImports.GetFocusItem();
	if(!selected.IsNull() && importsHandling.isImport(selected))
	{
	pickApiActionHandler(selected);
	}
	}
	return 1;
	case VK_DELETE:
	deleteSelectedImportsActionHandler();
	return 1;
	}

	SetMsgHandled(FALSE);
	return 0;
	}

	UINT MainGui::OnTreeImportsSubclassGetDlgCode(const MSG * lpMsg)
	{
	if(lpMsg)
	{
	switch(lpMsg->wParam)
	{
	case VK_RETURN:
	return DLGC_WANTMESSAGE;
	}
	}

	SetMsgHandled(FALSE);
	return 0;
	}

	void MainGui::OnTreeImportsSubclassChar(UINT nChar, UINT nRepCnt, UINT nFlags)
	{
	switch(nChar)
	{
	case VK_RETURN:
	break;
	default:
	SetMsgHandled(FALSE);
	break;
	}
	}

	void MainGui::OnProcessListDrop(UINT uNotifyCode, int nID, CWindow wndCtl)
	{
	fillProcessListComboBox(ComboProcessList);
	}

	void MainGui::OnProcessListSelected(UINT uNotifyCode, int nID, CWindow wndCtl)
	{
	processSelectedActionHandler(ComboProcessList.GetCurSel());
	}

	void MainGui::OnPickDLL(UINT uNotifyCode, int nID, CWindow wndCtl)
	{
	pickDllActionHandler();
	}

	void MainGui::OnOptions(UINT uNotifyCode, int nID, CWindow wndCtl)
	{
	optionsActionHandler();
	}

	void MainGui::OnDump(UINT uNotifyCode, int nID, CWindow wndCtl)
	{
	dumpActionHandler();
	}

	void MainGui::OnDumpMemory(UINT uNotifyCode, int nID, CWindow wndCtl)
	{
	dumpMemoryActionHandler();
	}

	void MainGui::OnDumpSection(UINT uNotifyCode, int nID, CWindow wndCtl)
	{
	dumpSectionActionHandler();
	}

	void MainGui::OnFixDump(UINT uNotifyCode, int nID, CWindow wndCtl)
	{
	dumpFixActionHandler();
	}

	void MainGui::OnPERebuild(UINT uNotifyCode, int nID, CWindow wndCtl)
	{
	peRebuildActionHandler();
	}

	void MainGui::OnDLLInject(UINT uNotifyCode, int nID, CWindow wndCtl)
	{
	dllInjectActionHandler();
	}
	void MainGui::OnDisassembler(UINT uNotifyCode, int nID, CWindow wndCtl)
	{
	disassemblerActionHandler();
	}

	void MainGui::OnIATAutoSearch(UINT uNotifyCode, int nID, CWindow wndCtl)
	{
	iatAutosearchActionHandler();
	}

	void MainGui::OnGetImports(UINT uNotifyCode, int nID, CWindow wndCtl)
	{
	getImportsActionHandler();
	}

	void MainGui::OnInvalidImports(UINT uNotifyCode, int nID, CWindow wndCtl)
	{
	showInvalidImportsActionHandler();
	}

	void MainGui::OnSuspectImports(UINT uNotifyCode, int nID, CWindow wndCtl)
	{
	showSuspectImportsActionHandler();
	}

	void MainGui::OnClearImports(UINT uNotifyCode, int nID, CWindow wndCtl)
	{
	clearImportsActionHandler();
	}

	void MainGui::OnInvalidateSelected(UINT uNotifyCode, int nID, CWindow wndCtl)
	{
	invalidateSelectedImportsActionHandler();
	}

	void MainGui::OnCutSelected(UINT uNotifyCode, int nID, CWindow wndCtl)
	{
	deleteSelectedImportsActionHandler();
	}

	void MainGui::OnSaveTree(UINT uNotifyCode, int nID, CWindow wndCtl)
	{
	saveTreeActionHandler();
	}

	void MainGui::OnLoadTree(UINT uNotifyCode, int nID, CWindow wndCtl)
	{
	loadTreeActionHandler();
	}

	void MainGui::OnAutotrace(UINT uNotifyCode, int nID, CWindow wndCtl)
	{
	// TODO
	}

	void MainGui::OnExit(UINT uNotifyCode, int nID, CWindow wndCtl)
	{
	if (isProcessSuspended)
	{
	int msgboxID = MessageBox(L"Process is suspended. Do you want to terminate the process?\r\n\r\nYES = Terminate Process\r\nNO = Try to resume the process\r\nCancel = Do nothing", L"Information", MB_YESNOCANCEL\|MB_ICONINFORMATION);

	switch (msgboxID)
	{
	case IDYES:
	ProcessAccessHelp::terminateProcess();
	break;
	case IDNO:
	ProcessAccessHelp::resumeProcess();
	break;
	default:
	break;
	}
	}

	DestroyWindow();
	}

	void MainGui::OnAbout(UINT uNotifyCode, int nID, CWindow wndCtl)
	{
	showAboutDialog();
	}

	void MainGui::OnDonate(UINT uNotifyCode, int nID, CWindow wndCtl)
	{
	showDonateDialog();
	}

	void MainGui::setupStatusBar()
	{
	StatusBar.Create(m_hWnd, NULL, L"", WS_CHILD \| WS_VISIBLE \| WS_CLIPCHILDREN \| WS_CLIPSIBLINGS \| SBARS_TOOLTIPS, NULL, IDC_STATUS_BAR);

	CRect rcMain, rcStatus;
	GetClientRect(&rcMain);
	StatusBar.GetWindowRect(&rcStatus);

	const int PARTS = 4;
	int widths[PARTS];

	widths[PART_COUNT] = rcMain.Width() / 5;
	widths[PART_INVALID] = widths[PART_COUNT] + rcMain.Width() / 5;
	widths[PART_IMAGEBASE] = widths[PART_INVALID] + rcMain.Width() / 3;
	widths[PART_MODULE] = -1;

	StatusBar.SetParts(PARTS, widths);

	ResizeClient(rcMain.Width(), rcMain.Height() + rcStatus.Height(), FALSE);
	}

	void MainGui::updateStatusBar()
	{
	// Rewrite ImportsHandling so we get these easily
	unsigned int totalImports = importsHandling.thunkCount();
	unsigned int invalidImports = importsHandling.invalidThunkCount();

	// \t = center, \t\t = right-align
	swprintf_s(stringBuffer, L"\tImports: %u", totalImports);
	StatusBar.SetText(PART_COUNT, stringBuffer);

	if(invalidImports > 0)
	{
	StatusBar.SetIcon(PART_INVALID, hIconError);
	}
	else
	{
	StatusBar.SetIcon(PART_INVALID, hIconCheck);
	}

	swprintf_s(stringBuffer, L"\tInvalid: %u", invalidImports);
	StatusBar.SetText(PART_INVALID, stringBuffer);

	if(selectedProcess)
	{
	DWORD_PTR imageBase = 0;
	const WCHAR * fileName = 0;

	if(ProcessAccessHelp::selectedModule)
	{
	imageBase = ProcessAccessHelp::selectedModule->modBaseAddr;
	fileName = ProcessAccessHelp::selectedModule->getFilename();
	}
	else
	{
	imageBase = selectedProcess->imageBase;
	fileName = selectedProcess->filename;
	}

	swprintf_s(stringBuffer, L"\tImagebase: " PRINTF_DWORD_PTR_FULL, imageBase);
	StatusBar.SetText(PART_IMAGEBASE, stringBuffer);
	StatusBar.SetText(PART_MODULE, fileName);
	StatusBar.SetTipText(PART_MODULE, fileName);
	}
	else
	{
	StatusBar.SetText(PART_IMAGEBASE, L"");
	StatusBar.SetText(PART_MODULE, L"");
	}
	}

	bool MainGui::showFileDialog(WCHAR * selectedFile, bool save, const WCHAR * defFileName, const WCHAR * filter, const WCHAR * defExtension, const WCHAR * directory)
	{
	OPENFILENAME ofn = {0};

	// WTL doesn't support new explorer styles on Vista and up
	// This is because it uses a custom hook, we could remove it or derive
	// from CFileDialog but this solution is easier and allows more control anyway (e.g. initial dir)

	if(defFileName)
	{
	wcscpy_s(selectedFile, MAX_PATH, defFileName);
	}
	else
	{
	selectedFile[0] = L'\0';
	}

	ofn.lStructSize = sizeof(ofn);
	ofn.hwndOwner = m_hWnd;
	ofn.lpstrFilter = filter;
	ofn.lpstrDefExt = defExtension; // only first 3 chars are used, no dots!
	ofn.lpstrFile = selectedFile;
	ofn.lpstrInitialDir = directory;
	ofn.nMaxFile = MAX_PATH;
	ofn.Flags = OFN_PATHMUSTEXIST \| OFN_HIDEREADONLY;

	/*
	*OFN_EXPLORER is automatically used, it only has to be specified
	*if using a custom hook
	*OFN_LONGNAMES is automatically used by explorer-style dialogs
	*/

	if(save)
	ofn.Flags \|= OFN_OVERWRITEPROMPT;
	else
	ofn.Flags \|= OFN_FILEMUSTEXIST;

	if(save)
	return 0 != GetSaveFileName(&ofn);
	else
	return 0 != GetOpenFileName(&ofn);
	}

	void MainGui::setIconAndDialogCaption()
	{
	SetIcon(hIcon, TRUE);
	SetIcon(hIcon, FALSE);

	SetWindowText(APPNAME L" " ARCHITECTURE L" " APPVERSION);
	}

	void MainGui::pickDllActionHandler()
	{
	if(!selectedProcess)
	return;

	PickDllGui dlgPickDll(ProcessAccessHelp::moduleList);
	if(dlgPickDll.DoModal())
	{
	//get selected module
	ProcessAccessHelp::selectedModule = dlgPickDll.getSelectedModule();

	ProcessAccessHelp::targetImageBase = ProcessAccessHelp::selectedModule->modBaseAddr;
	ProcessAccessHelp::targetSizeOfImage = ProcessAccessHelp::getSizeOfImageProcess(ProcessAccessHelp::hProcess, ProcessAccessHelp::targetImageBase);

	DWORD modEntryPoint = ProcessAccessHelp::getEntryPointFromFile(ProcessAccessHelp::selectedModule->fullPath);

	EditOEPAddress.SetValue(modEntryPoint + ProcessAccessHelp::targetImageBase);

	Scylla::windowLog.log(L"->>> Module %s selected.", ProcessAccessHelp::selectedModule->getFilename());
	Scylla::windowLog.log(L"Imagebase: " PRINTF_DWORD_PTR_FULL L" Size: %08X EntryPoint: %08X", ProcessAccessHelp::selectedModule->modBaseAddr, ProcessAccessHelp::selectedModule->modBaseSize, modEntryPoint);
	}
	else
	{
	ProcessAccessHelp::selectedModule = 0;
	}

	updateStatusBar();
	}

	void MainGui::pickApiActionHandler(CTreeItem item)
	{
	if(!importsHandling.isImport(item))
	return;

	// TODO: new node when user picked an API from another DLL?

