No OneTemporary
Actions

Size

151 KB

Subscribers

None

View Options

	diff --git a/Scylla/ApiReader.cpp b/Scylla/ApiReader.cpp
	index 836c9ac..036a7bb 100644
	--- a/Scylla/ApiReader.cpp
	+++ b/Scylla/ApiReader.cpp
	@@ -1,1325 +1,1184 @@

	#include "ApiReader.h"

	#include "Scylla.h"
	#include "Architecture.h"
	#include "SystemInformation.h"
	#include "StringConversion.h"

	-stdext::hash_map<DWORD_PTR, ApiInfo *> ApiReader::apiList; //api look up table
	+stdext::hash_multimap<DWORD_PTR, ApiInfo *> ApiReader::apiList; //api look up table
	std::map<DWORD_PTR, ImportModuleThunk> * ApiReader::moduleThunkList; //store found apis

	DWORD_PTR ApiReader::minApiAddress = 0xFFFFFFFF;
	DWORD_PTR ApiReader::maxApiAddress = 0;

	//#define DEBUG_COMMENTS

	void ApiReader::readApisFromModuleList()
	{
	for (unsigned int i = 0; i < moduleList.size();i++)
	{
	setModulePriority(&moduleList[i]);

	if (moduleList[i].modBaseAddr + moduleList[i].modBaseSize > maxValidAddress)
	{
	maxValidAddress = moduleList[i].modBaseAddr + moduleList[i].modBaseSize;
	}

	Scylla::windowLog.log(L"Module parsing: %s",moduleList[i].fullPath);

	if (!moduleList[i].isAlreadyParsed)
	{
	parseModule(&moduleList[i]);
	}
	}

	#ifdef DEBUG_COMMENTS
	Scylla::debugLog.log(L"Address Min " PRINTF_DWORD_PTR_FULL L" Max " PRINTF_DWORD_PTR_FULL L"\nimagebase " PRINTF_DWORD_PTR_FULL L" maxValidAddress " PRINTF_DWORD_PTR_FULL, minApiAddress, maxApiAddress, targetImageBase ,maxValidAddress);
	#endif
	}

	void ApiReader::parseModule(ModuleInfo *module)
	{
	module->parsing = true;

	if (isWinSxSModule(module))
	{
	parseModuleWithMapping(module);
	}
	else if (isModuleLoadedInOwnProcess(module))
	{
	parseModuleWithOwnProcess(module);
	}
	else
	{
	parseModuleWithProcess(module);
	}

	module->isAlreadyParsed = true;
	}

	void ApiReader::parseModuleWithMapping(ModuleInfo *moduleInfo)
	{
	LPVOID fileMapping = 0;
	PIMAGE_NT_HEADERS pNtHeader = 0;
	PIMAGE_DOS_HEADER pDosHeader = 0;

	fileMapping = createFileMappingViewRead(moduleInfo->fullPath);

	if (fileMapping == 0)
	return;

	pDosHeader = (PIMAGE_DOS_HEADER)fileMapping;
	pNtHeader = (PIMAGE_NT_HEADERS)((DWORD_PTR)fileMapping + (DWORD_PTR)(pDosHeader->e_lfanew));

	if (isPeAndExportTableValid(pNtHeader))
	{
	parseExportTable(moduleInfo, pNtHeader, (PIMAGE_EXPORT_DIRECTORY)((DWORD_PTR)fileMapping + pNtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress), (DWORD_PTR)fileMapping);
	}


	UnmapViewOfFile(fileMapping);

	}

	inline bool ApiReader::isApiForwarded(DWORD_PTR rva, PIMAGE_NT_HEADERS pNtHeader)
	{
	if ((rva > pNtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress) && (rva < (pNtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress + pNtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].Size)))
	{
	return true;
	}
	else
	{
	return false;
	}
	}

	void ApiReader::handleForwardedApi(DWORD_PTR vaStringPointer,char * functionNameParent, DWORD_PTR rvaParent, WORD ordinalParent, ModuleInfo *moduleParent)
	{
	size_t dllNameLength = 0;
	WORD ordinal = 0;
	ModuleInfo *module = 0;
	DWORD_PTR vaApi = 0;
	DWORD_PTR rvaApi = 0;
	char dllName[100] = {0};
	WCHAR dllNameW[100] = {0};
	char fordwardedString = (char )vaStringPointer;
	char *searchFunctionName = strchr(fordwardedString, '.');


	if (!searchFunctionName)
	return;

	dllNameLength = searchFunctionName - fordwardedString;

	if (dllNameLength >= 99)
	{
	return;
	}
	else
	{
	strncpy_s(dllName, fordwardedString, dllNameLength);
	}

	searchFunctionName++;

	//Windows 7
	if (!strncmp(dllName,"api-ms-win-", 11))
	{
	/*
	Info: http://www.nirsoft.net/articles/windows_7_kernel_architecture_changes.html
	*/

	FARPROC addy = GetProcAddress(GetModuleHandleA(dllName), searchFunctionName);

	if (addy != 0)
	{
	addApi(functionNameParent,0, ordinalParent, (DWORD_PTR)addy, (DWORD_PTR)addy - (DWORD_PTR)GetModuleHandleA(dllName), true, moduleParent);
	}

	return;
	}

	strcat_s(dllName, ".dll");

	StringConversion::ToUTF16(dllName, dllNameW, _countof(dllNameW));

	if (!_wcsicmp(dllNameW, moduleParent->getFilename()))
	{
	module = moduleParent;
	}
	else
	{
	module = findModuleByName(dllNameW);
	}

	if (module != 0) // module == 0 -> can be ignored
	{
	/*if ((module->isAlreadyParsed == false) && (module != moduleParent))
	{
	//do API extract

	if (module->parsing == true)
	{
	//some stupid circle dependency
	printf("stupid circle dependency %s\n",module->getFilename());
	}
	else
	{
	parseModule(module);
	}
	}*/

	if (strchr(searchFunctionName,'#'))
	{
	//forwarding by ordinal
	searchFunctionName++;
	ordinal = (WORD)atoi(searchFunctionName);
	findApiByModuleAndOrdinal(module, ordinal, &vaApi, &rvaApi);
	}
	else
	{
	findApiByModuleAndName(module, searchFunctionName, &vaApi, &rvaApi);
	}

	if (rvaApi == 0)
	{
	#ifdef DEBUG_COMMENTS
	Scylla::debugLog.log(L"handleForwardedApi :: Api not found, this is really BAD! %S",fordwardedString);
	#endif
	}
	else
	{
	addApi(functionNameParent,0, ordinalParent, vaApi, rvaApi, true, moduleParent);
	}
	}

	}

	ModuleInfo * ApiReader::findModuleByName(WCHAR *name)
	{
	for (unsigned int i = 0; i < moduleList.size(); i++) {
	if (!_wcsicmp(moduleList[i].getFilename(), name))
	{
	return &moduleList[i];
	}
	}

	return 0;
	}

	void ApiReader::addApiWithoutName(WORD ordinal, DWORD_PTR va, DWORD_PTR rva,bool isForwarded, ModuleInfo *moduleInfo)
	{
	addApi(0, 0, ordinal, va, rva, isForwarded, moduleInfo);
	}

	void ApiReader::addApi(char functionName, WORD hint, WORD ordinal, DWORD_PTR va, DWORD_PTR rva, bool isForwarded, ModuleInfo moduleInfo)
	{
	ApiInfo *apiInfo = new ApiInfo();

	if ((functionName != 0) && (strlen(functionName) < _countof(apiInfo->name)))
	{
	strcpy_s(apiInfo->name, functionName);
	}
	else
	{
	apiInfo->name[0] = 0x00;
	}

	apiInfo->ordinal = ordinal;
	apiInfo->isForwarded = isForwarded;
	apiInfo->module = moduleInfo;
	apiInfo->rva = rva;
	apiInfo->va = va;
	apiInfo->hint = hint;

	setMinMaxApiAddress(va);

	moduleInfo->apiList.push_back(apiInfo);

	apiList.insert(API_Pair(va, apiInfo));
	}

	BYTE * ApiReader::getHeaderFromProcess(ModuleInfo * module)
	{
	BYTE *bufferHeader = 0;
	DWORD readSize = 0;

	if (module->modBaseSize < PE_HEADER_BYTES_COUNT)
	{
	readSize = module->modBaseSize;
	}
	else
	{
	readSize = PE_HEADER_BYTES_COUNT;
	}

	bufferHeader = new BYTE[readSize];

	if(!readMemoryFromProcess(module->modBaseAddr, readSize, bufferHeader))
	{
	#ifdef DEBUG_COMMENTS
	Scylla::debugLog.log(L"getHeaderFromProcess :: Error reading header");
	#endif
	delete[] bufferHeader;
	return 0;
	}
	else
	{
	return bufferHeader;
	}
	}

	BYTE * ApiReader::getExportTableFromProcess(ModuleInfo * module, PIMAGE_NT_HEADERS pNtHeader)
	{
	DWORD readSize = 0;
	BYTE *bufferExportTable = 0;

	readSize = pNtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].Size;

	if (readSize < (sizeof(IMAGE_EXPORT_DIRECTORY) + 8))
	{
	//Something is wrong with the PE Header
	#ifdef DEBUG_COMMENTS
	Scylla::debugLog.log(L"Something is wrong with the PE Header here Export table size %d", readSize);
	#endif
	readSize = sizeof(IMAGE_EXPORT_DIRECTORY) + 100;
	}

	if (readSize)
	{
	bufferExportTable = new BYTE[readSize];

	if(!readMemoryFromProcess(module->modBaseAddr + pNtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress, readSize, bufferExportTable))
	{
	#ifdef DEBUG_COMMENTS
	Scylla::debugLog.log(L"getExportTableFromProcess :: Error reading export table from process");
	#endif
	delete[] bufferExportTable;
	return 0;
	}
	else
	{
	return bufferExportTable;
	}
	}
	else
	{
	return 0;
	}
	}

	void ApiReader::parseModuleWithProcess(ModuleInfo * module)
	{
	PIMAGE_NT_HEADERS pNtHeader = 0;
	PIMAGE_DOS_HEADER pDosHeader = 0;
	BYTE *bufferHeader = 0;
	BYTE *bufferExportTable = 0;


	bufferHeader = getHeaderFromProcess(module);

	if (bufferHeader == 0)
	return;

	pDosHeader = (PIMAGE_DOS_HEADER)bufferHeader;
	pNtHeader = (PIMAGE_NT_HEADERS)((DWORD_PTR)bufferHeader + (DWORD_PTR)(pDosHeader->e_lfanew));

	if (isPeAndExportTableValid(pNtHeader))
	{
	bufferExportTable = getExportTableFromProcess(module, pNtHeader);

	if(bufferExportTable)
	{
	parseExportTable(module,pNtHeader,(PIMAGE_EXPORT_DIRECTORY)bufferExportTable, (DWORD_PTR)bufferExportTable - pNtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress);
	delete[] bufferExportTable;
	}
	}

	delete[] bufferHeader;
	}

	void ApiReader::parseExportTable(ModuleInfo *module, PIMAGE_NT_HEADERS pNtHeader, PIMAGE_EXPORT_DIRECTORY pExportDir, DWORD_PTR deltaAddress)
	{
	DWORD addressOfFunctionsArray = 0,addressOfNamesArray = 0;
	WORD *addressOfNameOrdinalsArray = 0;
	char *functionName = 0;
	DWORD_PTR RVA = 0, VA = 0;
	WORD ordinal = 0;
	WORD i = 0, j = 0;
	bool withoutName;


	addressOfFunctionsArray = (DWORD *)((DWORD_PTR)pExportDir->AddressOfFunctions + deltaAddress);
	addressOfNamesArray = (DWORD *)((DWORD_PTR)pExportDir->AddressOfNames + deltaAddress);
	addressOfNameOrdinalsArray = (WORD *)((DWORD_PTR)pExportDir->AddressOfNameOrdinals + deltaAddress);