	PickApiGui dlgPickApi(ProcessAccessHelp::moduleList);
	if(dlgPickApi.DoModal())
	{
	const ApiInfo* api = dlgPickApi.getSelectedApi();
	if(api && api->module)
	{
	importsHandling.setImport(item, api->module->getFilename(), api->name, api->ordinal, api->hint, true, api->isForwarded);
	}
	}

	updateStatusBar();
	}

	void MainGui::startDisassemblerGui(CTreeItem selectedTreeNode)
	{
	if(!selectedProcess)
	return;

	DWORD_PTR address = importsHandling.getApiAddressByNode(selectedTreeNode);
	if (address)
	{
	BYTE test;
	if(!ProcessAccessHelp::readMemoryFromProcess(address, sizeof(test), &test))
	{
	swprintf_s(stringBuffer, L"Can't read memory at " PRINTF_DWORD_PTR_FULL, address);
	MessageBox(stringBuffer, L"Failure", MB_ICONERROR);
	}
	else
	{
	DisassemblerGui dlgDisassembler(address, &apiReader);
	dlgDisassembler.DoModal();
	}
	}
	}

	void MainGui::processSelectedActionHandler(int index)
	{
	std::vector<Process>& processList = Scylla::processLister.getProcessList();
	Process &process = processList.at(index);
	selectedProcess = 0;

	clearImportsActionHandler();

	Scylla::windowLog.log(L"Analyzing %s", process.fullPath);

	if (ProcessAccessHelp::hProcess != 0)
	{
	ProcessAccessHelp::closeProcessHandle();
	apiReader.clearAll();
	}

	if (!ProcessAccessHelp::openProcessHandle(process.PID))
	{
	enableDialogControls(FALSE);
	Scylla::windowLog.log(L"Error: Cannot open process handle.");
	updateStatusBar();
	return;
	}

	ProcessAccessHelp::getProcessModules(process.PID, ProcessAccessHelp::moduleList);

	apiReader.readApisFromModuleList();

	Scylla::windowLog.log(L"Loading modules done.");

	//TODO improve
	ProcessAccessHelp::selectedModule = 0;

	ProcessAccessHelp::targetImageBase = process.imageBase;
	ProcessAccessHelp::targetSizeOfImage = ProcessAccessHelp::getSizeOfImageProcess(ProcessAccessHelp::hProcess, ProcessAccessHelp::targetImageBase);

	process.imageSize = (DWORD)ProcessAccessHelp::targetSizeOfImage;


	Scylla::windowLog.log(L"Imagebase: " PRINTF_DWORD_PTR_FULL L" Size: %08X", process.imageBase, process.imageSize);

	process.entryPoint = ProcessAccessHelp::getEntryPointFromFile(process.fullPath);

	EditOEPAddress.SetValue(process.entryPoint + process.imageBase);

	selectedProcess = &process;
	enableDialogControls(TRUE);

	updateStatusBar();
	}

	void MainGui::fillProcessListComboBox(CComboBox& hCombo)
	{
	hCombo.ResetContent();

	std::vector<Process>& processList = Scylla::processLister.getProcessListSnapshot();

	for (size_t i = 0; i < processList.size(); i++)
	{
	swprintf_s(stringBuffer, L"0x%04X - %s - %s", processList[i].PID, processList[i].filename, processList[i].fullPath);
	hCombo.AddString(stringBuffer);
	}
	}

	/*
	void MainGui::addTextToOutputLog(const WCHAR * text)
	{
	if (m_hWnd)
	{
	ListLog.SetCurSel(ListLog.AddString(text));
	}
	}
	*/

	void MainGui::clearOutputLog()
	{
	if (m_hWnd)
	{
	ListLog.ResetContent();
	}
	}

	bool MainGui::saveLogToFile(const WCHAR * file)
	{
	const BYTE BOM[] = {0xFF, 0xFE}; // UTF-16 little-endian
	const WCHAR newLine[] = L"\r\n";
	bool success = true;

	HANDLE hFile = CreateFile(file, GENERIC_WRITE, FILE_SHARE_READ, 0, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, 0);
	if(hFile != INVALID_HANDLE_VALUE)
	{
	ProcessAccessHelp::writeMemoryToFileEnd(hFile, sizeof(BOM), BOM);

	WCHAR * buffer = 0;
	size_t bufsize = 0;
	for(int i = 0; i < ListLog.GetCount(); i++)
	{
	size_t size = ListLog.GetTextLen(i);
	size += _countof(newLine)-1;
	if(size+1 > bufsize)
	{
	bufsize = size+1;
	delete[] buffer;
	try
	{
	buffer = new WCHAR[bufsize];
	}
	catch(std::bad_alloc&)
	{
	buffer = 0;
	success = false;
	break;
	}
	}

	ListLog.GetText(i, buffer);
	wcscat_s(buffer, bufsize, newLine);

	ProcessAccessHelp::writeMemoryToFileEnd(hFile, (DWORD)(size * sizeof(WCHAR)), buffer);
	}
	delete[] buffer;
	CloseHandle(hFile);
	}
	return success;
	}

	void MainGui::showInvalidImportsActionHandler()
	{
	importsHandling.selectImports(true, false);
	GotoDlgCtrl(TreeImports);
	}

	void MainGui::showSuspectImportsActionHandler()
	{
	importsHandling.selectImports(false, true);
	GotoDlgCtrl(TreeImports);
	}

	void MainGui::deleteSelectedImportsActionHandler()
	{
	CTreeItem selected = TreeImports.GetFirstSelectedItem();
	while(!selected.IsNull())
	{
	if(importsHandling.isModule(selected))
	{
	importsHandling.cutModule(selected);
	}
	else
	{
	importsHandling.cutImport(selected);
	}
	selected = TreeImports.GetNextSelectedItem(selected);
	}
	updateStatusBar();
	}

	void MainGui::invalidateSelectedImportsActionHandler()
	{
	CTreeItem selected = TreeImports.GetFirstSelectedItem();
	while(!selected.IsNull())
	{
	if(importsHandling.isImport(selected))
	{
	importsHandling.invalidateImport(selected);
	}
	selected = TreeImports.GetNextSelectedItem(selected);
	}
	updateStatusBar();
	}

	void MainGui::loadTreeActionHandler()
	{
	if(!selectedProcess)
	return;

	WCHAR selectedFilePath[MAX_PATH];
	getCurrentModulePath(stringBuffer, _countof(stringBuffer));
	if(showFileDialog(selectedFilePath, false, NULL, filterXml, NULL, stringBuffer))
	{
	TreeImportExport treeIO(selectedFilePath);
	DWORD_PTR addrOEP = 0;
	DWORD_PTR addrIAT = 0;
	DWORD sizeIAT = 0;

	if(!treeIO.importTreeList(importsHandling.moduleList, &addrOEP, &addrIAT, &sizeIAT))
	{
	Scylla::windowLog.log(L"Loading tree file failed %s", selectedFilePath);
	MessageBox(L"Loading tree file failed.", L"Failure", MB_ICONERROR);
	}
	else
	{
	EditOEPAddress.SetValue(addrOEP);
	EditIATAddress.SetValue(addrIAT);
	EditIATSize.SetValue(sizeIAT);

	importsHandling.displayAllImports();
	updateStatusBar();

	Scylla::windowLog.log(L"Loaded tree file %s", selectedFilePath);
	Scylla::windowLog.log(L"-> OEP: " PRINTF_DWORD_PTR_FULL, addrOEP);
	Scylla::windowLog.log(L"-> IAT: " PRINTF_DWORD_PTR_FULL L" Size: " PRINTF_DWORD_PTR, addrIAT, sizeIAT);
	}
	}
	}

	void MainGui::saveTreeActionHandler()
	{
	if(!selectedProcess)
	return;

	WCHAR selectedFilePath[MAX_PATH];
	getCurrentModulePath(stringBuffer, _countof(stringBuffer));
	if(showFileDialog(selectedFilePath, true, NULL, filterXml, L"xml", stringBuffer))
	{
	TreeImportExport treeIO(selectedFilePath);
	DWORD_PTR addrOEP = EditOEPAddress.GetValue();
	DWORD_PTR addrIAT = EditIATAddress.GetValue();
	DWORD sizeIAT = EditIATSize.GetValue();

	if(!treeIO.exportTreeList(importsHandling.moduleList, selectedProcess, addrOEP, addrIAT, sizeIAT))
	{
	Scylla::windowLog.log(L"Saving tree file failed %s", selectedFilePath);
	MessageBox(L"Saving tree file failed.", L"Failure", MB_ICONERROR);
	}
	else
	{
	Scylla::windowLog.log(L"Saved tree file %s", selectedFilePath);
	}
	}
	}

	void MainGui::iatAutosearchActionHandler()
	{
	DWORD_PTR searchAddress = 0;
	DWORD_PTR addressIAT = 0, addressIATAdv = 0;
	DWORD sizeIAT = 0, sizeIATAdv = 0;
	IATSearch iatSearch;

	if(!selectedProcess)
	return;

	if(EditOEPAddress.GetWindowTextLength() > 0)
	{
	searchAddress = EditOEPAddress.GetValue();
	if (searchAddress)
	{

	if (Scylla::config[USE_ADVANCED_IAT_SEARCH].isTrue())
	{
	if (iatSearch.searchImportAddressTableInProcess(searchAddress, &addressIATAdv, &sizeIATAdv, true))
	{
	Scylla::windowLog.log(L"IAT Search Advanced: IAT VA " PRINTF_DWORD_PTR_FULL L" RVA " PRINTF_DWORD_PTR_FULL L" Size 0x%04X (%d)", addressIATAdv, addressIATAdv - ProcessAccessHelp::targetImageBase, sizeIATAdv, sizeIATAdv);
	}
	else
	{
	Scylla::windowLog.log(L"IAT Search Advanced: IAT not found at OEP " PRINTF_DWORD_PTR_FULL L"!", searchAddress);
	}
	}


	if (iatSearch.searchImportAddressTableInProcess(searchAddress, &addressIAT, &sizeIAT, false))
	{
	Scylla::windowLog.log(L"IAT Search Normal: IAT VA " PRINTF_DWORD_PTR_FULL L" RVA " PRINTF_DWORD_PTR_FULL L" Size 0x%04X (%d)", addressIAT, addressIAT - ProcessAccessHelp::targetImageBase, sizeIAT, sizeIAT);
	}
	else
	{
	Scylla::windowLog.log(L"IAT Search Normal: IAT not found at OEP " PRINTF_DWORD_PTR_FULL L"!", searchAddress);
	}

	if (addressIAT != 0 && addressIATAdv == 0)
	{
	setDialogIATAddressAndSize(addressIAT, sizeIAT);
	}
	else if (addressIAT == 0 && addressIATAdv != 0)
	{
	setDialogIATAddressAndSize(addressIATAdv, sizeIATAdv);
	}
	else if (addressIAT != 0 && addressIATAdv != 0)
	{
	if (addressIATAdv != addressIAT \|\| sizeIAT != sizeIATAdv)
	{
	int msgboxID = MessageBox(L"Result of advanced and normal search is different. Do you want to use the IAT Search Advanced result?", L"Information", MB_YESNO\|MB_ICONINFORMATION);
	if (msgboxID == IDYES)
	{
	setDialogIATAddressAndSize(addressIATAdv, sizeIATAdv);
	}
	else
	{
	setDialogIATAddressAndSize(addressIAT, sizeIAT);
	}
	}
	else
	{
	setDialogIATAddressAndSize(addressIAT, sizeIAT);
	}
	}

	}
	}
	}

	void MainGui::getImportsActionHandler()
	{
	if(!selectedProcess)
	return;

	DWORD_PTR addressIAT = EditIATAddress.GetValue();
	DWORD sizeIAT = EditIATSize.GetValue();

	if (addressIAT && sizeIAT)
	{
	apiReader.readAndParseIAT(addressIAT, sizeIAT, importsHandling.moduleList);
	importsHandling.displayAllImports();

	updateStatusBar();

	if (Scylla::config[SCAN_AND_FIX_DIRECT_IMPORTS].isTrue())
	{
	IATReferenceScan sc;
	sc.ScanForDirectImports = true;
	sc.ScanForNormalImports = false;
	sc.startScan(ProcessAccessHelp::targetImageBase, (DWORD)ProcessAccessHelp::targetSizeOfImage, addressIAT, sizeIAT);

	Scylla::windowLog.log(L"DIRECT IMPORTS - Found %d possible direct imports!", sc.numberOfFoundDirectImports());

	if (sc.numberOfFoundDirectImports() > 0)
	{
	sc.patchDirectImportsMemory();
	Scylla::windowLog.log(L"DIRECT IMPORTS - Patched!");
	}
	}


	if (isIATOutsidePeImage(addressIAT))
	{
	Scylla::windowLog.log(L"WARNING! IAT is not inside the PE image, requires rebasing!");
	}
	}
	}

	void MainGui::SetupImportsMenuItems(CTreeItem item)
	{
	bool isItem, isImport = false;
	isItem = !item.IsNull();
	if(isItem)
	{
	isImport = importsHandling.isImport(item);
	}

	CMenuHandle hSub = hMenuImports.GetSubMenu(0);

	UINT itemOnly = isItem ? MF_ENABLED : MF_GRAYED;
	UINT importOnly = isImport ? MF_ENABLED : MF_GRAYED;

	hSub.EnableMenuItem(ID__INVALIDATE, itemOnly);
	hSub.EnableMenuItem(ID__DISASSEMBLE, importOnly);
	hSub.EnableMenuItem(ID__CUTTHUNK, importOnly);

	hSub.EnableMenuItem(ID__DELETETREENODE, itemOnly);
	}

	void MainGui::DisplayContextMenuImports(CWindow hwnd, CPoint pt)
	{
	if(TreeImports.GetCount() < 1)
	return;

	CTreeItem over, parent;

	if(pt.x == -1 && pt.y == -1) // invoked by keyboard
	{
	CRect pos;
	over = TreeImports.GetFocusItem();
	if(over)
	{
	over.EnsureVisible();
	over.GetRect(&pos, TRUE);
	TreeImports.ClientToScreen(&pos);
	}
	else
	{
	TreeImports.GetWindowRect(&pos);
	}
	pt = pos.TopLeft();
	}
	else
	{
	// Get item under cursor
	over = findTreeItem(pt, true);
	}

	SetupImportsMenuItems(over);

	CMenuHandle hSub = hMenuImports.GetSubMenu(0);
	BOOL menuItem = hSub.TrackPopupMenu(TPM_LEFTALIGN \| TPM_RIGHTBUTTON \| TPM_RETURNCMD, pt.x, pt.y, hwnd);
	if (menuItem)
	{
	if ((menuItem >= PLUGIN_MENU_BASE_ID) && (menuItem <= (int)(Scylla::plugins.getScyllaPluginList().size() + Scylla::plugins.getImprecPluginList().size() + PLUGIN_MENU_BASE_ID)))
	{
	//wsprintf(stringBuffer, L"%d %s\n",menuItem,pluginList[menuItem - PLUGIN_MENU_BASE_ID].pluginName);
	//MessageBox(stringBuffer, L"plugin selection");

	pluginActionHandler(menuItem);
	return;
	}
	switch (menuItem)
	{
	case ID__INVALIDATE:
	if(importsHandling.isModule(over))
	importsHandling.invalidateModule(over);
	else
	importsHandling.invalidateImport(over);
	break;
	case ID__DISASSEMBLE:
	startDisassemblerGui(over);
	break;
	case ID__EXPANDALLNODES:
	importsHandling.expandAllTreeNodes();
	break;
	case ID__COLLAPSEALLNODES:
	importsHandling.collapseAllTreeNodes();
	break;
	case ID__CUTTHUNK:
	importsHandling.cutImport(over);
	break;
	case ID__DELETETREENODE:
	importsHandling.cutModule(importsHandling.isImport(over) ? over.GetParent() : over);
	break;
	}
	}

	updateStatusBar();
	}

	void MainGui::DisplayContextMenuLog(CWindow hwnd, CPoint pt)
	{
	if(pt.x == -1 && pt.y == -1) // invoked by keyboard
	{
	CRect pos;
	ListLog.GetWindowRect(&pos);
	pt = pos.TopLeft();
	}

	CMenuHandle hSub = hMenuLog.GetSubMenu(0);
	BOOL menuItem = hSub.TrackPopupMenu(TPM_LEFTALIGN \| TPM_RIGHTBUTTON \| TPM_RETURNCMD, pt.x, pt.y, hwnd);
	if (menuItem)
	{
	switch (menuItem)
	{
	case ID__SAVE:
	WCHAR selectedFilePath[MAX_PATH];
	getCurrentModulePath(stringBuffer, _countof(stringBuffer));
	if(showFileDialog(selectedFilePath, true, NULL, filterTxt, L"txt", stringBuffer))
	{
	saveLogToFile(selectedFilePath);
	}
	break;
	case ID__CLEAR:
	clearOutputLog();
	break;
	}
	}
	}

	void MainGui::appendPluginListToMenu(CMenuHandle hMenu)
	{
	std::vector<Plugin> &scyllaPluginList = Scylla::plugins.getScyllaPluginList();
	std::vector<Plugin> &imprecPluginList = Scylla::plugins.getImprecPluginList();

	if (scyllaPluginList.size() > 0)
	{
	CMenuHandle newMenu;
	newMenu.CreatePopupMenu();

	for (size_t i = 0; i < scyllaPluginList.size(); i++)
	{
	newMenu.AppendMenu(MF_STRING, i + PLUGIN_MENU_BASE_ID, scyllaPluginList[i].pluginName);
	}

	hMenu.AppendMenu(MF_MENUBARBREAK);
	hMenu.AppendMenu(MF_POPUP, newMenu, L"Scylla Plugins");
	}

	if (imprecPluginList.size() > 0)
	{
	CMenuHandle newMenu;
	newMenu.CreatePopupMenu();

	for (size_t i = 0; i < imprecPluginList.size(); i++)
	{
	newMenu.AppendMenu(MF_STRING, scyllaPluginList.size() + i + PLUGIN_MENU_BASE_ID, imprecPluginList[i].pluginName);
	}

	hMenu.AppendMenu(MF_MENUBARBREAK);
	hMenu.AppendMenu(MF_POPUP, newMenu, L"ImpREC Plugins");
	}
	}

	void MainGui::dumpMemoryActionHandler()
	{
	WCHAR selectedFilePath[MAX_PATH];
	DumpMemoryGui dlgDumpMemory;

	if(dlgDumpMemory.DoModal())
	{
	getCurrentModulePath(stringBuffer, _countof(stringBuffer));
	if(showFileDialog(selectedFilePath, true, dlgDumpMemory.dumpFilename, filterMem, L"mem", stringBuffer))
	{
	if (ProcessAccessHelp::writeMemoryToNewFile(selectedFilePath,dlgDumpMemory.dumpedMemorySize,dlgDumpMemory.dumpedMemory))
	{
	Scylla::windowLog.log(L"Memory dump saved %s", selectedFilePath);
	}
	else
	{
	Scylla::windowLog.log(L"Error! Cannot write memory dump to disk");
	}
	}
	}
	}

	void MainGui::dumpSectionActionHandler()
	{
	WCHAR selectedFilePath[MAX_PATH];
	DumpSectionGui dlgDumpSection;
	const WCHAR * fileFilter;
	const WCHAR * defExtension;
	PeParser * peFile = 0;

	dlgDumpSection.entryPoint = EditOEPAddress.GetValue();

	if (ProcessAccessHelp::selectedModule)
	{
	//dump DLL
	fileFilter = filterDll;
	defExtension = L"dll";

	dlgDumpSection.imageBase = ProcessAccessHelp::selectedModule->modBaseAddr;
	//get it from gui
	wcscpy_s(dlgDumpSection.fullpath, ProcessAccessHelp::selectedModule->fullPath);
	}
	else
	{
	fileFilter = filterExe;
	defExtension = L"exe";

	dlgDumpSection.imageBase = ProcessAccessHelp::targetImageBase;
	//get it from gui
	wcscpy_s(dlgDumpSection.fullpath, selectedProcess->fullPath);
	}

	if(dlgDumpSection.DoModal())
	{
	getCurrentModulePath(stringBuffer, _countof(stringBuffer));
	if(showFileDialog(selectedFilePath, true, NULL, fileFilter, defExtension, stringBuffer))
	{
	checkSuspendProcess();

	if (Scylla::config[USE_PE_HEADER_FROM_DISK].isTrue())
	{
	peFile = new PeParser(dlgDumpSection.fullpath, true);
	}
	else
	{
	peFile = new PeParser(dlgDumpSection.imageBase, true);
	}

	std::vector<PeSection> & sectionList = dlgDumpSection.getSectionList();

	if (peFile->dumpProcess(dlgDumpSection.imageBase, dlgDumpSection.entryPoint, selectedFilePath, sectionList))
	{
	Scylla::windowLog.log(L"Dump success %s", selectedFilePath);
	}
	else
	{
	Scylla::windowLog.log(L"Error: Cannot dump image.");
	MessageBox(L"Cannot dump image.", L"Failure", MB_ICONERROR);
	}

	delete peFile;
	}
	}
	}

	void MainGui::dumpActionHandler()
	{
	if(!selectedProcess)
	return;

	WCHAR selectedFilePath[MAX_PATH];
	const WCHAR * fileFilter;
	const WCHAR * defExtension;
	DWORD_PTR modBase = 0;
	DWORD_PTR entrypoint = 0;
	WCHAR * filename = 0;
	PeParser * peFile = 0;

	if (ProcessAccessHelp::selectedModule)
	{
	fileFilter = filterDll;
	defExtension = L"dll";
	}
	else
	{
	fileFilter = filterExe;
	defExtension = L"exe";
	}

	getCurrentModulePath(stringBuffer, _countof(stringBuffer));
	if(showFileDialog(selectedFilePath, true, NULL, fileFilter, defExtension, stringBuffer))
	{
	entrypoint = EditOEPAddress.GetValue();

	checkSuspendProcess();

	if (ProcessAccessHelp::selectedModule)
	{
	//dump DLL
	modBase = ProcessAccessHelp::selectedModule->modBaseAddr;
	filename = ProcessAccessHelp::selectedModule->fullPath;
	}
	else
	{
	//dump exe
	modBase = ProcessAccessHelp::targetImageBase;
	filename = selectedProcess->fullPath;
	}

	if (Scylla::config[USE_PE_HEADER_FROM_DISK].isTrue())
	{
	peFile = new PeParser(filename, true);
	}
	else
	{
	peFile = new PeParser(modBase, true);
	}

	if (peFile->dumpProcess(modBase, entrypoint, selectedFilePath))
	{
	Scylla::windowLog.log(L"Dump success %s", selectedFilePath);
	}
	else
	{
	Scylla::windowLog.log(L"Error: Cannot dump image.");
	MessageBox(L"Cannot dump image.", L"Failure", MB_ICONERROR);
	}

	delete peFile;
	}
	}

	void MainGui::peRebuildActionHandler()
	{
	DWORD newSize = 0;
	WCHAR selectedFilePath[MAX_PATH];

	getCurrentModulePath(stringBuffer, _countof(stringBuffer));
	if(showFileDialog(selectedFilePath, false, NULL, filterExeDll, NULL, stringBuffer))
	{
	if (Scylla::config[CREATE_BACKUP].isTrue())
	{
	if (!ProcessAccessHelp::createBackupFile(selectedFilePath))
	{
	Scylla::windowLog.log(L"Creating backup file failed %s", selectedFilePath);
	}
	}

	DWORD fileSize = (DWORD)ProcessAccessHelp::getFileSize(selectedFilePath);

	PeParser peFile(selectedFilePath, true);

	if (!peFile.isValidPeFile())
	{
	Scylla::windowLog.log(L"This is not a valid PE file %s", selectedFilePath);
	MessageBox(L"Not a valid PE file.", L"Failure", MB_ICONERROR);
	return;
	}

	if (peFile.readPeSectionsFromFile())
	{
	peFile.setDefaultFileAlignment();

	if (Scylla::config[REMOVE_DOS_HEADER_STUB].isTrue())
	{
	peFile.removeDosStub();
	}

	peFile.alignAllSectionHeaders();
	peFile.fixPeHeader();

	if (peFile.savePeFileToDisk(selectedFilePath))
	{
	newSize = (DWORD)ProcessAccessHelp::getFileSize(selectedFilePath);

	if (Scylla::config[UPDATE_HEADER_CHECKSUM].isTrue())
	{
	Scylla::windowLog.log(L"Generating PE header checksum");
	if (!PeParser::updatePeHeaderChecksum(selectedFilePath, newSize))
	{
	Scylla::windowLog.log(L"Generating PE header checksum FAILED!");
	}
	}

	Scylla::windowLog.log(L"Rebuild success %s", selectedFilePath);
	Scylla::windowLog.log(L"-> Old file size 0x%08X new file size 0x%08X (%d %%)", fileSize, newSize, ((newSize * 100) / fileSize) );
	}
	else
	{
	Scylla::windowLog.log(L"Rebuild failed, cannot save file %s", selectedFilePath);
	MessageBox(L"Rebuild failed. Cannot save file.", L"Failure", MB_ICONERROR);
	}
	}
	else
	{
	Scylla::windowLog.log(L"Rebuild failed, cannot read file %s", selectedFilePath);
	MessageBox(L"Rebuild failed. Cannot read file.", L"Failure", MB_ICONERROR);
	}

	}
	}

	void MainGui::dumpFixActionHandler()
	{
	if(!selectedProcess)
	return;

	if (TreeImports.GetCount() < 2)
	{
	Scylla::windowLog.log(L"Nothing to rebuild");
	return;
	}

	WCHAR newFilePath[MAX_PATH];
	WCHAR selectedFilePath[MAX_PATH];
	const WCHAR * fileFilter;
	DWORD_PTR modBase = 0;
	DWORD_PTR entrypoint = EditOEPAddress.GetValue();

	if (ProcessAccessHelp::selectedModule)
	{
	modBase = ProcessAccessHelp::selectedModule->modBaseAddr;
	fileFilter = filterDll;
	}
	else
	{
	modBase = ProcessAccessHelp::targetImageBase;
	fileFilter = filterExe;
	}

	getCurrentModulePath(stringBuffer, _countof(stringBuffer));
	if (showFileDialog(selectedFilePath, false, NULL, fileFilter, NULL, stringBuffer))
	{
	wcscpy_s(newFilePath, selectedFilePath);

	const WCHAR * extension = 0;