	#ifdef DEBUG_COMMENTS
	Scylla::debugLog.log(L"parseExportTable :: module %s NumberOfNames %X", module->fullPath, pExportDir->NumberOfNames);
	#endif

	for (i = 0; i < pExportDir->NumberOfNames; i++)
	{
	functionName = (char*)(addressOfNamesArray[i] + deltaAddress);
	ordinal = (WORD)(addressOfNameOrdinalsArray[i] + pExportDir->Base);
	RVA = addressOfFunctionsArray[addressOfNameOrdinalsArray[i]];
	VA = addressOfFunctionsArray[addressOfNameOrdinalsArray[i]] + module->modBaseAddr;

	#ifdef DEBUG_COMMENTS
	Scylla::debugLog.log(L"parseExportTable :: api %S ordinal %d imagebase " PRINTF_DWORD_PTR_FULL L" RVA " PRINTF_DWORD_PTR_FULL L" VA " PRINTF_DWORD_PTR_FULL, functionName, ordinal, module->modBaseAddr, RVA, VA);
	#endif
	if (!isApiBlacklisted(functionName))
	{
	if (!isApiForwarded(RVA,pNtHeader))
	{
	addApi(functionName, i, ordinal,VA,RVA,false,module);
	}
	else
	{
	//printf("Forwarded: %s\n",functionName);
	handleForwardedApi(RVA + deltaAddress,functionName,RVA,ordinal,module);
	}
	}

	}

	/Exports without name/
	if (pExportDir->NumberOfNames != pExportDir->NumberOfFunctions)
	{
	for (i = 0; i < pExportDir->NumberOfFunctions; i++)
	{
	withoutName = true;
	for (j = 0; j < pExportDir->NumberOfNames; j++)
	{
	if(addressOfNameOrdinalsArray[j] == i)
	{
	withoutName = false;
	break;
	}
	}
	if (withoutName && addressOfFunctionsArray[i] != 0)
	{
	ordinal = (WORD)(i+pExportDir->Base);
	RVA = addressOfFunctionsArray[i];
	VA = (addressOfFunctionsArray[i] + module->modBaseAddr);


	if (!isApiForwarded(RVA,pNtHeader))
	{
	addApiWithoutName(ordinal,VA,RVA,false,module);
	}
	else
	{
	handleForwardedApi(RVA + deltaAddress,0,RVA,ordinal,module);
	}

	}
	}
	}
	}

	void ApiReader::findApiByModuleAndOrdinal(ModuleInfo * module, WORD ordinal, DWORD_PTR * vaApi, DWORD_PTR * rvaApi)
	{
	findApiByModule(module,0,ordinal,vaApi,rvaApi);
	}

	void ApiReader::findApiByModuleAndName(ModuleInfo * module, char * searchFunctionName, DWORD_PTR * vaApi, DWORD_PTR * rvaApi)
	{
	findApiByModule(module,searchFunctionName,0,vaApi,rvaApi);
	}

	void ApiReader::findApiByModule(ModuleInfo * module, char * searchFunctionName, WORD ordinal, DWORD_PTR * vaApi, DWORD_PTR * rvaApi)
	{
	if (isModuleLoadedInOwnProcess(module))
	{
	HMODULE hModule = GetModuleHandle(module->getFilename());

	if (hModule)
	{
	if (ordinal)
	{
	*vaApi = (DWORD_PTR)GetProcAddress(hModule, (LPCSTR)ordinal);
	}
	else
	{
	*vaApi = (DWORD_PTR)GetProcAddress(hModule, searchFunctionName);
	}


	if (vaApi)
	{
	rvaApi = (vaApi) - (DWORD_PTR)hModule;
	vaApi = (rvaApi) + module->modBaseAddr;
	}
	else
	{
	#ifdef DEBUG_COMMENTS
	Scylla::debugLog.log(L"findApiByModule :: vaApi == NULL, should never happen %S", searchFunctionName);
	#endif
	}
	}
	else
	{
	#ifdef DEBUG_COMMENTS
	Scylla::debugLog.log(L"findApiByModule :: hModule == NULL, should never happen %s", module->getFilename());
	#endif
	}
	}
	else
	{
	//search api in extern process
	findApiInProcess(module,searchFunctionName,ordinal,vaApi,rvaApi);
	}
	}

	bool ApiReader::isModuleLoadedInOwnProcess(ModuleInfo * module)
	{
	for (unsigned int i = 0; i < ownModuleList.size(); i++)
	{
	if (!_wcsicmp(module->fullPath, ownModuleList[i].fullPath))
	{
	//printf("isModuleLoadedInOwnProcess :: %s %s\n",module->fullPath,ownModuleList[i].fullPath);
	return true;
	}
	}
	return false;
	}

	void ApiReader::parseModuleWithOwnProcess( ModuleInfo * module )
	{
	PIMAGE_NT_HEADERS pNtHeader = 0;
	PIMAGE_DOS_HEADER pDosHeader = 0;
	HMODULE hModule = GetModuleHandle(module->getFilename());

	if (hModule)
	{
	pDosHeader = (PIMAGE_DOS_HEADER)hModule;
	pNtHeader = (PIMAGE_NT_HEADERS)((DWORD_PTR)hModule + (DWORD_PTR)(pDosHeader->e_lfanew));

	if (isPeAndExportTableValid(pNtHeader))
	{
	parseExportTable(module, pNtHeader, (PIMAGE_EXPORT_DIRECTORY)((DWORD_PTR)hModule + pNtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress), (DWORD_PTR)hModule);
	}
	}
	else
	{
	#ifdef DEBUG_COMMENTS
	Scylla::debugLog.log(L"parseModuleWithOwnProcess :: hModule is NULL");
	#endif
	}
	}

	bool ApiReader::isPeAndExportTableValid(PIMAGE_NT_HEADERS pNtHeader)
	{
	if (pNtHeader->Signature != IMAGE_NT_SIGNATURE)
	{
	Scylla::windowLog.log(L"-> IMAGE_NT_SIGNATURE doesn't match.");
	return false;
	}
	else if ((pNtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress == 0) \|\| (pNtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].Size == 0))
	{
	Scylla::windowLog.log(L"-> No export table.");
	return false;
	}
	else
	{
	return true;
	}
	}

	void ApiReader::findApiInProcess(ModuleInfo * module, char * searchFunctionName, WORD ordinal, DWORD_PTR * vaApi, DWORD_PTR * rvaApi)
	{
	PIMAGE_NT_HEADERS pNtHeader = 0;
	PIMAGE_DOS_HEADER pDosHeader = 0;
	BYTE *bufferHeader = 0;
	BYTE *bufferExportTable = 0;


	bufferHeader = getHeaderFromProcess(module);

	if (bufferHeader == 0)
	return;

	pDosHeader = (PIMAGE_DOS_HEADER)bufferHeader;
	pNtHeader = (PIMAGE_NT_HEADERS)((DWORD_PTR)bufferHeader + (DWORD_PTR)(pDosHeader->e_lfanew));

	if (isPeAndExportTableValid(pNtHeader))
	{
	bufferExportTable = getExportTableFromProcess(module, pNtHeader);

	if(bufferExportTable)
	{
	findApiInExportTable(module,(PIMAGE_EXPORT_DIRECTORY)bufferExportTable, (DWORD_PTR)bufferExportTable - pNtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress,searchFunctionName,ordinal,vaApi,rvaApi);
	delete[] bufferExportTable;
	}
	}

	delete[] bufferHeader;
	}

	bool ApiReader::findApiInExportTable(ModuleInfo module, PIMAGE_EXPORT_DIRECTORY pExportDir, DWORD_PTR deltaAddress, char searchFunctionName, WORD ordinal, DWORD_PTR * vaApi, DWORD_PTR * rvaApi)
	{
	DWORD addressOfFunctionsArray = 0,addressOfNamesArray = 0;
	WORD *addressOfNameOrdinalsArray = 0;
	char *functionName = 0;
	DWORD i = 0, j = 0;

	addressOfFunctionsArray = (DWORD *)((DWORD_PTR)pExportDir->AddressOfFunctions + deltaAddress);
	addressOfNamesArray = (DWORD *)((DWORD_PTR)pExportDir->AddressOfNames + deltaAddress);
	addressOfNameOrdinalsArray = (WORD *)((DWORD_PTR)pExportDir->AddressOfNameOrdinals + deltaAddress);

	if (searchFunctionName)
	{
	for (i = 0; i < pExportDir->NumberOfNames; i++)
	{
	functionName = (char*)(addressOfNamesArray[i] + deltaAddress);

	if (!strcmp(functionName,searchFunctionName))
	{
	*rvaApi = addressOfFunctionsArray[addressOfNameOrdinalsArray[i]];
	*vaApi = addressOfFunctionsArray[addressOfNameOrdinalsArray[i]] + module->modBaseAddr;
	return true;
	}
	}
	}
	else
	{
	for (i = 0; i < pExportDir->NumberOfFunctions; i++)
	{
	if (ordinal == (i+pExportDir->Base))
	{
	*rvaApi = addressOfFunctionsArray[i];
	*vaApi = (addressOfFunctionsArray[i] + module->modBaseAddr);
	return true;
	}
	}
	}

	return false;
	}


	void ApiReader::setModulePriority(ModuleInfo * module)
	{
	const WCHAR *moduleFileName = module->getFilename();

	//imports by kernelbase don't exist
	if (!_wcsicmp(moduleFileName, L"kernelbase.dll"))
	{
	module->priority = -1;
	}
	else if (!_wcsicmp(moduleFileName, L"ntdll.dll"))
	{
	module->priority = 0;
	}
	else if (!_wcsicmp(moduleFileName, L"shlwapi.dll"))
	{
	module->priority = 0;
	}
	else if (!_wcsicmp(moduleFileName, L"ShimEng.dll"))
	{
	module->priority = 0;
	}
	else if (!_wcsicmp(moduleFileName, L"kernel32.dll"))
	{
	module->priority = 2;
	}
	else
	{
	module->priority = 1;
	}
	}

	bool ApiReader::isApiAddressValid(DWORD_PTR virtualAddress)
	{
	return apiList.count(virtualAddress) > 0;
	}

	ApiInfo * ApiReader::getApiByVirtualAddress(DWORD_PTR virtualAddress, bool * isSuspect)
	{
	- stdext::hash_map<DWORD_PTR, ApiInfo *>::iterator it1, it2;
	+ stdext::hash_multimap<DWORD_PTR, ApiInfo *>::iterator it1, it2;
	size_t c = 0;
	size_t countDuplicates = apiList.count(virtualAddress);
	int countHighPriority = 0;
	ApiInfo *apiFound = 0;


	if (countDuplicates == 0)
	{
	Scylla::windowLog.log(L"getApiByVirtualAddress :: No Api found " PRINTF_DWORD_PTR_FULL, virtualAddress);
	return 0;
	}
	else if (countDuplicates == 1)
	{
	//API is 100% correct
	*isSuspect = false;
	it1 = apiList.find(virtualAddress); // Find first match.
	return (ApiInfo )((it1).second);
	}
	else
	{
	it1 = apiList.find(virtualAddress); // Find first match.