	WCHAR* dot = wcsrchr(newFilePath, L'.');
	if (dot)
	{
	*dot = L'\0';
	extension = selectedFilePath + (dot - newFilePath); //wcsrchr(selectedFilePath, L'.');
	}

	wcscat_s(newFilePath, L"_SCY");

	if(extension)
	{
	wcscat_s(newFilePath, extension);
	}

	ImportRebuilder importRebuild(selectedFilePath);

	if (Scylla::config[IAT_FIX_AND_OEP_FIX].isTrue())
	{
	importRebuild.setEntryPointRva((DWORD)(entrypoint - modBase));
	}

	if (Scylla::config[OriginalFirstThunk_SUPPORT].isTrue())
	{
	importRebuild.enableOFTSupport();
	}

	+ if (Scylla::config[CREATE_NEW_IAT_IN_SECTION].isTrue())
	+ {
	+ DWORD_PTR addressIAT = EditIATAddress.GetValue();
	+ DWORD sizeIAT = EditIATSize.GetValue();
	+ importRebuild.enableNewIatInSection(addressIAT,sizeIAT);
	+ }
	+
	+
	if (importRebuild.rebuildImportTable(newFilePath, importsHandling.moduleList))
	{
	Scylla::windowLog.log(L"Import Rebuild success %s", newFilePath);
	}
	else
	{
	Scylla::windowLog.log(L"Import Rebuild failed %s", selectedFilePath);
	MessageBox(L"Import Rebuild failed", L"Failure", MB_ICONERROR);
	}
	}
	}

	void MainGui::enableDialogControls(BOOL value)
	{
	BOOL valButton = value ? TRUE : FALSE;

	GetDlgItem(IDC_BTN_PICKDLL).EnableWindow(valButton);
	GetDlgItem(IDC_BTN_DUMP).EnableWindow(valButton);
	GetDlgItem(IDC_BTN_FIXDUMP).EnableWindow(valButton);
	GetDlgItem(IDC_BTN_IATAUTOSEARCH).EnableWindow(valButton);
	GetDlgItem(IDC_BTN_GETIMPORTS).EnableWindow(valButton);
	GetDlgItem(IDC_BTN_SUSPECTIMPORTS).EnableWindow(valButton);
	GetDlgItem(IDC_BTN_INVALIDIMPORTS).EnableWindow(valButton);
	GetDlgItem(IDC_BTN_CLEARIMPORTS).EnableWindow(valButton);

	CMenuHandle menu = GetMenu();

	UINT valMenu = value ? MF_ENABLED : MF_GRAYED;

	menu.EnableMenuItem(ID_FILE_DUMP, valMenu);
	menu.EnableMenuItem(ID_FILE_DUMPMEMORY, valMenu);
	menu.EnableMenuItem(ID_FILE_DUMPSECTION, valMenu);
	menu.EnableMenuItem(ID_FILE_FIXDUMP, valMenu);
	menu.EnableMenuItem(ID_IMPORTS_INVALIDATESELECTED, valMenu);
	menu.EnableMenuItem(ID_IMPORTS_CUTSELECTED, valMenu);
	menu.EnableMenuItem(ID_IMPORTS_SAVETREE, valMenu);
	menu.EnableMenuItem(ID_IMPORTS_LOADTREE, valMenu);
	menu.EnableMenuItem(ID_MISC_DLLINJECTION, valMenu);
	menu.EnableMenuItem(ID_MISC_DISASSEMBLER, valMenu);
	menu.GetSubMenu(MenuImportsOffsetTrace).EnableMenuItem(MenuImportsTraceOffsetScylla, MF_BYPOSITION \| valMenu);
	menu.GetSubMenu(MenuImportsOffsetTrace).EnableMenuItem(MenuImportsTraceOffsetImpRec, MF_BYPOSITION \| valMenu);

	//not yet implemented
	GetDlgItem(IDC_BTN_AUTOTRACE).EnableWindow(FALSE);
	menu.EnableMenuItem(ID_TRACE_AUTOTRACE, MF_GRAYED);
	}

	CTreeItem MainGui::findTreeItem(CPoint pt, bool screenCoordinates)
	{
	if(screenCoordinates)
	{
	TreeImports.ScreenToClient(&pt);
	}

	UINT flags;
	CTreeItem over = TreeImports.HitTest(pt, &flags);
	if(over)
	{
	if(!(flags & TVHT_ONITEM))
	{
	over.m_hTreeItem = NULL;
	}
	}

	return over;
	}

	void MainGui::showAboutDialog()
	{
	AboutGui dlgAbout;
	dlgAbout.DoModal();
	}

	void MainGui::showDonateDialog()
	{
	DonateGui dlgDonate;
	dlgDonate.DoModal();
	}

	void MainGui::dllInjectActionHandler()
	{
	if(!selectedProcess)
	return;

	WCHAR selectedFilePath[MAX_PATH];
	HMODULE hMod = 0;
	DllInjection dllInjection;

	getCurrentModulePath(stringBuffer, _countof(stringBuffer));
	if (showFileDialog(selectedFilePath, false, NULL, filterDll, NULL, stringBuffer))
	{
	hMod = dllInjection.dllInjection(ProcessAccessHelp::hProcess, selectedFilePath);
	if (hMod && Scylla::config[DLL_INJECTION_AUTO_UNLOAD].isTrue())
	{
	if (!dllInjection.unloadDllInProcess(ProcessAccessHelp::hProcess, hMod))
	{
	Scylla::windowLog.log(L"DLL unloading failed, target %s", selectedFilePath);
	}
	}

	if (hMod)
	{
	Scylla::windowLog.log(L"DLL Injection was successful, target %s", selectedFilePath);
	}
	else
	{
	Scylla::windowLog.log(L"DLL Injection failed, target %s", selectedFilePath);
	}
	}
	}

	void MainGui::disassemblerActionHandler()
	{
	DWORD_PTR oep = EditOEPAddress.GetValue();
	DisassemblerGui disGuiDlg(oep, &apiReader);
	disGuiDlg.DoModal();
	}

	void MainGui::optionsActionHandler()
	{
	OptionsGui dlgOptions;
	dlgOptions.DoModal();
	}

	void MainGui::clearImportsActionHandler()
	{
	importsHandling.clearAllImports();
	updateStatusBar();
	}

	void MainGui::pluginActionHandler( int menuItem )
	{
	if(!selectedProcess)
	return;

	DllInjectionPlugin dllInjectionPlugin;

	std::vector<Plugin> &scyllaPluginList = Scylla::plugins.getScyllaPluginList();
	std::vector<Plugin> &imprecPluginList = Scylla::plugins.getImprecPluginList();

	menuItem -= PLUGIN_MENU_BASE_ID;

	dllInjectionPlugin.hProcess = ProcessAccessHelp::hProcess;
	dllInjectionPlugin.apiReader = &apiReader;

	if (menuItem < (int)scyllaPluginList.size())
	{
	//scylla plugin
	dllInjectionPlugin.injectPlugin(scyllaPluginList[menuItem], importsHandling.moduleList,selectedProcess->imageBase, selectedProcess->imageSize);
	}
	else
	{
	#ifndef _WIN64

	menuItem -= (int)scyllaPluginList.size();
	//imprec plugin
	dllInjectionPlugin.injectImprecPlugin(imprecPluginList[menuItem], importsHandling.moduleList,selectedProcess->imageBase, selectedProcess->imageSize);

	#endif
	}

	importsHandling.scanAndFixModuleList();
	importsHandling.displayAllImports();
	updateStatusBar();
	}

	bool MainGui::getCurrentModulePath(WCHAR * buffer, size_t bufferSize)
	{
	if(!selectedProcess)
	return false;

	if(ProcessAccessHelp::selectedModule)
	{
	wcscpy_s(buffer, bufferSize, ProcessAccessHelp::selectedModule->fullPath);
	}
	else
	{
	wcscpy_s(buffer, bufferSize, selectedProcess->fullPath);
	}

	WCHAR * slash = wcsrchr(buffer, L'\\');
	if(slash)
	{
	*(slash+1) = L'\0';
	}

	return true;
	}

	void MainGui::checkSuspendProcess()
	{
	if (Scylla::config[SUSPEND_PROCESS_FOR_DUMPING].isTrue())
	{
	if (!ProcessAccessHelp::suspendProcess())
	{
	Scylla::windowLog.log(L"Error: Cannot suspend process.");
	}
	else
	{
	isProcessSuspended = true;
	Scylla::windowLog.log(L"Suspending process successful, please resume manually.");
	}
	}
	}

	void MainGui::setDialogIATAddressAndSize( DWORD_PTR addressIAT, DWORD sizeIAT )
	{
	EditIATAddress.SetValue(addressIAT);
	EditIATSize.SetValue(sizeIAT);

	swprintf_s(stringBuffer, L"IAT found:\r\n\r\nStart: " PRINTF_DWORD_PTR_FULL L"\r\nSize: 0x%04X (%d) ", addressIAT, sizeIAT, sizeIAT);
	MessageBox(stringBuffer, L"IAT found", MB_ICONINFORMATION);
	}

	bool MainGui::isIATOutsidePeImage( DWORD_PTR addressIAT )
	{
	DWORD_PTR minAdd = 0, maxAdd = 0;

	if(ProcessAccessHelp::selectedModule)
	{
	minAdd = ProcessAccessHelp::selectedModule->modBaseAddr;
	maxAdd = minAdd + ProcessAccessHelp::selectedModule->modBaseSize;
	}
	else
	{
	minAdd = selectedProcess->imageBase;
	maxAdd = minAdd + selectedProcess->imageSize;
	}

	if (addressIAT > minAdd && addressIAT < maxAdd)
	{
	return false; //inside pe image
	}
	else
	{
	return true; //outside pe image, requires rebasing iat
	}
	}
	diff --git a/Scylla/MainGui.rc b/Scylla/MainGui.rc
	index e2ae354..cd4ddcd 100644
	Binary files a/Scylla/MainGui.rc and b/Scylla/MainGui.rc differ
	diff --git a/Scylla/OptionsGui.cpp b/Scylla/OptionsGui.cpp
	index cc8f41d..e6b5f2c 100644
	--- a/Scylla/OptionsGui.cpp
	+++ b/Scylla/OptionsGui.cpp
	@@ -1,62 +1,64 @@
	#include "OptionsGui.h"
	#include "Scylla.h"

	BOOL OptionsGui::OnInitDialog(CWindow wndFocus, LPARAM lInitParam)
	{
	loadOptions();
	DoDataExchange(DDX_LOAD); // show settings

	EditSectionName.LimitText(IMAGE_SIZEOF_SHORT_NAME);

	CenterWindow();

	return TRUE;
	}

	void OptionsGui::OnOK(UINT uNotifyCode, int nID, CWindow wndCtl)
	{
	DoDataExchange(DDX_SAVE);
	saveOptions();
	Scylla::config.saveConfiguration();