	//any high priority with a name
	apiFound = getScoredApi(it1,countDuplicates,true,false,false,true,false,false,false,false);

	if (apiFound)
	return apiFound;

	*isSuspect = true;

	//high priority with a name and ansi/unicode name
	apiFound = getScoredApi(it1,countDuplicates,true,true,false,true,false,false,false,false);

	if (apiFound)
	return apiFound;

	//priority 2 with no underline in name
	apiFound = getScoredApi(it1,countDuplicates,true,false,true,false,false,false,true,false);

	if (apiFound)
	return apiFound;

	//priority 1 with a name
	apiFound = getScoredApi(it1,countDuplicates,true,false,false,false,false,true,false,false);

	if (apiFound)
	return apiFound;

	//With a name
	apiFound = getScoredApi(it1,countDuplicates,true,false,false,false,false,false,false,false);

	if (apiFound)
	return apiFound;

	//any with priority, name, ansi/unicode
	apiFound = getScoredApi(it1,countDuplicates,true,true,false,true,false,false,false,true);

	if (apiFound)
	return apiFound;

	//any with priority
	apiFound = getScoredApi(it1,countDuplicates,false,false,false,true,false,false,false,true);

	if (apiFound)
	return apiFound;

	//has prio 0 and name
	apiFound = getScoredApi(it1,countDuplicates,false,false,false,false,true,false,false,true);

	if (apiFound)
	return apiFound;
	}

	//is never reached
	Scylla::windowLog.log(L"getApiByVirtualAddress :: There is a api resolving bug, VA: " PRINTF_DWORD_PTR_FULL, virtualAddress);
	for (size_t c = 0; c < countDuplicates; c++, it1++)
	{
	apiFound = (ApiInfo )((it1).second);
	Scylla::windowLog.log(L"-> Possible API: %S ord: %d ", apiFound->name, apiFound->ordinal);
	}
	return (ApiInfo *) 1;
	}

	-/ApiInfo ApiReader::getApiByVirtualAddress(DWORD_PTR virtualAddress, bool * isSuspect)
	-{
	- std::unordered_map<DWORD_PTR, ApiInfo *>::iterator it1, it2;
	- size_t c = 0;
	- size_t countDuplicates = apiList.count(virtualAddress);
	- int countHighPriority = 0;
	- ApiInfo *apiFound = 0;
	-
	-
	- if (countDuplicates == 0)
	- {
	- Scylla::windowLog.log(L"getApiByVirtualAddress :: No Api found " PRINTF_DWORD_PTR_FULL, virtualAddress);
	- return 0;
	- }
	- else if (countDuplicates == 1)
	- {
	- //API is 100% correct
	- *isSuspect = false;
	- it1 = apiList.find(virtualAddress); // Find first match.
	- return (ApiInfo )((it1).second);
	- }
	- else
	- {
	- it1 = apiList.find(virtualAddress); // Find first match.
	- it2 = it1;
	- for (c = 0; c < countDuplicates; c++, it1++)
	- {
	- apiFound = (ApiInfo )((it1).second);
	-
	- if (apiFound->module->priority >= 1) //1 == high priority
	- {
	- countHighPriority++;
	- }
	- }
	-
	- it1 = it2;
	-
	-
	- This is flawed:
	- It chooses api(prio:1, name:no) over api(prio:0, name:yes)
	- (e.g. SHLWAPI.PathCombineW vs SHELL32.#25)
	-
	- Maybe there should be a check higher up in the code, to see if this API is surrounded
	- by APIs of a DLL and pick the duplicate from that DLL
	-
	-
	- if (countHighPriority == 0)
	- {
	-#ifdef DEBUG_COMMENTS
	- Scylla::debugLog.log(L"getApiByVirtualAddress :: countHighPriority == 0 " PRINTF_DWORD_PTR_FULL, virtualAddress);
	-#endif
	- *isSuspect = true;
	- return (ApiInfo )((it1).second);
	- }
	- else if (countHighPriority == 1) // what about kernel32, it has priority 2
	- {
	- //API is 100% correct if countHighPriority == 1 and name export
	-
	- *isSuspect = false;
	- for (c = 0; c < countDuplicates; c++, it1++)
	- {
	- apiFound = (ApiInfo )((it1).second);
	-
	- if (apiFound->module->priority >= 1 && apiFound->name[0] != 0x00) //1 == high priority
	- {
	- return apiFound;
	- }
	- }
	- }
	- //else // fall through for case api1(priority:1, name:false) <> api2(priority:0, name:true)
	- {
	- //API not 100% correct
	-#ifdef DEBUG_COMMENTS
	- Scylla::debugLog.log(L"getApiByVirtualAddress :: countHighPriority == %d " PRINTF_DWORD_PTR_FULL, countHighPriority, virtualAddress);
	-#endif
	- *isSuspect = true;
	- for (c = 0; c < countDuplicates; c++, it1++)
	- {
	- apiFound = (ApiInfo )((it1).second);
	- Scylla::windowLog.log(L"%s - %s %X %X\n",apiFound->name, apiFound->module->getFilename(), apiFound->rva, apiFound->ordinal);
	- }
	- it1 = it2;
	-
	- for (c = 0; c < countDuplicates; c++, it1++)
	- {
	- apiFound = (ApiInfo )((it1).second);
	-
	- //prefer APIs with a name
	- if (apiFound->module->priority >= 1 && apiFound->name[0] != 0x00) //1 == high priority
	- {
	- //prefer ANSI/UNICODE APIs
	- if (strrchr(apiFound->name, 'W') \|\| strrchr(apiFound->name, 'A'))
	- {
	- return apiFound;
	- }
	- }
	- }
	-
	- it1 = it2;
	-
	- for (c = 0; c < countDuplicates; c++, it1++)
	- {
	- apiFound = (ApiInfo )((it1).second);
	-
	- //prefer APIs with a name
	- if (apiFound->module->priority == 2 && !strrchr(apiFound->name, '_')) //1 == high priority
	- {
	- return apiFound;
	- }
	- }
	-
	- it1 = it2;
	-
	- for (c = 0; c < countDuplicates; c++, it1++)
	- {
	- apiFound = (ApiInfo )((it1).second);
	- if (apiFound->module->priority == 1 && apiFound->name[0] != 0x00) //1 == high priority
	- {
	- return apiFound;
	- }
	- }
	-
	- it1 = it2;
	-
	- for (c = 0; c < countDuplicates; c++, it1++)
	- {
	- apiFound = (ApiInfo )((it1).second);
	-
	- if (apiFound->module->priority == 1) //1 == high priority
	- {
	- return apiFound;
	- }
	- }
	- }
	- }
	-
	- //is never reached
	- Scylla::windowLog.log(L"getApiByVirtualAddress :: There is a big bug");
	- return (ApiInfo *) 1;
	-}*/
	-
	-ApiInfo * ApiReader::getScoredApi(stdext::hash_map<DWORD_PTR, ApiInfo *>::iterator it1,size_t countDuplicates, bool hasName, bool hasUnicodeAnsiName, bool hasNoUnderlineInName, bool hasPrioDll,bool hasPrio0Dll,bool hasPrio1Dll, bool hasPrio2Dll, bool firstWin )
	+ApiInfo * ApiReader::getScoredApi(stdext::hash_multimap<DWORD_PTR, ApiInfo *>::iterator it1,size_t countDuplicates, bool hasName, bool hasUnicodeAnsiName, bool hasNoUnderlineInName, bool hasPrioDll,bool hasPrio0Dll,bool hasPrio1Dll, bool hasPrio2Dll, bool firstWin )
	{
	ApiInfo * foundApi = 0;
	ApiInfo * foundMatchingApi = 0;
	int countFoundApis = 0;
	int scoreNeeded = 0;
	int scoreValue = 0;
	size_t apiNameLength = 0;

	if (hasUnicodeAnsiName \|\| hasNoUnderlineInName)
	{
	hasName = true;
	}

	if (hasName)
	scoreNeeded++;

	if (hasUnicodeAnsiName)
	scoreNeeded++;

	if (hasNoUnderlineInName)
	scoreNeeded++;

	if (hasPrioDll)
	scoreNeeded++;

	if (hasPrio0Dll)
	scoreNeeded++;

	if (hasPrio1Dll)
	scoreNeeded++;

	if (hasPrio2Dll)
	scoreNeeded++;

	for (size_t c = 0; c < countDuplicates; c++, it1++)
	{
	foundApi = (ApiInfo )((it1).second);
	scoreValue = 0;

	if (hasName)
	{
	if (foundApi->name[0] != 0x00)
	{
	scoreValue++;

	if (hasUnicodeAnsiName)
	{
	apiNameLength = strlen(foundApi->name);

	if ((foundApi->name[apiNameLength - 1] == 'W') \|\| (foundApi->name[apiNameLength - 1] == 'A'))
	{
	scoreValue++;
	}
	}

	if (hasNoUnderlineInName)
	{
	if (!strrchr(foundApi->name, '_'))
	{
	scoreValue++;
	}
	}
	}
	}

	if (hasPrioDll)
	{
	if (foundApi->module->priority >= 1)
	{
	scoreValue++;
	}
	}

	if (hasPrio0Dll)
	{
	if (foundApi->module->priority == 0)
	{
	scoreValue++;
	}
	}

	if (hasPrio1Dll)
	{
	if (foundApi->module->priority == 1)
	{
	scoreValue++;
	}
	}

	if (hasPrio2Dll)
	{
	if (foundApi->module->priority == 2)
	{
	scoreValue++;
	}
	}


	if (scoreValue == scoreNeeded)
	{
	foundMatchingApi = foundApi;
	countFoundApis++;

	if (firstWin)
	{
	return foundMatchingApi;
	}
	}
	}

	if (countFoundApis == 1)
	{
	return foundMatchingApi;
	}
	else
	{
	return (ApiInfo *)0;
	}

	}

	void ApiReader::setMinMaxApiAddress(DWORD_PTR virtualAddress)
	{
	if (virtualAddress < minApiAddress)
	{
	minApiAddress = virtualAddress - 1;
	}
	if (virtualAddress > maxApiAddress)
	{
	maxApiAddress = virtualAddress + 1;
	}
	}

	void ApiReader::readAndParseIAT(DWORD_PTR addressIAT, DWORD sizeIAT, std::map<DWORD_PTR, ImportModuleThunk> &moduleListNew)
	{
	moduleThunkList = &moduleListNew;
	BYTE *dataIat = new BYTE[sizeIAT];
	if (readMemoryFromProcess(addressIAT,sizeIAT,dataIat))
	{
	parseIAT(addressIAT,dataIat,sizeIAT);
	}
	else
	{
	#ifdef DEBUG_COMMENTS
	Scylla::debugLog.log(L"ApiReader::readAndParseIAT :: error reading iat " PRINTF_DWORD_PTR_FULL, addressIAT);
	#endif
	}

	delete[] dataIat;
	}

	void ApiReader::parseIAT(DWORD_PTR addressIAT, BYTE * iatBuffer, SIZE_T size)
	{
	ApiInfo *apiFound = 0;
	ModuleInfo *module = 0;
	bool isSuspect = false;
	int countApiFound = 0, countApiNotFound = 0;
	DWORD_PTR * pIATAddress = (DWORD_PTR *)iatBuffer;
	SIZE_T sizeIAT = size / sizeof(DWORD_PTR);

	bool foundModuleBreak = false;

	for (SIZE_T i = 0; i < sizeIAT; i++)
	{
	//Scylla::windowLog.log(L"%08X %08X %d von %d", addressIAT + (DWORD_PTR)&pIATAddress[i] - (DWORD_PTR)iatBuffer, pIATAddress[i],i,sizeIAT);


	if (pIATAddress[i] == 0 \|\| pIATAddress[i] == -1)
	{
	/*if (pIATAddress[i+1] != 0)
	{
	printf("parseIAT :: Module break\n");
	}*/
	/*else
	{
	printf("parseIAT :: IAT finished\n");
	break;
	}*/
	foundModuleBreak = true;
	}
	else if ( (pIATAddress[i] > minApiAddress) && (pIATAddress[i] < maxApiAddress) )
	{

	apiFound = getApiByVirtualAddress(pIATAddress[i], &isSuspect);
	if (apiFound == (ApiInfo *)1)
	{
	#ifdef DEBUG_COMMENTS
	Scylla::debugLog.log(L"apiFound == (ApiInfo *)1 -> " PRINTF_DWORD_PTR_FULL, pIATAddress[i]);
	#endif
	}
	else if (apiFound)
	{
	countApiFound++;
	#ifdef DEBUG_COMMENTS
	Scylla::debugLog.log(PRINTF_DWORD_PTR_FULL L" %s %d %s", apiFound->va, apiFound->module->getFilename(), apiFound->ordinal, apiFound->name);
	#endif
	if (module != apiFound->module)
	{
	module = apiFound->module;
	addFoundApiToModuleList(addressIAT + (DWORD_PTR)&pIATAddress[i] - (DWORD_PTR)iatBuffer, apiFound, true, isSuspect);
	}
	else
	{
	addFoundApiToModuleList(addressIAT + (DWORD_PTR)&pIATAddress[i] - (DWORD_PTR)iatBuffer, apiFound, false, isSuspect);
	}

	}
	else
	{
	countApiNotFound++;
	addNotFoundApiToModuleList(addressIAT + (DWORD_PTR)&pIATAddress[i] - (DWORD_PTR)iatBuffer, pIATAddress[i]);
	//printf("parseIAT :: API not found %08X\n", pIATAddress[i]);
	}
	}
	else
	{
	//printf("parseIAT :: API not found %08X\n", pIATAddress[i]);
	countApiNotFound++;
	addNotFoundApiToModuleList(addressIAT + (DWORD_PTR)&pIATAddress[i] - (DWORD_PTR)iatBuffer, pIATAddress[i]);
	}
	}

	Scylla::windowLog.log(L"IAT parsing finished, found %d valid APIs, missed %d APIs", countApiFound, countApiNotFound);
	}

	void ApiReader::addFoundApiToModuleList(DWORD_PTR iatAddressVA, ApiInfo * apiFound, bool isNewModule, bool isSuspect)
	{
	if (isNewModule)
	{
	addModuleToModuleList(apiFound->module->getFilename(), iatAddressVA - targetImageBase);
	}
	addFunctionToModuleList(apiFound, iatAddressVA, iatAddressVA - targetImageBase, apiFound->ordinal, true, isSuspect);
	}

	bool ApiReader::addModuleToModuleList(const WCHAR * moduleName, DWORD_PTR firstThunk)
	{
	ImportModuleThunk module;

	module.firstThunk = firstThunk;
	wcscpy_s(module.moduleName, moduleName);

	(*moduleThunkList).insert(std::pair<DWORD_PTR,ImportModuleThunk>(firstThunk,module));

	return true;
	}

	void ApiReader::addUnknownModuleToModuleList(DWORD_PTR firstThunk)
	{
	ImportModuleThunk module;

	module.firstThunk = firstThunk;
	wcscpy_s(module.moduleName, L"?");

	(*moduleThunkList).insert(std::pair<DWORD_PTR,ImportModuleThunk>(firstThunk,module));
	}

	bool ApiReader::addFunctionToModuleList(ApiInfo * apiFound, DWORD_PTR va, DWORD_PTR rva, WORD ordinal, bool valid, bool suspect)
	{
	ImportThunk import;
	ImportModuleThunk * module = 0;
	std::map<DWORD_PTR, ImportModuleThunk>::iterator iterator1;

	if ((*moduleThunkList).size() > 1)
	{
	iterator1 = (*moduleThunkList).begin();
	while (iterator1 != (*moduleThunkList).end())
	{
	if (rva >= iterator1->second.firstThunk)
	{
	iterator1++;
	if (iterator1 == (*moduleThunkList).end())
	{
	iterator1--;
	module = &(iterator1->second);
	break;
	}
	else if (rva < iterator1->second.firstThunk)
	{
	iterator1--;
	module = &(iterator1->second);
	break;
	}
	}
	else
	{
	#ifdef DEBUG_COMMENTS
	Scylla::debugLog.log(L"Error iterator1 != (*moduleThunkList).end()");
	#endif
	break;
	}
	}
	}
	else
	{
	iterator1 = (*moduleThunkList).begin();
	module = &(iterator1->second);
	}

	if (!module)
	{
	#ifdef DEBUG_COMMENTS
	Scylla::debugLog.log(L"ImportsHandling::addFunction module not found rva " PRINTF_DWORD_PTR_FULL, rva);
	#endif
	return false;
	}


	import.suspect = suspect;
	import.valid = valid;
	import.va = va;
	import.rva = rva;
	import.apiAddressVA = apiFound->va;
	import.ordinal = ordinal;
	import.hint = (WORD)apiFound->hint;

	wcscpy_s(import.moduleName, apiFound->module->getFilename());
	strcpy_s(import.name, apiFound->name);

	module->thunkList.insert(std::pair<DWORD_PTR,ImportThunk>(import.rva, import));

	return true;
	}

	void ApiReader::clearAll()
	{
	minApiAddress = -1;
	maxApiAddress = 0;

	for ( stdext::hash_map<DWORD_PTR, ApiInfo *>::iterator it = apiList.begin(); it != apiList.end(); ++it )
	{
	delete it->second;
	}
	apiList.clear();

	if (moduleThunkList != 0)
	{
	(*moduleThunkList).clear();
	}
	}

	bool ApiReader::addNotFoundApiToModuleList(DWORD_PTR iatAddressVA, DWORD_PTR apiAddress)
	{
	ImportThunk import;
	ImportModuleThunk * module = 0;
	std::map<DWORD_PTR, ImportModuleThunk>::iterator iterator1;
	DWORD_PTR rva = iatAddressVA - targetImageBase;

	if ((*moduleThunkList).size() > 0)
	{
	iterator1 = (*moduleThunkList).begin();
	while (iterator1 != (*moduleThunkList).end())
	{
	if (rva >= iterator1->second.firstThunk)
	{
	iterator1++;
	if (iterator1 == (*moduleThunkList).end())
	{
	iterator1--;
	//new unknown module
	if (iterator1->second.moduleName[0] == L'?')
	{
	module = &(iterator1->second);
	}
	else
	{
	addUnknownModuleToModuleList(rva);
	module = &((*moduleThunkList).find(rva)->second);
	}

	break;
	}
	else if (rva < iterator1->second.firstThunk)
	{
	iterator1--;
	module = &(iterator1->second);
	break;
	}
	}
	else
	{
	#ifdef DEBUG_COMMENTS
	Scylla::debugLog.log(L"Error iterator1 != (*moduleThunkList).end()\r\n");
	#endif
	break;
	}
	}
	}
	else
	{
	//new unknown module
	addUnknownModuleToModuleList(rva);
	module = &((*moduleThunkList).find(rva)->second);
	}

	if (!module)
	{
	#ifdef DEBUG_COMMENTS
	Scylla::debugLog.log(L"ImportsHandling::addFunction module not found rva " PRINTF_DWORD_PTR_FULL,rva);
	#endif
	return false;
	}


	import.suspect = true;
	import.valid = false;
	import.va = iatAddressVA;
	import.rva = rva;
	import.apiAddressVA = apiAddress;
	import.ordinal = 0;

	wcscpy_s(import.moduleName, L"?");
	strcpy_s(import.name, "?");

	module->thunkList.insert(std::pair<DWORD_PTR,ImportThunk>(import.rva, import));

	return true;
	}

	bool ApiReader::isApiBlacklisted( const char * functionName )
	{
	if (SystemInformation::currenOS < WIN_VISTA_32)
	{
	if (!strcmp(functionName, "RestoreLastError"))
	{
	return true;
	}
	else
	{
	return false;
	}
	}
	else
	{
	return false;
	}


	/*#ifdef _WIN64
	else if (SystemInformation::currenOS == WIN_XP_64 && !strcmp(functionName, "DecodePointer"))
	{
	return true;
	}
	#endif*/
	}

	bool ApiReader::isWinSxSModule( ModuleInfo * module )
	{
	if (wcsstr(module->fullPath, L"\\WinSxS\\"))
	{
	return true;
	}
	else if (wcsstr(module->fullPath, L"\\winsxs\\"))
	{
	return true;
	}
	else
	{
	return false;
	}
	}
	diff --git a/Scylla/ApiReader.h b/Scylla/ApiReader.h
	index ac66656..d42fc35 100644
	--- a/Scylla/ApiReader.h
	+++ b/Scylla/ApiReader.h
	@@ -1,74 +1,74 @@
	#pragma once

	#include <windows.h>
	#include <map>
	#include <hash_map>
	#include "ProcessAccessHelp.h"
	#include "Thunks.h"

	typedef std::pair<DWORD_PTR, ApiInfo *> API_Pair;

	class ApiReader : public ProcessAccessHelp
	{
	public:
	- static stdext::hash_map<DWORD_PTR, ApiInfo *> apiList; //api look up table
	+ static stdext::hash_multimap<DWORD_PTR, ApiInfo *> apiList; //api look up table

	static std::map<DWORD_PTR, ImportModuleThunk> * moduleThunkList; //store found apis

	static DWORD_PTR minApiAddress;
	static DWORD_PTR maxApiAddress;

	/*
	* Read all APIs from target process
	*/
	void readApisFromModuleList();

	bool isApiAddressValid(DWORD_PTR virtualAddress);
	ApiInfo * getApiByVirtualAddress(DWORD_PTR virtualAddress, bool * isSuspect);
	void readAndParseIAT(DWORD_PTR addressIAT, DWORD sizeIAT, std::map<DWORD_PTR, ImportModuleThunk> &moduleListNew );

	void clearAll();

	private:

	void parseIAT(DWORD_PTR addressIAT, BYTE * iatBuffer, SIZE_T size);

	void addApi(char functionName, WORD hint, WORD ordinal, DWORD_PTR va, DWORD_PTR rva, bool isForwarded, ModuleInfo moduleInfo);
	void addApiWithoutName(WORD ordinal, DWORD_PTR va, DWORD_PTR rva,bool isForwarded, ModuleInfo *moduleInfo);
	inline bool isApiForwarded(DWORD_PTR rva, PIMAGE_NT_HEADERS pNtHeader);
	void handleForwardedApi(DWORD_PTR vaStringPointer,char functionNameParent,DWORD_PTR rvaParent, WORD ordinalParent, ModuleInfo moduleParent);
	void parseModule(ModuleInfo *module);
	void parseModuleWithProcess(ModuleInfo * module);

	void parseExportTable(ModuleInfo *module, PIMAGE_NT_HEADERS pNtHeader, PIMAGE_EXPORT_DIRECTORY pExportDir, DWORD_PTR deltaAddress);

	ModuleInfo * findModuleByName(WCHAR *name);

	void findApiByModuleAndOrdinal(ModuleInfo * module, WORD ordinal, DWORD_PTR * vaApi, DWORD_PTR * rvaApi);
	void findApiByModuleAndName(ModuleInfo * module, char * searchFunctionName, DWORD_PTR * vaApi, DWORD_PTR * rvaApi);
	void findApiByModule(ModuleInfo * module, char * searchFunctionName, WORD ordinal, DWORD_PTR * vaApi, DWORD_PTR * rvaApi);

	bool isModuleLoadedInOwnProcess( ModuleInfo * module );
	void parseModuleWithOwnProcess( ModuleInfo * module );
	bool isPeAndExportTableValid(PIMAGE_NT_HEADERS pNtHeader);
	void findApiInProcess( ModuleInfo * module, char * searchFunctionName, WORD ordinal, DWORD_PTR * vaApi, DWORD_PTR * rvaApi );
	bool findApiInExportTable(ModuleInfo module, PIMAGE_EXPORT_DIRECTORY pExportDir, DWORD_PTR deltaAddress, char searchFunctionName, WORD ordinal, DWORD_PTR * vaApi, DWORD_PTR * rvaApi);