	EndDialog(0);
	}

	void OptionsGui::OnCancel(UINT uNotifyCode, int nID, CWindow wndCtl)
	{
	EndDialog(0);
	}

	void OptionsGui::saveOptions() const
	{
	Scylla::config[USE_PE_HEADER_FROM_DISK].setBool(usePEHeaderFromDisk);
	Scylla::config[DEBUG_PRIVILEGE].setBool(debugPrivilege);
	Scylla::config[CREATE_BACKUP].setBool(createBackup);
	Scylla::config[DLL_INJECTION_AUTO_UNLOAD].setBool(dllInjectionAutoUnload);
	Scylla::config[UPDATE_HEADER_CHECKSUM].setBool(updateHeaderChecksum);
	Scylla::config[IAT_SECTION_NAME].setString(iatSectionName);
	Scylla::config[REMOVE_DOS_HEADER_STUB].setBool(removeDosHeaderStub);
	Scylla::config[IAT_FIX_AND_OEP_FIX].setBool(fixIatAndOep);
	Scylla::config[SUSPEND_PROCESS_FOR_DUMPING].setBool(suspendProcessForDumping);
	Scylla::config[OriginalFirstThunk_SUPPORT].setBool(oftSupport);
	Scylla::config[USE_ADVANCED_IAT_SEARCH].setBool(useAdvancedIatSearch);
	Scylla::config[SCAN_AND_FIX_DIRECT_IMPORTS].setBool(scanAndFixDirectImports);
	+ Scylla::config[CREATE_NEW_IAT_IN_SECTION].setBool(createNewIatInSection);
	}

	void OptionsGui::loadOptions()
	{
	usePEHeaderFromDisk = Scylla::config[USE_PE_HEADER_FROM_DISK].getBool();
	debugPrivilege = Scylla::config[DEBUG_PRIVILEGE].getBool();
	createBackup = Scylla::config[CREATE_BACKUP].getBool();
	dllInjectionAutoUnload = Scylla::config[DLL_INJECTION_AUTO_UNLOAD].getBool();
	updateHeaderChecksum = Scylla::config[UPDATE_HEADER_CHECKSUM].getBool();
	wcsncpy_s(iatSectionName, Scylla::config[IAT_SECTION_NAME].getString(), _countof(iatSectionName)-1);
	iatSectionName[_countof(iatSectionName) - 1] = L'\0';

	removeDosHeaderStub = Scylla::config[REMOVE_DOS_HEADER_STUB].getBool();
	fixIatAndOep = Scylla::config[IAT_FIX_AND_OEP_FIX].getBool();
	suspendProcessForDumping = Scylla::config[SUSPEND_PROCESS_FOR_DUMPING].getBool();
	oftSupport = Scylla::config[OriginalFirstThunk_SUPPORT].getBool();
	useAdvancedIatSearch = Scylla::config[USE_ADVANCED_IAT_SEARCH].getBool();
	scanAndFixDirectImports = Scylla::config[SCAN_AND_FIX_DIRECT_IMPORTS].getBool();
	+ createNewIatInSection = Scylla::config[CREATE_NEW_IAT_IN_SECTION].getBool();
	}
	diff --git a/Scylla/OptionsGui.h b/Scylla/OptionsGui.h
	index acaef96..d565675 100644
	--- a/Scylla/OptionsGui.h
	+++ b/Scylla/OptionsGui.h
	@@ -1,74 +1,76 @@
	#pragma once

	#include <windows.h>
	#include "resource.h"

	// WTL
	#include <atlbase.h> // base ATL classes
	#include <atlapp.h> // base WTL classes
	#include <atlwin.h> // ATL GUI classes
	#include <atlcrack.h> // WTL enhanced msg map macros
	#include <atlctrls.h> // WTL controls
	#include <atlddx.h> // WTL dialog data exchange

	class OptionsGui : public CDialogImpl<OptionsGui>, public CWinDataExchange<OptionsGui>
	{
	public:
	enum { IDD = IDD_DLG_OPTIONS };

	BEGIN_DDX_MAP(OptionsGui)
	DDX_CONTROL_HANDLE(IDC_OPTIONS_SECTIONNAME, EditSectionName)
	DDX_TEXT(IDC_OPTIONS_SECTIONNAME, iatSectionName)
	DDX_CHECK(IDC_CHECK_HEADER_CHECKSUM, updateHeaderChecksum)
	DDX_CHECK(IDC_CHECK_CREATE_BACKUP, createBackup)
	DDX_CHECK(IDC_CHECK_UNLOAD_DLL, dllInjectionAutoUnload)
	DDX_CHECK(IDC_CHECK_PE_HEADER_FROM_DISK, usePEHeaderFromDisk)
	DDX_CHECK(IDC_CHECK_DEBUG_PRIVILEGES, debugPrivilege)
	DDX_CHECK(IDC_CHECK_REMOVE_DOS_STUB, removeDosHeaderStub)
	DDX_CHECK(IDC_CHECK_FIX_IAT_AND_OEP, fixIatAndOep)
	DDX_CHECK(IDC_CHECK_SUSPEND_PROCESS, suspendProcessForDumping)
	DDX_CHECK(IDC_CHECKOFTSUPPORT, oftSupport)
	DDX_CHECK(IDC_CHECK_USEADVANCEDIATSEARCH, useAdvancedIatSearch)
	DDX_CHECK(IDC_SCANFIXDIRECTIMPORT, scanAndFixDirectImports)
	+ DDX_CHECK(IDC_NEWIATINSECTION, createNewIatInSection)
	END_DDX_MAP()

	BEGIN_MSG_MAP(OptionsGui)
	MSG_WM_INITDIALOG(OnInitDialog)

	COMMAND_ID_HANDLER_EX(IDC_BTN_OPTIONS_OK, OnOK)
	COMMAND_ID_HANDLER_EX(IDC_BTN_OPTIONS_CANCEL, OnCancel)
	COMMAND_ID_HANDLER_EX(IDCANCEL, OnCancel)
	END_MSG_MAP()

	protected:

	// Settings (filled by DDX)

	WCHAR iatSectionName[IMAGE_SIZEOF_SHORT_NAME+1];
	bool updateHeaderChecksum;
	bool createBackup;
	bool dllInjectionAutoUnload;
	bool usePEHeaderFromDisk;
	bool debugPrivilege;
	bool removeDosHeaderStub;
	bool fixIatAndOep;
	bool suspendProcessForDumping;
	bool oftSupport;
	bool useAdvancedIatSearch;
	bool scanAndFixDirectImports;
	+ bool createNewIatInSection;
	// Controls

	CEdit EditSectionName;

	// Message handlers

	BOOL OnInitDialog(CWindow wndFocus, LPARAM lInitParam);

	void OnOK(UINT uNotifyCode, int nID, CWindow wndCtl);
	void OnCancel(UINT uNotifyCode, int nID, CWindow wndCtl);

	// Gui helpers

	void saveOptions() const;
	void loadOptions();
	};
	diff --git a/Scylla/PeParser.cpp b/Scylla/PeParser.cpp
	index ca700ed..bf95d51 100644
	--- a/Scylla/PeParser.cpp
	+++ b/Scylla/PeParser.cpp
	@@ -1,1223 +1,1263 @@

	#include "PeParser.h"
	#include "ProcessAccessHelp.h"
	#include <algorithm>
	#include <imagehlp.h>

	#pragma comment(lib, "Imagehlp.lib")


	PeParser::PeParser()
	{
	initClass();
	}

	PeParser::PeParser(const WCHAR * file, bool readSectionHeaders)
	{
	initClass();

	filename = file;

	if (filename)
	{
	readPeHeaderFromFile(readSectionHeaders);

	if (readSectionHeaders)
	{
	if (isValidPeFile())
	{
	getSectionHeaders();
	}
	}
	}
	}

	PeParser::PeParser(const DWORD_PTR moduleBase, bool readSectionHeaders)
	{
	initClass();

	moduleBaseAddress = moduleBase;

	if (moduleBaseAddress)
	{
	readPeHeaderFromProcess(readSectionHeaders);

	if (readSectionHeaders)
	{
	if (isValidPeFile())
	{
	getSectionHeaders();
	}
	}
	}

	}

	PeParser::~PeParser()
	{
	if (headerMemory)
	{
	delete [] headerMemory;
	}
	if (fileMemory)
	{
	delete [] fileMemory;
	}

	for (size_t i = 0; i < listPeSection.size(); i++)
	{
	if (listPeSection[i].data)
	{
	delete [] listPeSection[i].data;
	}
	}

	listPeSection.clear();
	}

	void PeParser::initClass()
	{
	fileMemory = 0;
	headerMemory = 0;

	pDosHeader = 0;
	pDosStub = 0;
	dosStubSize = 0;
	pNTHeader32 = 0;
	pNTHeader64 = 0;
	overlayData = 0;
	overlaySize = 0;

	filename = 0;
	fileSize = 0;
	moduleBaseAddress = 0;
	hFile = INVALID_HANDLE_VALUE;
	}

	bool PeParser::isPE64()
	{
	if (isValidPeFile())
	{
	return (pNTHeader32->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR64_MAGIC);
	}
	else
	{
	return false;
	}
	}

	bool PeParser::isPE32()
	{
	if (isValidPeFile())
	{
	return (pNTHeader32->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR32_MAGIC);
	}
	else
	{
	return false;
	}
	}

	bool PeParser::isTargetFileSamePeFormat()
	{
	#ifdef _WIN64
	return isPE64();
	#else
	return isPE32();
	#endif
	}

	bool PeParser::isValidPeFile()
	{
	bool retValue = false;

	if (pDosHeader)
	{
	if (pDosHeader->e_magic == IMAGE_DOS_SIGNATURE)
	{
	if (pNTHeader32)
	{
	if (pNTHeader32->Signature == IMAGE_NT_SIGNATURE)
	{
	retValue = true;
	}
	}
	}
	}

	return retValue;
	}

	bool PeParser::hasDirectory(const int directoryIndex)
	{
	if (isPE32())
	{
	return (pNTHeader32->OptionalHeader.DataDirectory[directoryIndex].VirtualAddress != 0);
	}
	else if (isPE64())
	{
	return (pNTHeader64->OptionalHeader.DataDirectory[directoryIndex].VirtualAddress != 0);
	}
	else
	{
	return false;
	}
	}

	bool PeParser::hasExportDirectory()
	{
	return hasDirectory(IMAGE_DIRECTORY_ENTRY_EXPORT);
	}

	bool PeParser::hasTLSDirectory()
	{
	return hasDirectory(IMAGE_DIRECTORY_ENTRY_TLS);
	}

	bool PeParser::hasRelocationDirectory()
	{
	return hasDirectory(IMAGE_DIRECTORY_ENTRY_BASERELOC);
	}

	DWORD PeParser::getEntryPoint()
	{
	if (isPE32())
	{
	return pNTHeader32->OptionalHeader.AddressOfEntryPoint;
	}
	else if (isPE64())
	{
	return pNTHeader64->OptionalHeader.AddressOfEntryPoint;
	}
	else
	{
	return 0;
	}
	}

	bool PeParser::readPeHeaderFromProcess(bool readSectionHeaders)
	{
	bool retValue = false;
	DWORD correctSize = 0;

	DWORD readSize = getInitialHeaderReadSize(readSectionHeaders);

	headerMemory = new BYTE[readSize];

	if (ProcessAccessHelp::readMemoryPartlyFromProcess(moduleBaseAddress, readSize, headerMemory))
	{
	retValue = true;

	getDosAndNtHeader(headerMemory, (LONG)readSize);

	if (isValidPeFile())
	{
	correctSize = calcCorrectPeHeaderSize(readSectionHeaders);

	if (readSize < correctSize)
	{
	readSize = correctSize;
	delete [] headerMemory;
	headerMemory = new BYTE[readSize];

	if (ProcessAccessHelp::readMemoryPartlyFromProcess(moduleBaseAddress, readSize, headerMemory))
	{
	getDosAndNtHeader(headerMemory, (LONG)readSize);
	}
	}
	}
	}

	return retValue;
	}

	bool PeParser::readPeHeaderFromFile(bool readSectionHeaders)
	{
	bool retValue = false;
	DWORD correctSize = 0;
	DWORD numberOfBytesRead = 0;

	DWORD readSize = getInitialHeaderReadSize(readSectionHeaders);

	headerMemory = new BYTE[readSize];

	if (openFileHandle())
	{
	fileSize = (DWORD)ProcessAccessHelp::getFileSize(hFile);

	if (ReadFile(hFile, headerMemory, readSize, &numberOfBytesRead, 0))
	{
	retValue = true;

	getDosAndNtHeader(headerMemory, (LONG)readSize);

	if (isValidPeFile())
	{
	correctSize = calcCorrectPeHeaderSize(readSectionHeaders);

	if (readSize < correctSize)
	{
	readSize = correctSize;

	if (fileSize > 0)
	{
	if (fileSize < correctSize)
	{
	readSize = fileSize;
	}
	}


	delete [] headerMemory;
	headerMemory = new BYTE[readSize];

	SetFilePointer(hFile, 0, 0, FILE_BEGIN);

	if (ReadFile(hFile, headerMemory, readSize, &numberOfBytesRead, 0))
	{
	getDosAndNtHeader(headerMemory, (LONG)readSize);
	}
	}
	}
	}

	closeFileHandle();
	}

	return retValue;
	}

	bool PeParser::readPeSectionsFromProcess()
	{
	bool retValue = true;
	DWORD_PTR readOffset = 0;

	listPeSection.reserve(getNumberOfSections());

	for (WORD i = 0; i < getNumberOfSections(); i++)
	{
	readOffset = listPeSection[i].sectionHeader.VirtualAddress + moduleBaseAddress;

	listPeSection[i].normalSize = listPeSection[i].sectionHeader.Misc.VirtualSize;

	if (!readSectionFromProcess(readOffset, listPeSection[i]))
	{
	retValue = false;
	}
	}

	return retValue;
	}

	bool PeParser::readPeSectionsFromFile()
	{
	bool retValue = true;
	DWORD readOffset = 0;

	listPeSection.reserve(getNumberOfSections());


	if (openFileHandle())
	{
	for (WORD i = 0; i < getNumberOfSections(); i++)
	{
	readOffset = listPeSection[i].sectionHeader.PointerToRawData;

	listPeSection[i].normalSize = listPeSection[i].sectionHeader.SizeOfRawData;

	if (!readSectionFromFile(readOffset, listPeSection[i]))
	{
	retValue = false;
	}

	}

	closeFileHandle();
	}
	else
	{
	retValue = false;
	}

	return retValue;
	}

	bool PeParser::getSectionHeaders()
	{
	PIMAGE_SECTION_HEADER pSection = IMAGE_FIRST_SECTION(pNTHeader32);