	BYTE * getHeaderFromProcess(ModuleInfo * module);
	BYTE * getExportTableFromProcess(ModuleInfo * module, PIMAGE_NT_HEADERS pNtHeader);

	void setModulePriority(ModuleInfo * module);
	void setMinMaxApiAddress(DWORD_PTR virtualAddress);

	void parseModuleWithMapping(ModuleInfo *moduleInfo); //not used
	void addFoundApiToModuleList(DWORD_PTR iatAddress, ApiInfo * apiFound, bool isNewModule, bool isSuspect);
	bool addModuleToModuleList(const WCHAR * moduleName, DWORD_PTR firstThunk);
	bool addFunctionToModuleList(ApiInfo * apiFound, DWORD_PTR va, DWORD_PTR rva, WORD ordinal, bool valid, bool suspect);
	bool addNotFoundApiToModuleList(DWORD_PTR iatAddressVA, DWORD_PTR apiAddress);

	void addUnknownModuleToModuleList(DWORD_PTR firstThunk);
	bool isApiBlacklisted( const char * functionName );
	bool isWinSxSModule( ModuleInfo * module );

	ApiInfo * getScoredApi(stdext::hash_map<DWORD_PTR, ApiInfo *>::iterator it1,size_t countDuplicates, bool hasName, bool hasUnicodeAnsiName, bool hasNoUnderlineInName, bool hasPrioDll,bool hasPrio0Dll,bool hasPrio1Dll, bool hasPrio2Dll, bool firstWin );
	};
	diff --git a/Scylla/DumpMemoryGui.cpp b/Scylla/DumpMemoryGui.cpp
	index 142db46..38e355b 100644
	--- a/Scylla/DumpMemoryGui.cpp
	+++ b/Scylla/DumpMemoryGui.cpp
	@@ -1,604 +1,605 @@
	#include "DumpMemoryGui.h"

	#include "Architecture.h"
	#include "ProcessAccessHelp.h"
	#include <Psapi.h>

	WCHAR DumpMemoryGui::protectionString[100];
	const WCHAR DumpMemoryGui::MemoryUndefined[] = L"UNDEF";
	const WCHAR DumpMemoryGui::MemoryUnknown[] = L"UNKNOWN";
	const WCHAR * DumpMemoryGui::MemoryStateValues[] = {L"COMMIT",L"FREE",L"RESERVE"};
	const WCHAR * DumpMemoryGui::MemoryTypeValues[] = {L"IMAGE",L"MAPPED",L"PRIVATE"};
	const WCHAR * DumpMemoryGui::MemoryProtectionValues[] = {L"EXECUTE",L"EXECUTE_READ",L"EXECUTE_READWRITE",L"EXECUTE_WRITECOPY",L"NOACCESS",L"READONLY",L"READWRITE",L"WRITECOPY",L"GUARD",L"NOCACHE",L"WRITECOMBINE"};


	DumpMemoryGui::DumpMemoryGui()
	{
	dumpedMemory = 0;
	dumpedMemorySize = 0;
	deviceNameResolver = new DeviceNameResolver();
	}
	DumpMemoryGui::~DumpMemoryGui()
	{
	if (dumpedMemory)
	{
	delete [] dumpedMemory;
	}

	if (deviceNameResolver)
	{
	delete deviceNameResolver;
	}
	}
	BOOL DumpMemoryGui::OnInitDialog(CWindow wndFocus, LPARAM lInitParam)
	{
	DoDataExchange(); // attach controls
	DlgResize_Init(true, true);

	addColumnsToMemoryList(ListMemorySelect);
	displayMemoryList(ListMemorySelect);

	forceDump = false;
	DoDataExchange(DDX_LOAD);

	EditMemoryAddress.SetValue(ProcessAccessHelp::targetImageBase);
	EditMemorySize.SetValue((DWORD)ProcessAccessHelp::targetSizeOfImage);

	CenterWindow();
	return TRUE;
	}

	void DumpMemoryGui::addColumnsToMemoryList(CListViewCtrl& list)
	{
	list.SetExtendedListViewStyle(LVS_EX_FULLROWSELECT, LVS_EX_FULLROWSELECT);

	list.InsertColumn(COL_ADDRESS, L"Address", LVCFMT_CENTER);
	list.InsertColumn(COL_SIZE, L"Size", LVCFMT_CENTER);
	list.InsertColumn(COL_FILENAME, L"File", LVCFMT_LEFT);
	list.InsertColumn(COL_PESECTION, L"PE Section", LVCFMT_LEFT);

	list.InsertColumn(COL_TYPE, L"Type", LVCFMT_CENTER);
	list.InsertColumn(COL_PROTECTION, L"Protection", LVCFMT_CENTER);
	list.InsertColumn(COL_STATE, L"State", LVCFMT_CENTER);

	list.InsertColumn(COL_MAPPED_FILE, L"Mapped File", LVCFMT_LEFT);
	}

	void DumpMemoryGui::displayMemoryList(CListViewCtrl& list)
	{
	int count = 0;
	WCHAR temp[20];
	list.DeleteAllItems();


	getMemoryList();

	std::vector<Memory>::const_iterator iter;

	for( iter = memoryList.begin(); iter != memoryList.end(); iter++ , count++)
	{
	swprintf_s(temp, PRINTF_DWORD_PTR_FULL, iter->address);
	list.InsertItem(count,temp);

	swprintf_s(temp, L"%08X", iter->size);
	list.SetItemText(count, COL_SIZE, temp);

	list.SetItemText(count, COL_FILENAME, iter->filename);
	list.SetItemText(count, COL_PESECTION, iter->peSection);

	-
	if (iter->state == MEM_FREE)
	{
	list.SetItemText(count, COL_TYPE, MemoryUndefined);
	}
	else
	{
	list.SetItemText(count, COL_TYPE, getMemoryTypeString(iter->type));
	}

	if ( (iter->state == MEM_RESERVE) \|\| (iter->state == MEM_FREE) )
	{
	list.SetItemText(count, COL_PROTECTION, MemoryUndefined);
	}
	else
	{
	list.SetItemText(count, COL_PROTECTION, getMemoryProtectionString(iter->protect));
	}

	list.SetItemText(count, COL_STATE, getMemoryStateString(iter->state));

	list.SetItemText(count, COL_MAPPED_FILE, iter->mappedFilename);

	list.SetItemData(count, (DWORD_PTR)&(*iter));
	}

	list.SetColumnWidth(COL_ADDRESS, LVSCW_AUTOSIZE_USEHEADER);
	list.SetColumnWidth(COL_SIZE, LVSCW_AUTOSIZE_USEHEADER);
	list.SetColumnWidth(COL_FILENAME, LVSCW_AUTOSIZE_USEHEADER);
	list.SetColumnWidth(COL_PESECTION, LVSCW_AUTOSIZE_USEHEADER);
	list.SetColumnWidth(COL_TYPE, LVSCW_AUTOSIZE_USEHEADER);
	list.SetColumnWidth(COL_PROTECTION, LVSCW_AUTOSIZE_USEHEADER);
	list.SetColumnWidth(COL_STATE, LVSCW_AUTOSIZE_USEHEADER);
	list.SetColumnWidth(COL_MAPPED_FILE, LVSCW_AUTOSIZE_USEHEADER);
	}

	const WCHAR * DumpMemoryGui::getMemoryTypeString(DWORD value)
	{
	switch(value)
	{
	case MEM_IMAGE:
	return MemoryTypeValues[TYPE_IMAGE];
	case MEM_MAPPED:
	return MemoryTypeValues[TYPE_MAPPED];
	case MEM_PRIVATE:
	return MemoryTypeValues[TYPE_PRIVATE];
	default:
	return MemoryUnknown;
	}
	}
	const WCHAR * DumpMemoryGui::getMemoryStateString(DWORD value)
	{
	switch(value)
	{
	case MEM_COMMIT:
	return MemoryStateValues[STATE_COMMIT];
	case MEM_FREE:
	return MemoryStateValues[STATE_FREE];
	case MEM_RESERVE:
	return MemoryStateValues[STATE_RESERVE];
	default:
	return MemoryUnknown;
	}
	}

	WCHAR * DumpMemoryGui::getMemoryProtectionString(DWORD value)
	{
	protectionString[0] = 0;

	if (value & PAGE_GUARD)
	{
	- wcscpy_s(protectionString,_countof(protectionString), MemoryProtectionValues[PROT_GUARD]);
	- wcscat_s(protectionString,_countof(protectionString), L" \| ");
	+ wcscpy_s(protectionString, MemoryProtectionValues[PROT_GUARD]);
	+ wcscat_s(protectionString, L" \| ");
	value ^= PAGE_GUARD;
	}
	if (value & PAGE_NOCACHE)
	{
	- wcscpy_s(protectionString,_countof(protectionString), MemoryProtectionValues[PROT_NOCACHE]);
	- wcscat_s(protectionString,_countof(protectionString), L" \| ");
	+ wcscpy_s(protectionString, MemoryProtectionValues[PROT_NOCACHE]);
	+ wcscat_s(protectionString, L" \| ");
	value ^= PAGE_NOCACHE;
	}
	if (value & PAGE_WRITECOMBINE)
	{
	- wcscpy_s(protectionString,_countof(protectionString), MemoryProtectionValues[PROT_WRITECOMBINE]);
	- wcscat_s(protectionString,_countof(protectionString), L" \| ");
	+ wcscpy_s(protectionString, MemoryProtectionValues[PROT_WRITECOMBINE]);
	+ wcscat_s(protectionString, L" \| ");
	value ^= PAGE_WRITECOMBINE;
	}

	switch(value)
	{
	case PAGE_EXECUTE:
	{
	- wcscat_s(protectionString,_countof(protectionString), MemoryProtectionValues[PROT_EXECUTE]);
	+ wcscat_s(protectionString, MemoryProtectionValues[PROT_EXECUTE]);
	break;
	}
	case PAGE_EXECUTE_READ:
	{
	- wcscat_s(protectionString,_countof(protectionString), MemoryProtectionValues[PROT_EXECUTE_READ]);
	+ wcscat_s(protectionString, MemoryProtectionValues[PROT_EXECUTE_READ]);
	break;
	}
	case PAGE_EXECUTE_READWRITE:
	{
	- wcscat_s(protectionString,_countof(protectionString), MemoryProtectionValues[PROT_EXECUTE_READWRITE]);
	+ wcscat_s(protectionString, MemoryProtectionValues[PROT_EXECUTE_READWRITE]);
	break;
	}
	case PAGE_EXECUTE_WRITECOPY:
	{
	- wcscat_s(protectionString,_countof(protectionString), MemoryProtectionValues[PROT_EXECUTE_WRITECOPY]);
	+ wcscat_s(protectionString, MemoryProtectionValues[PROT_EXECUTE_WRITECOPY]);
	break;
	}
	case PAGE_NOACCESS:
	{
	- wcscat_s(protectionString,_countof(protectionString), MemoryProtectionValues[PROT_NOACCESS]);
	+ wcscat_s(protectionString, MemoryProtectionValues[PROT_NOACCESS]);
	break;
	}
	case PAGE_READONLY:
	{
	- wcscat_s(protectionString,_countof(protectionString), MemoryProtectionValues[PROT_READONLY]);
	+ wcscat_s(protectionString, MemoryProtectionValues[PROT_READONLY]);
	break;
	}
	case PAGE_READWRITE:
	{
	- wcscat_s(protectionString,_countof(protectionString), MemoryProtectionValues[PROT_READWRITE]);
	+ wcscat_s(protectionString, MemoryProtectionValues[PROT_READWRITE]);
	break;
	}
	case PAGE_WRITECOPY:
	{
	- wcscat_s(protectionString,_countof(protectionString), MemoryProtectionValues[PROT_WRITECOPY]);
	+ wcscat_s(protectionString, MemoryProtectionValues[PROT_WRITECOPY]);
	break;
	}
	default:
	{
	- wcscat_s(protectionString,_countof(protectionString), MemoryUnknown);
	+ wcscat_s(protectionString, MemoryUnknown);
	}
	}

	return protectionString;
	}


	LRESULT DumpMemoryGui::OnListMemoryColumnClicked(NMHDR* pnmh)
	{
	NMLISTVIEW* list = (NMLISTVIEW*)pnmh;
	int column = list->iSubItem;

	if(column == prevColumn)
	{
	ascending = !ascending;
	}
	else
	{
	prevColumn = column;
	ascending = true;
	}

	// lo-byte: column, hi-byte: sort-order
	ListMemorySelect.SortItems(&listviewCompareFunc, MAKEWORD(column, ascending));

	return 0;
	}
	LRESULT DumpMemoryGui::OnListMemoryClick(NMHDR* pnmh)
	{
	int index = ListMemorySelect.GetSelectionMark();
	if (index != -1)
	{
	selectedMemory = (Memory *)ListMemorySelect.GetItemData(index);
	if (selectedMemory)
	{
	updateAddressAndSize(selectedMemory);
	}

	}
	return 0;
	}
	void DumpMemoryGui::OnOK(UINT uNotifyCode, int nID, CWindow wndCtl)
	{
	DoDataExchange(DDX_SAVE);

	if (EditMemoryAddress.GetValue() == 0 \|\| EditMemorySize.GetValue() == 0)
	{
	wndCtl.MessageBoxW(L"Textbox is empty!",L"Error",MB_ICONERROR);
	}
	else
	{
	if (dumpMemory())
	{
	EndDialog(1);
	}
	else
	{
	- wndCtl.MessageBoxW(L"Read memory from process failed",L"Error",MB_ICONERROR);
	+ wndCtl.MessageBoxW(L"Reading memory from process failed",L"Error",MB_ICONERROR);
	}
	}
	}
	void DumpMemoryGui::OnCancel(UINT uNotifyCode, int nID, CWindow wndCtl)
	{
	EndDialog(0);
	}

	void DumpMemoryGui::updateAddressAndSize( Memory * selectedMemory )
	{
	EditMemoryAddress.SetValue(selectedMemory->address);
	EditMemorySize.SetValue(selectedMemory->size);
	}

	int DumpMemoryGui::listviewCompareFunc(LPARAM lParam1, LPARAM lParam2, LPARAM lParamSort)
	{
	const Memory * module1 = (Memory *)lParam1;
	const Memory * module2 = (Memory *)lParam2;

	int column = LOBYTE(lParamSort);
	bool ascending = (HIBYTE(lParamSort) == TRUE);

	int diff = 0;

	switch(column)
	{
	case COL_ADDRESS:
	diff = module1->address < module2->address ? -1 : 1;
	break;
	case COL_SIZE:
	diff = module1->size < module2->size ? -1 : 1;
	break;
	case COL_FILENAME:
	diff = _wcsicmp(module1->filename, module2->filename);
	break;
	case COL_PESECTION:
	diff = _wcsicmp(module1->peSection, module2->peSection);
	break;
	case COL_TYPE:
	diff = module1->type < module2->type ? -1 : 1;
	break;
	case COL_PROTECTION:
	diff = module1->protect < module2->protect ? -1 : 1;
	break;
	case COL_STATE:
	- diff = module1->state < module2->state ? -1 : 1;
	+ diff = _wcsicmp(getMemoryStateString(module1->state), getMemoryStateString(module2->state));
	+ //diff = module1->state < module2->state ? -1 : 1;
	break;
	case COL_MAPPED_FILE:
	diff = _wcsicmp(module1->mappedFilename, module2->mappedFilename);
	break;
	}

	return ascending ? diff : -diff;
	}

	void DumpMemoryGui::getMemoryList()
	{
	DWORD count = 0;
	DWORD_PTR address = 0;
	MEMORY_BASIC_INFORMATION memBasic = {0};
	Memory memory;
	HMODULE * hMods = 0;
	DWORD cbNeeded = 0;
	bool notEnough = true;
	WCHAR target[MAX_PATH];

	count = 100;
	hMods = new HMODULE[count];

	if (memoryList.empty())
	{
	memoryList.reserve(20);
	}
	else
	{
	memoryList.clear();
	}

	memory.filename[0] = 0;
	memory.peSection[0] = 0;
	memory.mappedFilename[0] = 0;

	while(VirtualQueryEx(ProcessAccessHelp::hProcess,(LPCVOID)address,&memBasic,sizeof(memBasic)))
	{
	memory.address = (DWORD_PTR)memBasic.BaseAddress;
	memory.type = memBasic.Type;
	memory.state = memBasic.State;
	memory.size = (DWORD)memBasic.RegionSize;
	memory.protect = memBasic.Protect;


	if (memory.type == MEM_MAPPED)
	{
	if (!getMappedFilename(&memory))
	{
	memory.mappedFilename[0] = 0;
	}
	}

	memoryList.push_back(memory);

	memory.mappedFilename[0] = 0;

	address += memBasic.RegionSize;
	}

	do
	{
	if (!EnumProcessModules(ProcessAccessHelp::hProcess, hMods, count * sizeof(HMODULE), &cbNeeded))
	{
	#ifdef DEBUG_COMMENTS
	Scylla::debugLog.log(L"getMemoryList :: EnumProcessModules failed count %d", count);
	#endif
	delete [] hMods;
	return;
	}

	if ( (count * sizeof(HMODULE)) < cbNeeded )
	{
	delete [] hMods;
	count += 100;
	hMods = new HMODULE[count];
	}
	else
	{
	notEnough = false;
	}
	} while (notEnough);

	for (DWORD i = 0; i < (cbNeeded / sizeof(HMODULE)); i++ )
	{
	if (GetModuleFileNameExW(ProcessAccessHelp::hProcess, hMods[i], target, _countof(target)))
	{
	setModuleName((DWORD_PTR)hMods[i],target);
	setAllSectionNames((DWORD_PTR)hMods[i],target);
	}
	else
	{
	#ifdef DEBUG_COMMENTS
	Scylla::debugLog.log(L"getMemoryList :: GetModuleFileNameExW failed 0x%X", GetLastError());
	#endif
	}
	}

	delete [] hMods;


	}

	void DumpMemoryGui::setSectionName(DWORD_PTR sectionAddress, DWORD sectionSize, const WCHAR * sectionName)
	{
	bool found = false;
	std::vector<Memory>::const_iterator iter;


	for( iter = memoryList.begin(); iter != memoryList.end(); iter++)
	{
	if (!found)
	{
	if ( (iter->address <= sectionAddress) && (sectionAddress < (iter->address + iter->size)) )
	{
	if (wcslen(iter->peSection) == 0)
	{
	- wcscpy_s((WCHAR *)iter->peSection, IMAGE_SIZEOF_SHORT_NAME + 1, sectionName);
	+ wcscpy_s((WCHAR )iter->peSection, IMAGE_SIZEOF_SHORT_NAME 4, sectionName);
	}
	else
	{
	- wcscat_s((WCHAR )iter->peSection, IMAGE_SIZEOF_SHORT_NAME 4,L"\|");
	- wcscat_s((WCHAR )iter->peSection, IMAGE_SIZEOF_SHORT_NAME 4,sectionName);
	+ wcscat_s((WCHAR )iter->peSection, IMAGE_SIZEOF_SHORT_NAME 4, L"\|");
	+ wcscat_s((WCHAR )iter->peSection, IMAGE_SIZEOF_SHORT_NAME 4, sectionName);
	}

	found = true;
	}
	}
	else
	{
	if ((sectionSize+sectionAddress) < iter->address)
	{
	break;
	}
	if (wcslen(iter->peSection) == 0)
	{
	- wcscpy_s((WCHAR *)iter->peSection, IMAGE_SIZEOF_SHORT_NAME + 1, sectionName);
	+ wcscpy_s((WCHAR )iter->peSection, IMAGE_SIZEOF_SHORT_NAME 4, sectionName);
	}
	else
	{
	- wcscat_s((WCHAR )iter->peSection, IMAGE_SIZEOF_SHORT_NAME 4,L"\|");
	- wcscat_s((WCHAR )iter->peSection, IMAGE_SIZEOF_SHORT_NAME 4,sectionName);
	+ wcscat_s((WCHAR )iter->peSection, IMAGE_SIZEOF_SHORT_NAME 4, L"\|");
	+ wcscat_s((WCHAR )iter->peSection, IMAGE_SIZEOF_SHORT_NAME 4, sectionName);
	}
	}

	}
	}

	void DumpMemoryGui::setModuleName(DWORD_PTR moduleBase, const WCHAR * moduleName)
	{
	bool found = false;
	std::vector<Memory>::const_iterator iter;

	//get filename
	const WCHAR* slash = wcsrchr(moduleName, L'\\');
	if(slash)
	{
	moduleName = slash+1;
	}


	for( iter = memoryList.begin(); iter != memoryList.end(); iter++)
	{
	if (iter->address == moduleBase)
	{
	found = true;
	}

	if (found)
	{
	if (iter->type == MEM_IMAGE)
	{
	wcscpy_s((WCHAR *)iter->filename, MAX_PATH, moduleName);
	}
	else
	{
	break;
	}
	}
	}
	}

	void DumpMemoryGui::setAllSectionNames( DWORD_PTR moduleBase, WCHAR * moduleName )
	{
	WORD numSections = 0;
	PIMAGE_DOS_HEADER pDos = 0;
	PIMAGE_NT_HEADERS pNT = 0;
	PIMAGE_SECTION_HEADER pSec = 0;
	DWORD size = sizeof(IMAGE_DOS_HEADER) + sizeof(IMAGE_NT_HEADERS) + 200;
	DWORD correctSize = 0;
	WCHAR sectionNameW[IMAGE_SIZEOF_SHORT_NAME + 1] = {0};
	CHAR sectionNameA[IMAGE_SIZEOF_SHORT_NAME + 1] = {0};

	BYTE * buffer = new BYTE[size];

	if (ProcessAccessHelp::readMemoryFromProcess(moduleBase,size,buffer))
	{
	pDos = (PIMAGE_DOS_HEADER)buffer;

	if (pDos->e_magic == IMAGE_DOS_SIGNATURE)
	{
	pNT = (PIMAGE_NT_HEADERS)((DWORD_PTR)pDos + pDos->e_lfanew);
	if (pNT->Signature == IMAGE_NT_SIGNATURE)
	{
	numSections = pNT->FileHeader.NumberOfSections;
	correctSize = (numSections*sizeof(IMAGE_SECTION_HEADER)) + sizeof(IMAGE_NT_HEADERS) + pDos->e_lfanew;

	if (size < correctSize)
	{
	size = correctSize;
	delete [] buffer;
	buffer = new BYTE[size];
	if (!ProcessAccessHelp::readMemoryFromProcess(moduleBase,size,buffer))
	{
	delete [] buffer;
	return;
	}

	pDos = (PIMAGE_DOS_HEADER)buffer;
	pNT = (PIMAGE_NT_HEADERS)((DWORD_PTR)pDos + pDos->e_lfanew);
	}

	pSec = IMAGE_FIRST_SECTION(pNT);

	for (WORD i = 0; i < numSections; i++)
	{
	+ ZeroMemory(sectionNameA, sizeof(sectionNameA));
	memcpy(sectionNameA,pSec->Name,8);
	- swprintf_s(sectionNameW,_countof(sectionNameW),L"%S",sectionNameA);
	+ swprintf_s(sectionNameW,L"%S",sectionNameA);

	setSectionName(moduleBase + pSec->VirtualAddress, pSec->Misc.VirtualSize,sectionNameW);
	pSec++;
	}