	PeFileSection peFileSection;

	listPeSection.clear();
	listPeSection.reserve(getNumberOfSections());

	for (WORD i = 0; i < getNumberOfSections(); i++)
	{
	memcpy_s(&peFileSection.sectionHeader, sizeof(IMAGE_SECTION_HEADER), pSection, sizeof(IMAGE_SECTION_HEADER));

	listPeSection.push_back(peFileSection);
	pSection++;
	}

	return true;
	}

	bool PeParser::getSectionNameUnicode(const int sectionIndex, WCHAR * output, const int outputLen)
	{
	CHAR sectionNameA[IMAGE_SIZEOF_SHORT_NAME + 1] = {0};

	output[0] = 0;

	memcpy(sectionNameA, listPeSection[sectionIndex].sectionHeader.Name, IMAGE_SIZEOF_SHORT_NAME); //not null terminated

	return (swprintf_s(output, outputLen, L"%S", sectionNameA) != -1);
	}

	WORD PeParser::getNumberOfSections()
	{
	return pNTHeader32->FileHeader.NumberOfSections;
	}

	void PeParser::setNumberOfSections(WORD numberOfSections)
	{
	pNTHeader32->FileHeader.NumberOfSections = numberOfSections;
	}

	std::vector<PeFileSection> & PeParser::getSectionHeaderList()
	{
	return listPeSection;
	}

	void PeParser::getDosAndNtHeader(BYTE * memory, LONG size)
	{
	pDosHeader = (PIMAGE_DOS_HEADER)memory;

	pNTHeader32 = 0;
	pNTHeader64 = 0;
	dosStubSize = 0;
	pDosStub = 0;

	if (pDosHeader->e_lfanew > 0 && pDosHeader->e_lfanew < size) //malformed PE
	{
	pNTHeader32 = (PIMAGE_NT_HEADERS32)((DWORD_PTR)pDosHeader + pDosHeader->e_lfanew);
	pNTHeader64 = (PIMAGE_NT_HEADERS64)((DWORD_PTR)pDosHeader + pDosHeader->e_lfanew);

	if (pDosHeader->e_lfanew > sizeof(IMAGE_DOS_HEADER))
	{
	dosStubSize = pDosHeader->e_lfanew - sizeof(IMAGE_DOS_HEADER);
	pDosStub = (BYTE *)((DWORD_PTR)pDosHeader + sizeof(IMAGE_DOS_HEADER));
	}
	else if (pDosHeader->e_lfanew < sizeof(IMAGE_DOS_HEADER))
	{
	//Overlapped Headers, e.g. Spack (by Bagie)
	pDosHeader->e_lfanew = sizeof(IMAGE_DOS_HEADER);
	}
	}
	}

	DWORD PeParser::calcCorrectPeHeaderSize(bool readSectionHeaders)
	{
	DWORD correctSize = pDosHeader->e_lfanew + 50; //extra buffer

	if (readSectionHeaders)
	{
	correctSize += getNumberOfSections() * sizeof(IMAGE_SECTION_HEADER);
	}

	if (isPE32())
	{
	correctSize += sizeof(IMAGE_NT_HEADERS32);
	}
	else if(isPE64())
	{
	correctSize += sizeof(IMAGE_NT_HEADERS64);
	}
	else
	{
	correctSize = 0; //not a valid PE
	}

	return correctSize;
	}

	DWORD PeParser::getInitialHeaderReadSize(bool readSectionHeaders)
	{
	DWORD readSize = sizeof(IMAGE_DOS_HEADER) + 0x300 + sizeof(IMAGE_NT_HEADERS64);

	//if (readSectionHeaders)
	//{
	// readSize += (10 * sizeof(IMAGE_SECTION_HEADER));
	//}

	return readSize;
	}

	DWORD PeParser::getSectionHeaderBasedFileSize()
	{
	DWORD lastRawOffset = 0, lastRawSize = 0;

	//this is needed if the sections aren't sorted by their RawOffset (e.g. Petite)
	for (WORD i = 0; i < getNumberOfSections(); i++)
	{
	if (listPeSection[i].sectionHeader.PointerToRawData > lastRawOffset)
	{
	lastRawOffset = listPeSection[i].sectionHeader.PointerToRawData;
	lastRawSize = listPeSection[i].sectionHeader.SizeOfRawData;
	}
	}

	return (lastRawSize + lastRawOffset);
	}

	DWORD PeParser::getSectionHeaderBasedSizeOfImage()
	{
	DWORD lastVirtualOffset = 0, lastVirtualSize = 0;

	//this is needed if the sections aren't sorted by their RawOffset (e.g. Petite)
	for (WORD i = 0; i < getNumberOfSections(); i++)
	{
	if (listPeSection[i].sectionHeader.VirtualAddress > lastVirtualOffset)
	{
	lastVirtualOffset = listPeSection[i].sectionHeader.VirtualAddress;
	lastVirtualSize = listPeSection[i].sectionHeader.Misc.VirtualSize;
	}
	}

	return (lastVirtualSize + lastVirtualOffset);
	}

	bool PeParser::openFileHandle()
	{
	if (hFile == INVALID_HANDLE_VALUE)
	{
	if (filename)
	{
	hFile = CreateFile(filename, GENERIC_READ, FILE_SHARE_READ, 0, OPEN_EXISTING, 0, 0);
	}
	else
	{
	hFile = INVALID_HANDLE_VALUE;
	}
	}

	return (hFile != INVALID_HANDLE_VALUE);
	}

	bool PeParser::openWriteFileHandle( const WCHAR * newFile )
	{
	if (newFile)
	{
	hFile = CreateFile(newFile, GENERIC_WRITE, FILE_SHARE_WRITE, 0, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, 0);
	}
	else
	{
	hFile = INVALID_HANDLE_VALUE;
	}

	return (hFile != INVALID_HANDLE_VALUE);
	}


	void PeParser::closeFileHandle()
	{
	if (hFile != INVALID_HANDLE_VALUE)
	{
	CloseHandle(hFile);
	hFile = INVALID_HANDLE_VALUE;
	}
	}

	bool PeParser::readSectionFromProcess(const DWORD_PTR readOffset, PeFileSection & peFileSection)
	{
	return readSectionFrom(readOffset, peFileSection, true); //process
	}

	bool PeParser::readSectionFromFile(const DWORD readOffset, PeFileSection & peFileSection)
	{
	return readSectionFrom(readOffset, peFileSection, false); //file
	}

	bool PeParser::readSectionFrom(const DWORD_PTR readOffset, PeFileSection & peFileSection, const bool isProcess)
	{
	const DWORD maxReadSize = 100;
	DWORD currentReadSize;
	BYTE data[maxReadSize];
	bool retValue = true;
	DWORD valuesFound = 0;
	DWORD readSize = 0;
	DWORD_PTR currentOffset = 0;

	peFileSection.data = 0;
	peFileSection.dataSize = 0;
	readSize = peFileSection.normalSize;

	if (!readOffset \|\| !readSize)
	{
	return true; //section without data is valid
	}

	if (readSize <= maxReadSize)
	{
	peFileSection.dataSize = readSize;
	peFileSection.normalSize = readSize;

	if (isProcess)
	{
	return readPeSectionFromProcess(readOffset, peFileSection);
	}
	else
	{
	return readPeSectionFromFile((DWORD)readOffset, peFileSection);
	}
	}

	currentReadSize = readSize % maxReadSize; //alignment %

	if (!currentReadSize)
	{
	currentReadSize = maxReadSize;
	}
	currentOffset = readOffset + readSize - currentReadSize;


	while(currentOffset >= readOffset) //start from the end
	{
	ZeroMemory(data, currentReadSize);

	if (isProcess)
	{
	retValue = ProcessAccessHelp::readMemoryPartlyFromProcess(currentOffset, currentReadSize, data);
	}
	else
	{
	retValue = ProcessAccessHelp::readMemoryFromFile(hFile, (LONG)currentOffset, currentReadSize, data);
	}

	if (!retValue)
	{
	break;
	}

	valuesFound = isMemoryNotNull(data, currentReadSize);
	if (valuesFound)
	{
	//found some real code

	currentOffset += valuesFound;

	if (readOffset < currentOffset)
	{
	//real size
	peFileSection.dataSize = (DWORD)(currentOffset - readOffset);
	+
	+ //some safety space because of something like this at the end of a section:
	+ //FF25 C0604000 JMP DWORD PTR DS:[<&KERNEL32.RtlUnwind>]
	+ peFileSection.dataSize += sizeof(DWORD);;
	}

	break;
	}

	currentReadSize = maxReadSize;
	currentOffset -= currentReadSize;
	}

	+
	if (peFileSection.dataSize)
	{
	if (isProcess)
	{
	retValue = readPeSectionFromProcess(readOffset, peFileSection);
	}
	else
	{
	retValue = readPeSectionFromFile((DWORD)readOffset, peFileSection);
	}
	}

	return retValue;
	}


	DWORD PeParser::isMemoryNotNull( BYTE * data, int dataSize )
	{
	for (int i = (dataSize - 1); i >= 0; i--)
	{
	if (data[i] != 0)
	{
	return i + 1;
	}
	}

	return 0;
	}

	bool PeParser::savePeFileToDisk( const WCHAR * newFile )
	{
	bool retValue = true;
	DWORD dwFileOffset = 0, dwWriteSize = 0;

	if (getNumberOfSections() != listPeSection.size())
	{
	return false;
	}

	if (openWriteFileHandle(newFile))
	{
	//Dos header
	dwWriteSize = sizeof(IMAGE_DOS_HEADER);
	if (!ProcessAccessHelp::writeMemoryToFile(hFile, dwFileOffset, dwWriteSize, pDosHeader))
	{
	retValue = false;
	}
	dwFileOffset += dwWriteSize;


	if (dosStubSize && pDosStub)
	{
	//Dos Stub
	dwWriteSize = dosStubSize;
	if (!ProcessAccessHelp::writeMemoryToFile(hFile, dwFileOffset, dwWriteSize, pDosStub))
	{
	retValue = false;
	}
	dwFileOffset += dwWriteSize;
	}


	//Pe Header
	if (isPE32())
	{
	dwWriteSize = sizeof(IMAGE_NT_HEADERS32);
	}
	else
	{
	dwWriteSize = sizeof(IMAGE_NT_HEADERS64);
	}

	if (!ProcessAccessHelp::writeMemoryToFile(hFile, dwFileOffset, dwWriteSize, pNTHeader32))
	{
	retValue = false;
	}
	dwFileOffset += dwWriteSize;

	//section headers
	dwWriteSize = sizeof(IMAGE_SECTION_HEADER);

	for (WORD i = 0; i < getNumberOfSections(); i++)
	{
	if (!ProcessAccessHelp::writeMemoryToFile(hFile, dwFileOffset, dwWriteSize, &listPeSection[i].sectionHeader))
	{
	retValue = false;
	break;
	}
	dwFileOffset += dwWriteSize;
	}

	for (WORD i = 0; i < getNumberOfSections(); i++)
	{
	if (!listPeSection[i].sectionHeader.PointerToRawData)
	continue;


	if (listPeSection[i].sectionHeader.PointerToRawData > dwFileOffset)
	{
	dwWriteSize = listPeSection[i].sectionHeader.PointerToRawData - dwFileOffset; //padding

	if (!writeZeroMemoryToFile(hFile, dwFileOffset, dwWriteSize))
	{
	retValue = false;
	break;
	}
	dwFileOffset += dwWriteSize;
	}

	dwWriteSize = listPeSection[i].dataSize;

	if (dwWriteSize)
	{
	if (!ProcessAccessHelp::writeMemoryToFile(hFile, listPeSection[i].sectionHeader.PointerToRawData, dwWriteSize, listPeSection[i].data))
	{
	retValue = false;
	break;
	}
	dwFileOffset += dwWriteSize;

	if (listPeSection[i].dataSize < listPeSection[i].sectionHeader.SizeOfRawData) //padding
	{
	dwWriteSize = listPeSection[i].sectionHeader.SizeOfRawData - listPeSection[i].dataSize;

	if (!writeZeroMemoryToFile(hFile, dwFileOffset, dwWriteSize))
	{
	retValue = false;
	break;
	}
	dwFileOffset += dwWriteSize;
	}
	}