	}
	}
	}

	delete [] buffer;
	}

	bool DumpMemoryGui::dumpMemory()
	{
	DWORD_PTR address = EditMemoryAddress.GetValue();
	dumpedMemorySize = EditMemorySize.GetValue();

	- swprintf_s(dumpFilename,_countof(dumpFilename),TEXT("MEM_")TEXT(PRINTF_DWORD_PTR_FULL_S)TEXT("_")TEXT("%08X"),address,dumpedMemorySize);
	+ swprintf_s(dumpFilename,TEXT("MEM_")TEXT(PRINTF_DWORD_PTR_FULL_S)TEXT("_")TEXT("%08X"),address,dumpedMemorySize);

	dumpedMemory = new BYTE[dumpedMemorySize];

	if (dumpedMemory)
	{
	if (forceDump)
	{
	return ProcessAccessHelp::readMemoryPartlyFromProcess(address,dumpedMemorySize,dumpedMemory);
	}
	else
	{
	return ProcessAccessHelp::readMemoryFromProcess(address,dumpedMemorySize,dumpedMemory);
	}

	}
	else
	{
	return false;
	}
	}

	bool DumpMemoryGui::getMappedFilename( Memory* memory )
	{
	WCHAR filename[MAX_PATH] = {0};

	//TODO replace with Nt direct syscall
	if (GetMappedFileNameW(ProcessAccessHelp::hProcess, (LPVOID)memory->address, filename, _countof(filename)) > 0)
	{
	return deviceNameResolver->resolveDeviceLongNameToShort(filename,memory->mappedFilename);
	}

	return false;
	}
	diff --git a/Scylla/DumpMemoryGui.h b/Scylla/DumpMemoryGui.h
	index f841e16..63eec66 100644
	--- a/Scylla/DumpMemoryGui.h
	+++ b/Scylla/DumpMemoryGui.h
	@@ -1,168 +1,169 @@
	#pragma once

	#include <windows.h>
	#include "resource.h"

	// WTL
	#include <atlbase.h> // base ATL classes
	#include <atlapp.h> // base WTL classes
	#include <atlwin.h> // ATL GUI classes
	#include <atlframe.h> // WTL window frame helpers
	#include <atlmisc.h> // WTL utility classes
	#include <atlcrack.h> // WTL enhanced msg map macros
	#include <atlctrls.h> // WTL controls
	#include <atlddx.h> // WTL dialog data exchange

	#include <vector>
	#include "hexedit.h"
	#include "DeviceNameResolver.h"

	class Memory
	{
	public:
	DWORD_PTR address;
	DWORD size;
	WCHAR filename[MAX_PATH];
	WCHAR mappedFilename[MAX_PATH];
	WCHAR peSection[IMAGE_SIZEOF_SHORT_NAME *4];
	DWORD state;
	DWORD protect;
	DWORD type;
	};

	class DumpMemoryGui : public CDialogImpl<DumpMemoryGui>, public CWinDataExchange<DumpMemoryGui>, public CDialogResize<DumpMemoryGui>
	{
	public:
	enum { IDD = IDD_DLG_DUMPMEMORY };

	BEGIN_DDX_MAP(DumpMemoryGui)
	DDX_CONTROL_HANDLE(IDC_LIST_DUMPMEMORY, ListMemorySelect)
	DDX_CONTROL(IDC_EDIT_DUMPADDRESS, EditMemoryAddress)
	DDX_CONTROL(IDC_EDIT_DUMPSIZE, EditMemorySize)
	DDX_CHECK(IDC_CHECK_FORCEDUMP, forceDump)
	END_DDX_MAP()

	BEGIN_MSG_MAP(DumpMemoryGui)
	MSG_WM_INITDIALOG(OnInitDialog)

	NOTIFY_HANDLER_EX(IDC_LIST_DUMPMEMORY, LVN_COLUMNCLICK, OnListMemoryColumnClicked)
	NOTIFY_HANDLER_EX(IDC_LIST_DUMPMEMORY, NM_CLICK, OnListMemoryClick)

	COMMAND_ID_HANDLER_EX(IDC_BTN_DUMPMEMORY_OK, OnOK)
	COMMAND_ID_HANDLER_EX(IDC_BTN_DUMPMEMORY_CANCEL, OnCancel)
	COMMAND_ID_HANDLER_EX(IDCANCEL, OnCancel)

	CHAIN_MSG_MAP(CDialogResize<DumpMemoryGui>)
	END_MSG_MAP()

	BEGIN_DLGRESIZE_MAP(DumpMemoryGui)
	DLGRESIZE_CONTROL(IDC_LIST_DUMPMEMORY, DLSZ_SIZE_X \| DLSZ_SIZE_Y)
	DLGRESIZE_CONTROL(IDC_BTN_DUMPMEMORY_OK, DLSZ_MOVE_X \| DLSZ_MOVE_Y)
	DLGRESIZE_CONTROL(IDC_BTN_DUMPMEMORY_CANCEL, DLSZ_MOVE_X \| DLSZ_MOVE_Y)
	DLGRESIZE_CONTROL(IDC_EDIT_DUMPADDRESS, DLSZ_MOVE_Y)
	DLGRESIZE_CONTROL(IDC_EDIT_DUMPSIZE, DLSZ_MOVE_Y)
	DLGRESIZE_CONTROL(IDC_STATIC_SIZE, DLSZ_MOVE_Y)
	DLGRESIZE_CONTROL(IDC_STATIC_ADDRESS, DLSZ_MOVE_Y)
	DLGRESIZE_CONTROL(IDC_CHECK_FORCEDUMP, DLSZ_MOVE_Y)
	END_DLGRESIZE_MAP()

	DumpMemoryGui();
	~DumpMemoryGui();

	BYTE * dumpedMemory;
	DWORD dumpedMemorySize;
	WCHAR dumpFilename[39];

	protected:
	CListViewCtrl ListMemorySelect;
	CHexEdit<DWORD_PTR> EditMemoryAddress;
	CHexEdit<DWORD> EditMemorySize;

	std::vector<Memory> memoryList;
	Memory * selectedMemory;

	DeviceNameResolver * deviceNameResolver;

	enum ListColumns {
	COL_ADDRESS = 0,
	COL_SIZE,
	COL_FILENAME,
	COL_PESECTION,
	COL_TYPE,
	COL_PROTECTION,
	COL_STATE,
	COL_MAPPED_FILE
	};

	int prevColumn;
	bool ascending;

	bool forceDump;

	// Message handlers

	BOOL OnInitDialog(CWindow wndFocus, LPARAM lInitParam);

	LRESULT OnListMemoryColumnClicked(NMHDR* pnmh);
	LRESULT OnListMemoryClick(NMHDR* pnmh);
	void OnOK(UINT uNotifyCode, int nID, CWindow wndCtl);
	void OnCancel(UINT uNotifyCode, int nID, CWindow wndCtl);

	// GUI functions

	void addColumnsToMemoryList(CListViewCtrl& list);
	void displayMemoryList(CListViewCtrl& list);

	static int CALLBACK listviewCompareFunc(LPARAM lParam1, LPARAM lParam2, LPARAM lParamSort);

	private:

	enum enumMemoryStateValues {
	STATE_COMMIT = 0,
	STATE_FREE,
	STATE_RESERVE
	};

	//"IMAGE",L"MAPPED",L"PRIVATE"
	enum enumMemoryTypeValues {
	TYPE_IMAGE = 0,
	TYPE_MAPPED,
	TYPE_PRIVATE
	};

	//"EXECUTE",L"EXECUTE_READ",L"EXECUTE_READWRITE",L"EXECUTE_WRITECOPY",L"NOACCESS",L"READONLY",L"READWRITE",L"WRITECOPY",L"GUARD",L"NOCACHE",L"WRITECOMBINE"
	enum enumMemoryProtectionValues {
	PROT_EXECUTE = 0,
	PROT_EXECUTE_READ,
	PROT_EXECUTE_READWRITE,
	PROT_EXECUTE_WRITECOPY,
	PROT_NOACCESS,
	PROT_READONLY,
	PROT_READWRITE,
	PROT_WRITECOPY,
	PROT_GUARD,
	PROT_NOCACHE,
	PROT_WRITECOMBINE
	};

	static const WCHAR * MemoryStateValues[];
	static const WCHAR * MemoryTypeValues[];
	static const WCHAR * MemoryProtectionValues[];
	static const WCHAR MemoryUnknown[];
	static const WCHAR MemoryUndefined[];

	static WCHAR protectionString[100];

	- const WCHAR * getMemoryTypeString(DWORD value);
	- const WCHAR * getMemoryStateString(DWORD value);
	- WCHAR * getMemoryProtectionString(DWORD value);
	+ static const WCHAR * getMemoryTypeString(DWORD value);
	+ static const WCHAR * getMemoryStateString(DWORD value);
	+ static WCHAR * getMemoryProtectionString(DWORD value);
	+
	void updateAddressAndSize( Memory * selectedMemory );
	void getMemoryList();
	SIZE_T getSizeOfImage(DWORD_PTR moduleBase);
	void setModuleName(DWORD_PTR moduleBase, const WCHAR * moduleName);
	void setAllSectionNames( DWORD_PTR moduleBase, WCHAR * moduleName );