	}

	//add overlay?
	if (overlaySize && overlayData)
	{
	dwWriteSize = overlaySize;
	if (!ProcessAccessHelp::writeMemoryToFile(hFile, dwFileOffset, dwWriteSize, overlayData))
	{
	retValue = false;
	}
	dwFileOffset += dwWriteSize;
	}

	SetEndOfFile(hFile);

	closeFileHandle();
	}

	return retValue;
	}

	bool PeParser::writeZeroMemoryToFile(HANDLE hFile, DWORD fileOffset, DWORD size)
	{
	bool retValue = false;
	PVOID zeromemory = calloc(size, 1);

	if (zeromemory)
	{
	retValue = ProcessAccessHelp::writeMemoryToFile(hFile, fileOffset, size, zeromemory);
	free(zeromemory);
	}

	return retValue;
	}

	void PeParser::removeDosStub()
	{
	if (pDosHeader)
	{
	dosStubSize = 0;
	pDosStub = 0; //must not delete []
	pDosHeader->e_lfanew = sizeof(IMAGE_DOS_HEADER);
	}
	}

	bool PeParser::readPeSectionFromFile(DWORD readOffset, PeFileSection & peFileSection)
	{
	DWORD bytesRead = 0;

	peFileSection.data = new BYTE[peFileSection.dataSize];

	SetFilePointer(hFile, readOffset, 0, FILE_BEGIN);

	return (ReadFile(hFile, peFileSection.data, peFileSection.dataSize, &bytesRead, 0) != FALSE);
	}

	bool PeParser::readPeSectionFromProcess(DWORD_PTR readOffset, PeFileSection & peFileSection)
	{
	peFileSection.data = new BYTE[peFileSection.dataSize];

	return ProcessAccessHelp::readMemoryPartlyFromProcess(readOffset, peFileSection.dataSize, peFileSection.data);
	}

	DWORD PeParser::alignValue(DWORD badValue, DWORD alignTo)
	{
	return (((badValue + alignTo - 1) / alignTo) * alignTo);
	}

	bool PeParser::addNewLastSection(const CHAR * sectionName, DWORD sectionSize, BYTE * sectionData)
	{
	size_t nameLength = strlen(sectionName);
	DWORD fileAlignment = 0, sectionAlignment = 0;
	PeFileSection peFileSection;

	if (nameLength > IMAGE_SIZEOF_SHORT_NAME)
	{
	return false;
	}

	if (isPE32())
	{
	fileAlignment = pNTHeader32->OptionalHeader.FileAlignment;
	sectionAlignment = pNTHeader32->OptionalHeader.SectionAlignment;
	}
	else
	{
	fileAlignment = pNTHeader64->OptionalHeader.FileAlignment;
	sectionAlignment = pNTHeader64->OptionalHeader.SectionAlignment;
	}

	memcpy_s(peFileSection.sectionHeader.Name, IMAGE_SIZEOF_SHORT_NAME, sectionName, nameLength);

	//last section doesn't need SizeOfRawData alignment
	peFileSection.sectionHeader.SizeOfRawData = sectionSize; //alignValue(sectionSize, fileAlignment);
	peFileSection.sectionHeader.Misc.VirtualSize = alignValue(sectionSize, sectionAlignment);

	peFileSection.sectionHeader.PointerToRawData = alignValue(getSectionHeaderBasedFileSize(), fileAlignment);
	peFileSection.sectionHeader.VirtualAddress = alignValue(getSectionHeaderBasedSizeOfImage(), sectionAlignment);

	peFileSection.sectionHeader.Characteristics = IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE\|IMAGE_SCN_CNT_CODE\|IMAGE_SCN_CNT_INITIALIZED_DATA;

	peFileSection.normalSize = peFileSection.sectionHeader.SizeOfRawData;
	peFileSection.dataSize = peFileSection.sectionHeader.SizeOfRawData;

	if (sectionData == 0)
	{
	peFileSection.data = new BYTE[peFileSection.sectionHeader.SizeOfRawData];
	ZeroMemory(peFileSection.data , peFileSection.sectionHeader.SizeOfRawData);
	}
	else
	{
	peFileSection.data = sectionData;
	}

	listPeSection.push_back(peFileSection);

	setNumberOfSections(getNumberOfSections() + 1);

	return true;
	}

	+DWORD_PTR PeParser::getStandardImagebase()
	+{
	+ if (isPE32())
	+ {
	+ return pNTHeader32->OptionalHeader.ImageBase;
	+ }
	+ else
	+ {
	+ return pNTHeader64->OptionalHeader.ImageBase;
	+ }
	+}
	+
	int PeParser::convertRVAToOffsetVectorIndex(DWORD_PTR dwRVA)
	{
	for (WORD i = 0; i < getNumberOfSections(); i++)
	{
	if ((listPeSection[i].sectionHeader.VirtualAddress <= dwRVA) && ((listPeSection[i].sectionHeader.VirtualAddress + listPeSection[i].sectionHeader.Misc.VirtualSize) > dwRVA))
	{
	return i;
	}
	}

	return -1;
	}

	DWORD_PTR PeParser::convertRVAToOffsetVector(DWORD_PTR dwRVA)
	{
	for (WORD i = 0; i < getNumberOfSections(); i++)
	{
	if ((listPeSection[i].sectionHeader.VirtualAddress <= dwRVA) && ((listPeSection[i].sectionHeader.VirtualAddress + listPeSection[i].sectionHeader.Misc.VirtualSize) > dwRVA))
	{
	return ((dwRVA - listPeSection[i].sectionHeader.VirtualAddress) + listPeSection[i].sectionHeader.PointerToRawData);
	}
	}

	return 0;
	}

	+DWORD_PTR PeParser::convertRVAToOffsetRelative(DWORD_PTR dwRVA)
	+{
	+ for (WORD i = 0; i < getNumberOfSections(); i++)
	+ {
	+ if ((listPeSection[i].sectionHeader.VirtualAddress <= dwRVA) && ((listPeSection[i].sectionHeader.VirtualAddress + listPeSection[i].sectionHeader.Misc.VirtualSize) > dwRVA))
	+ {
	+ return (dwRVA - listPeSection[i].sectionHeader.VirtualAddress);
	+ }
	+ }
	+
	+ return 0;
	+}
	+
	DWORD_PTR PeParser::convertOffsetToRVAVector(DWORD_PTR dwOffset)
	{
	for (WORD i = 0; i < getNumberOfSections(); i++)
	{
	if ((listPeSection[i].sectionHeader.PointerToRawData <= dwOffset) && ((listPeSection[i].sectionHeader.PointerToRawData + listPeSection[i].sectionHeader.SizeOfRawData) > dwOffset))
	{
	return ((dwOffset - listPeSection[i].sectionHeader.PointerToRawData) + listPeSection[i].sectionHeader.VirtualAddress);
	}
	}

	return 0;
	}

	void PeParser::fixPeHeader()
	{
	DWORD dwSize = pDosHeader->e_lfanew + sizeof(DWORD) + sizeof(IMAGE_FILE_HEADER);

	if (isPE32())
	{
	//delete bound import directories
	pNTHeader32->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT].VirtualAddress = 0;
	pNTHeader32->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT].Size = 0;

	//max 16, zeroing possible garbage values
	for (DWORD i = pNTHeader32->OptionalHeader.NumberOfRvaAndSizes; i < IMAGE_NUMBEROF_DIRECTORY_ENTRIES; i++)
	{
	pNTHeader32->OptionalHeader.DataDirectory[i].Size = 0;
	pNTHeader32->OptionalHeader.DataDirectory[i].VirtualAddress = 0;
	}

	pNTHeader32->OptionalHeader.NumberOfRvaAndSizes = IMAGE_NUMBEROF_DIRECTORY_ENTRIES;
	pNTHeader32->FileHeader.SizeOfOptionalHeader = sizeof(IMAGE_OPTIONAL_HEADER32);

	pNTHeader32->OptionalHeader.SizeOfImage = getSectionHeaderBasedSizeOfImage();

	if (moduleBaseAddress)
	{
	pNTHeader32->OptionalHeader.ImageBase = (DWORD)moduleBaseAddress;
	}

	pNTHeader32->OptionalHeader.SizeOfHeaders = alignValue(dwSize + pNTHeader32->FileHeader.SizeOfOptionalHeader + (getNumberOfSections() * sizeof(IMAGE_SECTION_HEADER)), pNTHeader32->OptionalHeader.FileAlignment);
	}
	else
	{
	//delete bound import directories
	pNTHeader64->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT].VirtualAddress = 0;
	pNTHeader64->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT].Size = 0;

	//max 16, zeroing possible garbage values
	for (DWORD i = pNTHeader64->OptionalHeader.NumberOfRvaAndSizes; i < IMAGE_NUMBEROF_DIRECTORY_ENTRIES; i++)
	{
	pNTHeader64->OptionalHeader.DataDirectory[i].Size = 0;
	pNTHeader64->OptionalHeader.DataDirectory[i].VirtualAddress = 0;
	}

	pNTHeader64->OptionalHeader.NumberOfRvaAndSizes = IMAGE_NUMBEROF_DIRECTORY_ENTRIES;
	pNTHeader64->FileHeader.SizeOfOptionalHeader = sizeof(IMAGE_OPTIONAL_HEADER64);

	pNTHeader64->OptionalHeader.SizeOfImage = getSectionHeaderBasedSizeOfImage();

	if (moduleBaseAddress)
	{
	pNTHeader64->OptionalHeader.ImageBase = moduleBaseAddress;
	}

	pNTHeader64->OptionalHeader.SizeOfHeaders = alignValue(dwSize + pNTHeader64->FileHeader.SizeOfOptionalHeader + (getNumberOfSections() * sizeof(IMAGE_SECTION_HEADER)), pNTHeader64->OptionalHeader.FileAlignment);
	}

	removeIatDirectory();
	}

	void PeParser::removeIatDirectory()
	{
	DWORD searchAddress = 0;

	if (isPE32())
	{
	searchAddress = pNTHeader32->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IAT].VirtualAddress;

	pNTHeader32->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IAT].VirtualAddress = 0;
	pNTHeader32->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IAT].Size = 0;
	}
	else
	{
	searchAddress = pNTHeader64->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IAT].VirtualAddress;

	pNTHeader64->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IAT].VirtualAddress = 0;
	pNTHeader64->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IAT].Size = 0;
	}

	if (searchAddress)
	{
	for (WORD i = 0; i < getNumberOfSections(); i++)
	{
	if ((listPeSection[i].sectionHeader.VirtualAddress <= searchAddress) && ((listPeSection[i].sectionHeader.VirtualAddress + listPeSection[i].sectionHeader.Misc.VirtualSize) > searchAddress))
	{
	//section must be read and writable
	listPeSection[i].sectionHeader.Characteristics \|= IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE;
	}
	}
	}
	}

	void PeParser::setDefaultFileAlignment()
	{
	if (isPE32())
	{
	pNTHeader32->OptionalHeader.FileAlignment = FileAlignmentConstant;
	}
	else
	{
	pNTHeader64->OptionalHeader.FileAlignment = FileAlignmentConstant;
	}
	}

	bool PeFileSectionSortByPointerToRawData(const PeFileSection& d1, const PeFileSection& d2)
	{
	return d1.sectionHeader.PointerToRawData < d2.sectionHeader.PointerToRawData;
	}

	bool PeFileSectionSortByVirtualAddress(const PeFileSection& d1, const PeFileSection& d2)
	{
	return d1.sectionHeader.VirtualAddress < d2.sectionHeader.VirtualAddress;
	}

	void PeParser::alignAllSectionHeaders()
	{
	DWORD sectionAlignment = 0;
	DWORD fileAlignment = 0;
	DWORD newFileSize = 0;

	if (isPE32())
	{
	sectionAlignment = pNTHeader32->OptionalHeader.SectionAlignment;
	fileAlignment = pNTHeader32->OptionalHeader.FileAlignment;
	}
	else
	{
	sectionAlignment = pNTHeader64->OptionalHeader.SectionAlignment;
	fileAlignment = pNTHeader64->OptionalHeader.FileAlignment;
	}

	std::sort(listPeSection.begin(), listPeSection.end(), PeFileSectionSortByPointerToRawData); //sort by PointerToRawData ascending