	void setSectionName(DWORD_PTR sectionAddress, DWORD sectionSize, const WCHAR * sectionName);
	bool dumpMemory();
	bool getMappedFilename( Memory* memory );
	};
	diff --git a/Scylla/DumpSectionGui.cpp b/Scylla/DumpSectionGui.cpp
	new file mode 100644
	index 0000000..a8ab9a6
	--- /dev/null
	+++ b/Scylla/DumpSectionGui.cpp
	@@ -0,0 +1,329 @@
	+#include "DumpSectionGui.h"
	+
	+#include "Architecture.h"
	+#include "ProcessAccessHelp.h"
	+
	+
	+bool PeSection::highlightVirtualSize()
	+{
	+ //highlight too big virtual sizes -> anti-dump protection
	+ if (virtualSize > 0x2000000)
	+ {
	+ return true;
	+ }
	+ else
	+ {
	+ return false;
	+ }
	+}
	+
	+BOOL DumpSectionGui::OnInitDialog(CWindow wndFocus, LPARAM lInitParam)
	+{
	+ DoDataExchange(); // attach controls
	+ DlgResize_Init(true, true);
	+
	+ addColumnsToSectionList(ListSectionSelect);
	+ displaySectionList(ListSectionSelect);
	+
	+
	+ CenterWindow();
	+ return TRUE;
	+}
	+
	+LRESULT DumpSectionGui::OnListSectionColumnClicked(NMHDR* pnmh)
	+{
	+ NMLISTVIEW* list = (NMLISTVIEW*)pnmh;
	+ int column = list->iSubItem;
	+
	+ if(column == prevColumn)
	+ {
	+ ascending = !ascending;
	+ }
	+ else
	+ {
	+ prevColumn = column;
	+ ascending = true;
	+ }
	+
	+ // lo-byte: column, hi-byte: sort-order
	+ ListSectionSelect.SortItems(&listviewCompareFunc, MAKEWORD(column, ascending));
	+
	+ return 0;
	+}
	+LRESULT DumpSectionGui::OnListSectionClick(NMHDR* pnmh)
	+{
	+ int index = ListSectionSelect.GetSelectionMark();
	+ if (index != -1)
	+ {
	+ //selectedMemory = (Memory *)ListMemorySelect.GetItemData(index);
	+ //if (selectedMemory)
	+ //{
	+ // //updateAddressAndSize(selectedMemory);
	+ //}
	+
	+ }
	+ return 0;
	+}
	+
	+LRESULT DumpSectionGui::OnListDoubleClick(NMHDR* pnmh)
	+{
	+ RECT rect;
	+ RECT rect1,rect2;
	+ NMITEMACTIVATE* ia = (NMITEMACTIVATE*)pnmh;
	+
	+ if (ia->iSubItem != COL_VSize)
	+ {
	+ return 0;
	+ }
	+
	+
	+ LVHITTESTINFO hti;
	+ hti.pt = ia->ptAction;
	+ int clicked = ListSectionSelect.HitTest(&hti);
	+ if(clicked != -1)
	+ {
	+ selectedSection = (PeSection *)ListSectionSelect.GetItemData(clicked);
	+
	+ }
	+
	+ ListSectionSelect.GetSubItemRect(ia->iItem,ia->iSubItem,LVIR_BOUNDS,&rect);
	+
	+ //Get the Rectange of the listControl
	+ ListSectionSelect.GetWindowRect(&rect1);
	+ //Get the Rectange of the Dialog
	+ GetWindowRect(&rect2);
	+
	+ int x = rect1.left - rect2.left;
	+ int y = rect1.top - rect2.top;
	+
	+ EditListControl.SetWindowPos(HWND_TOP,rect.left + 7, rect.top + 7, rect.right - rect.left, rect.bottom - rect.top, NULL);
	+ EditListControl.ShowWindow(SW_SHOW);
	+ EditListControl.SetFocus();
	+
	+ //Draw a Rectangle around the SubItem
	+ //Rectangle(ListSectionSelect.GetDC(),rect.left,rect.top-1,rect.right,rect.bottom);
	+ //Set the listItem text in the EditBox
	+ EditListControl.SetValue(selectedSection->virtualSize);
	+
	+ return 0;
	+}
	+
	+void DumpSectionGui::OnSectionSelectAll(UINT uNotifyCode, int nID, CWindow wndCtl)
	+{
	+ for (size_t i = 0; i < sectionList.size(); i++)
	+ {
	+ ListSectionSelect.SetCheckState((int)i, ListSectionSelect.GetCheckState((int)i) ? FALSE : TRUE);
	+ }
	+}
	+
	+void DumpSectionGui::OnOK(UINT uNotifyCode, int nID, CWindow wndCtl)
	+{
	+ EndDialog(1);
	+}
	+void DumpSectionGui::OnCancel(UINT uNotifyCode, int nID, CWindow wndCtl)
	+{
	+ EndDialog(0);
	+}
	+
	+int DumpSectionGui::listviewCompareFunc(LPARAM lParam1, LPARAM lParam2, LPARAM lParamSort)
	+{
	+ const PeSection * module1 = (PeSection *)lParam1;
	+ const PeSection * module2 = (PeSection *)lParam2;
	+
	+ int column = LOBYTE(lParamSort);
	+ bool ascending = (HIBYTE(lParamSort) == TRUE);
	+
	+ int diff = 0;
	+
	+ switch(column)
	+ {
	+ case COL_NAME:
	+ diff = _wcsicmp(module1->name, module2->name);
	+ break;
	+ case COL_VA:
	+ diff = module1->virtualAddress < module2->virtualAddress ? -1 : 1;
	+ break;
	+ case COL_VSize:
	+ diff = module1->virtualSize < module2->virtualSize ? -1 : 1;
	+ break;
	+ case COL_RVA:
	+ diff = module1->rawAddress < module2->rawAddress ? -1 : 1;
	+ break;
	+ case COL_RSize:
	+ diff = module1->rawSize < module2->rawSize ? -1 : 1;
	+ break;
	+ case COL_Characteristics:
	+ diff = module1->characteristics < module2->characteristics ? -1 : 1;
	+ break;
	+ }
	+
	+ return ascending ? diff : -diff;
	+}
	+
	+void DumpSectionGui::addColumnsToSectionList(CListViewCtrl& list)
	+{
	+ list.SetExtendedListViewStyle(LVS_EX_FULLROWSELECT\|LVS_EX_CHECKBOXES\|LVS_EX_GRIDLINES, LVS_EX_FULLROWSELECT\|LVS_EX_CHECKBOXES\|LVS_EX_GRIDLINES);
	+
	+ list.InsertColumn(COL_NAME, L"Name", LVCFMT_CENTER);
	+ list.InsertColumn(COL_VA, L"Virtual Address", LVCFMT_CENTER);
	+ list.InsertColumn(COL_VSize, L"Virtual Size", LVCFMT_CENTER);
	+ list.InsertColumn(COL_RVA, L"Raw Address", LVCFMT_CENTER);
	+ list.InsertColumn(COL_RSize, L"Raw Size", LVCFMT_CENTER);
	+ list.InsertColumn(COL_Characteristics, L"Characteristics", LVCFMT_CENTER);
	+}
	+
	+void DumpSectionGui::displaySectionList(CListViewCtrl& list)
	+{
	+ int count = 0;
	+ WCHAR temp[20];
	+ list.DeleteAllItems();
	+
	+ getAllSectionsFromFile();
	+
	+ std::vector<PeSection>::const_iterator iter;
	+
	+ for( iter = sectionList.begin(); iter != sectionList.end(); iter++ , count++)
	+ {
	+ list.InsertItem(count, iter->name);
	+
	+ swprintf_s(temp, PRINTF_DWORD_PTR_FULL, iter->virtualAddress);
	+ list.SetItemText(count, COL_VA, temp);
	+
	+ swprintf_s(temp, L"%08X", iter->virtualSize);
	+ list.SetItemText(count, COL_VSize, temp);
	+
	+ swprintf_s(temp, L"%08X", iter->rawAddress);
	+ list.SetItemText(count, COL_RVA, temp);
	+
	+ swprintf_s(temp, L"%08X", iter->rawSize);
	+ list.SetItemText(count, COL_RSize, temp);
	+
	+ swprintf_s(temp, L"%08X", iter->characteristics);
	+ list.SetItemText(count, COL_Characteristics, temp);
	+
	+
	+ list.SetItemData(count, (DWORD_PTR)&(*iter));
	+ }
	+
	+ list.SetColumnWidth(COL_NAME, LVSCW_AUTOSIZE_USEHEADER);
	+ list.SetColumnWidth(COL_VA, LVSCW_AUTOSIZE_USEHEADER);
	+ list.SetColumnWidth(COL_VSize, LVSCW_AUTOSIZE_USEHEADER);
	+ list.SetColumnWidth(COL_RVA, LVSCW_AUTOSIZE_USEHEADER);
	+ list.SetColumnWidth(COL_RSize, LVSCW_AUTOSIZE_USEHEADER);
	+ list.SetColumnWidth(COL_Characteristics, LVSCW_AUTOSIZE_USEHEADER);
	+
	+}
	+
	+LRESULT DumpSectionGui::OnNMCustomdraw(NMHDR* pnmh)
	+{
	+ LRESULT pResult = 0;
	+ unsigned int vectorIndex = 0;
	+ LPNMLVCUSTOMDRAW lpLVCustomDraw = (LPNMLVCUSTOMDRAW)(pnmh);
	+
	+ switch(lpLVCustomDraw->nmcd.dwDrawStage)
	+ {
	+ case CDDS_ITEMPREPAINT:
	+ case CDDS_ITEMPREPAINT \| CDDS_SUBITEM:
	+ {
	+ vectorIndex = (unsigned int)lpLVCustomDraw->nmcd.dwItemSpec;
	+
	+ if (lpLVCustomDraw->iSubItem == COL_VSize)
	+ {
	+ if (sectionList[vectorIndex].highlightVirtualSize())
	+ {
	+ lpLVCustomDraw->clrText = RGB(255,255,255); // white text
	+ lpLVCustomDraw->clrTextBk = RGB(255,0,0); // red background
	+ }
	+ }
	+ else
	+ {
	+ lpLVCustomDraw->clrText = CLR_DEFAULT;
	+ lpLVCustomDraw->clrTextBk = CLR_DEFAULT;
	+ }
	+ }
	+ break;
	+ default:
	+ break;
	+ }
	+
	+
	+ pResult \|= CDRF_NOTIFYPOSTPAINT;
	+ pResult \|= CDRF_NOTIFYITEMDRAW;
	+ pResult \|= CDRF_NOTIFYSUBITEMDRAW;
	+
	+ return pResult;
	+}
	+
	+void DumpSectionGui::getAllSectionsFromFile()
	+{
	+ PIMAGE_DOS_HEADER pDos = 0;
	+ PIMAGE_SECTION_HEADER pSec = 0;
	+ PIMAGE_NT_HEADERS pNT = 0;
	+ DWORD size = sizeof(IMAGE_DOS_HEADER) + sizeof(IMAGE_NT_HEADERS) + 200;
	+ DWORD correctSize = 0;
	+ CHAR sectionNameA[IMAGE_SIZEOF_SHORT_NAME + 1] = {0};
	+ PeSection peSection;
	+
	+ if (sectionList.empty())
	+ {
	+ sectionList.reserve(3);
	+ }
	+ else
	+ {
	+ sectionList.clear();
	+ }
	+
	+ BYTE * buffer = new BYTE[size];
	+
	+ if (ProcessAccessHelp::readHeaderFromFile(buffer,size,fullpath))
	+ {
	+ pDos = (PIMAGE_DOS_HEADER)buffer;
	+
	+ if (pDos->e_magic == IMAGE_DOS_SIGNATURE)
	+ {
	+ pNT = (PIMAGE_NT_HEADERS)((DWORD_PTR)pDos + pDos->e_lfanew);
	+ if (pNT->Signature == IMAGE_NT_SIGNATURE)
	+ {
	+ correctSize = (pNT->FileHeader.NumberOfSections*sizeof(IMAGE_SECTION_HEADER)) + sizeof(IMAGE_NT_HEADERS) + pDos->e_lfanew + 50;
	+
	+ if (size < correctSize)
	+ {
	+ size = correctSize;
	+ delete [] buffer;
	+ buffer = new BYTE[size];
	+ if (!ProcessAccessHelp::readHeaderFromFile(buffer,size,fullpath))
	+ {
	+ delete [] buffer;
	+ return;
	+ }
	+
	+ pDos = (PIMAGE_DOS_HEADER)buffer;
	+ pNT = (PIMAGE_NT_HEADERS)((DWORD_PTR)pDos + pDos->e_lfanew);
	+ }
	+
	+ pSec = IMAGE_FIRST_SECTION(pNT);
	+
	+ for (WORD i = 0; i < pNT->FileHeader.NumberOfSections; i++)
	+ {
	+ ZeroMemory(sectionNameA, sizeof(sectionNameA));
	+ memcpy(sectionNameA,pSec->Name,8);
	+ swprintf_s(peSection.name,L"%S",sectionNameA);
	+
	+
	+ peSection.virtualAddress = imageBase + pSec->VirtualAddress;
	+ peSection.virtualSize = pSec->Misc.VirtualSize;
	+ peSection.rawAddress = pSec->PointerToRawData;
	+ peSection.rawSize = pSec->SizeOfRawData;
	+ peSection.characteristics = pSec->Characteristics;
	+
	+ sectionList.push_back(peSection);
	+
	+ pSec++;
	+ }
	+
	+ }
	+ }
	+ }
	+
	+ delete [] buffer;
	+}
	diff --git a/Scylla/DumpSectionGui.h b/Scylla/DumpSectionGui.h
	new file mode 100644
	index 0000000..3975be7
	--- /dev/null
	+++ b/Scylla/DumpSectionGui.h
	@@ -0,0 +1,118 @@
	+#pragma once
	+
	+#include <windows.h>
	+#include "resource.h"
	+
	+// WTL
	+#include <atlbase.h> // base ATL classes
	+#include <atlapp.h> // base WTL classes
	+#include <atlwin.h> // ATL GUI classes
	+#include <atlframe.h> // WTL window frame helpers
	+#include <atlmisc.h