	newFileSize = pDosHeader->e_lfanew + sizeof(DWORD) + sizeof(IMAGE_FILE_HEADER) + pNTHeader32->FileHeader.SizeOfOptionalHeader + (getNumberOfSections() * sizeof(IMAGE_SECTION_HEADER));


	for (WORD i = 0; i < getNumberOfSections(); i++)
	{
	listPeSection[i].sectionHeader.VirtualAddress = alignValue(listPeSection[i].sectionHeader.VirtualAddress, sectionAlignment);
	listPeSection[i].sectionHeader.Misc.VirtualSize = alignValue(listPeSection[i].sectionHeader.Misc.VirtualSize, sectionAlignment);

	listPeSection[i].sectionHeader.PointerToRawData = alignValue(newFileSize, fileAlignment);
	listPeSection[i].sectionHeader.SizeOfRawData = alignValue(listPeSection[i].dataSize, fileAlignment);

	newFileSize = listPeSection[i].sectionHeader.PointerToRawData + listPeSection[i].sectionHeader.SizeOfRawData;
	}

	std::sort(listPeSection.begin(), listPeSection.end(), PeFileSectionSortByVirtualAddress); //sort by VirtualAddress ascending
	}

	bool PeParser::dumpProcess(DWORD_PTR modBase, DWORD_PTR entryPoint, const WCHAR * dumpFilePath)
	{
	moduleBaseAddress = modBase;

	if (readPeSectionsFromProcess())
	{
	setDefaultFileAlignment();

	setEntryPointVa(entryPoint);

	alignAllSectionHeaders();
	fixPeHeader();

	getFileOverlay();

	return savePeFileToDisk(dumpFilePath);
	}

	return false;
	}

	bool PeParser::dumpProcess(DWORD_PTR modBase, DWORD_PTR entryPoint, const WCHAR * dumpFilePath, std::vector<PeSection> & sectionList)
	{
	if (listPeSection.size() == sectionList.size())
	{
	for (int i = (getNumberOfSections() - 1); i >= 0; i--)
	{
	if (!sectionList[i].isDumped)
	{
	listPeSection.erase(listPeSection.begin() + i);
	setNumberOfSections(getNumberOfSections() - 1);
	}
	else
	{
	listPeSection[i].sectionHeader.Misc.VirtualSize = sectionList[i].virtualSize;
	listPeSection[i].sectionHeader.SizeOfRawData = sectionList[i].rawSize;
	listPeSection[i].sectionHeader.Characteristics = sectionList[i].characteristics;
	}
	}
	}

	return dumpProcess(modBase, entryPoint, dumpFilePath);
	}

	void PeParser::setEntryPointVa(DWORD_PTR entryPoint)
	{
	DWORD entryPointRva = (DWORD)(entryPoint - moduleBaseAddress);

	setEntryPointRva(entryPointRva);
	}

	void PeParser::setEntryPointRva(DWORD entryPoint)
	{
	if (isPE32())
	{
	pNTHeader32->OptionalHeader.AddressOfEntryPoint = entryPoint;
	}
	else if (isPE64())
	{
	pNTHeader64->OptionalHeader.AddressOfEntryPoint = entryPoint;
	}
	}

	bool PeParser::getFileOverlay()
	{
	DWORD numberOfBytesRead;
	bool retValue = false;

	if (!hasOverlayData())
	{
	return false;
	}

	if (openFileHandle())
	{
	DWORD overlayOffset = getSectionHeaderBasedFileSize();
	DWORD fileSize = (DWORD)ProcessAccessHelp::getFileSize(hFile);
	overlaySize = fileSize - overlayOffset;

	overlayData = new BYTE[overlaySize];

	SetFilePointer(hFile, overlayOffset, 0, FILE_BEGIN);

	if (ReadFile(hFile, overlayData, overlaySize, &numberOfBytesRead, 0))
	{
	retValue = true;
	}

	closeFileHandle();
	}

	return retValue;
	}

	bool PeParser::hasOverlayData()
	{
	if (!filename)
	return false;

	if (isValidPeFile())
	{
	DWORD fileSize = (DWORD)ProcessAccessHelp::getFileSize(filename);

	return (fileSize > getSectionHeaderBasedFileSize());
	}
	else
	{
	return false;
	}
	}

	bool PeParser::updatePeHeaderChecksum(const WCHAR * targetFile, DWORD fileSize)
	{
	PIMAGE_NT_HEADERS32 pNTHeader32 = 0;
	PIMAGE_NT_HEADERS64 pNTHeader64 = 0;
	DWORD headerSum = 0;
	DWORD checkSum = 0;
	bool retValue = false;

	if (!fileSize)
	return retValue;

	HANDLE hFileToMap = CreateFile(targetFile, GENERIC_READ\|GENERIC_WRITE, FILE_SHARE_READ\|FILE_SHARE_WRITE, 0, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0);

	if(hFileToMap != INVALID_HANDLE_VALUE)
	{
	HANDLE hMappedFile = CreateFileMapping(hFileToMap, 0, PAGE_READWRITE, 0, 0, 0);
	if(hMappedFile)
	{
	if (GetLastError() != ERROR_ALREADY_EXISTS)
	{
	LPVOID addrMappedDll = MapViewOfFile(hMappedFile, FILE_MAP_ALL_ACCESS, 0, 0, 0);

	if (addrMappedDll)
	{
	pNTHeader32 = (PIMAGE_NT_HEADERS32)CheckSumMappedFile(addrMappedDll, fileSize, &headerSum, &checkSum);

	if (pNTHeader32)
	{
	if (pNTHeader32->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR64_MAGIC)
	{
	pNTHeader64 = (PIMAGE_NT_HEADERS64)pNTHeader32;
	pNTHeader64->OptionalHeader.CheckSum = checkSum;
	}
	else
	{
	pNTHeader32->OptionalHeader.CheckSum = checkSum;
	}

	retValue = true;
	}

	UnmapViewOfFile(addrMappedDll);
	}
	}
	CloseHandle(hMappedFile);
	}
	CloseHandle(hFileToMap);
	}

	return retValue;
	}
	+
	+BYTE * PeParser::getSectionMemoryByIndex(int index)
	+{
	+ return listPeSection[index].data;
	+}
	+
	+DWORD PeParser::getSectionMemorySizeByIndex(int index)
	+{
	+ return listPeSection[index].dataSize;
	+}
	\ No newline at end of file
	diff --git a/Scylla/PeParser.h b/Scylla/PeParser.h
	index b3dc055..b20482d 100644
	--- a/Scylla/PeParser.h
	+++ b/Scylla/PeParser.h
	@@ -1,136 +1,141 @@
	#pragma once

	#include <windows.h>
	#include <vector>
	#include "DumpSectionGui.h"

	class PeFileSection {
	public:
	IMAGE_SECTION_HEADER sectionHeader;
	BYTE * data;
	DWORD dataSize;
	DWORD normalSize;

	PeFileSection()
	{
	ZeroMemory(&sectionHeader, sizeof(IMAGE_SECTION_HEADER));
	data = 0;
	dataSize = 0;
	normalSize = 0;
	}
	};

	class PeParser
	{
	public:
	PeParser(const WCHAR * file, bool readSectionHeaders = true);
	PeParser(const DWORD_PTR moduleBase, bool readSectionHeaders = true);

	~PeParser();

	bool isValidPeFile();
	bool isPE64();
	bool isPE32();

	bool isTargetFileSamePeFormat();

	WORD getNumberOfSections();
	std::vector<PeFileSection> & getSectionHeaderList();

	bool hasExportDirectory();
	bool hasTLSDirectory();
	bool hasRelocationDirectory();
	bool hasOverlayData();

	DWORD getEntryPoint();

	bool getSectionNameUnicode(const int sectionIndex, WCHAR * output, const int outputLen);

	DWORD getSectionHeaderBasedFileSize();
	DWORD getSectionHeaderBasedSizeOfImage();

	bool readPeSectionsFromProcess();
	bool readPeSectionsFromFile();
	bool savePeFileToDisk(const WCHAR * newFile);
	void removeDosStub();
	void alignAllSectionHeaders();
	void fixPeHeader();
	void setDefaultFileAlignment();
	bool dumpProcess(DWORD_PTR modBase, DWORD_PTR entryPoint, const WCHAR * dumpFilePath);
	bool dumpProcess(DWORD_PTR modBase, DWORD_PTR entryPoint, const WCHAR * dumpFilePath, std::vector<PeSection> & sectionList);

	void setEntryPointVa(DWORD_PTR entryPoint);
	void setEntryPointRva(DWORD entryPoint);

	static bool updatePeHeaderChecksum(const WCHAR * targetFile, DWORD fileSize);
	+ BYTE * getSectionMemoryByIndex(int index);
	+ DWORD getSectionMemorySizeByIndex(int index);
	+ int convertRVAToOffsetVectorIndex(DWORD_PTR dwRVA);
	+ DWORD_PTR convertOffsetToRVAVector(DWORD_PTR dwOffset);
	+ DWORD_PTR convertRVAToOffsetVector(DWORD_PTR dwRVA);
	+ DWORD_PTR convertRVAToOffsetRelative(DWORD_PTR dwRVA);
	protected:
	PeParser();


	static const DWORD FileAlignmentConstant = 0x200;

	const WCHAR * filename;
	DWORD_PTR moduleBaseAddress;

	/************************************************************************/
	/* PE FILE */
	/* */
	/* IMAGE_DOS_HEADER 64 0x40 */
	/* IMAGE_NT_HEADERS32 248 0xF8 */
	/* IMAGE_NT_HEADERS64 264 0x108 */
	/* IMAGE_SECTION_HEADER 40 0x28 */
	/************************************************************************/

	PIMAGE_DOS_HEADER pDosHeader;
	BYTE * pDosStub; //between dos header and section header
	DWORD dosStubSize;
	PIMAGE_NT_HEADERS32 pNTHeader32;
	PIMAGE_NT_HEADERS64 pNTHeader64;
	std::vector<PeFileSection> listPeSection;
	BYTE * overlayData;
	DWORD overlaySize;
	/************************************************************************/

	BYTE * fileMemory;
	BYTE * headerMemory;

	HANDLE hFile;
	DWORD fileSize;

	bool readPeHeaderFromFile(bool readSectionHeaders);
	bool readPeHeaderFromProcess(bool readSectionHeaders);

	bool hasDirectory(const int directoryIndex);
	bool getSectionHeaders();
	void getDosAndNtHeader(BYTE * memory, LONG size);
	DWORD calcCorrectPeHeaderSize( bool readSectionHeaders );
	DWORD getInitialHeaderReadSize( bool readSectionHeaders );
	bool openFileHandle();
	void closeFileHandle();
	void initClass();

	DWORD isMemoryNotNull( BYTE * data, int dataSize );
	bool openWriteFileHandle( const WCHAR * newFile );
	bool writeZeroMemoryToFile(HANDLE hFile, DWORD fileOffset, DWORD size);

	bool readPeSectionFromFile( DWORD readOffset, PeFileSection & peFileSection );
	bool readPeSectionFromProcess( DWORD_PTR readOffset, PeFileSection & peFileSection );

	bool readSectionFromProcess(const DWORD_PTR readOffset, PeFileSection & peFileSection );
	bool readSectionFromFile(const DWORD readOffset, PeFileSection & peFileSection );
	bool readSectionFrom(const DWORD_PTR readOffset, PeFileSection & peFileSection, const bool isProcess);


	-
	+ DWORD_PTR getStandardImagebase();

	bool addNewLastSection(const CHAR * sectionName, DWORD sectionSize, BYTE * sectionData);
	DWORD alignValue(DWORD badValue, DWORD alignTo);
	- int convertRVAToOffsetVectorIndex(DWORD_PTR dwRVA);
	- DWORD_PTR convertOffsetToRVAVector(DWORD_PTR dwOffset);
	- DWORD_PTR convertRVAToOffsetVector(DWORD_PTR dwRVA);
	+
	void setNumberOfSections(WORD numberOfSections);

	void removeIatDirectory();
	bool getFileOverlay();
	+
	};

	diff --git a/Scylla/resource.h b/Scylla/resource.h
	index 0cc56ea..d3d47f4 100644
	Binary files a/Scylla/resource.h and b/Scylla/resource.h differ

File Metadata

Mime Type: text/x-diff
Expires: Fri, Sep 5, 3:49 PM (9 h, 37 m)
Storage Engine: local-disk
Storage Format: Raw Data
Storage Handle: 4a/9f/f31ef2de1a09fcfe1cb27e4b590a

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions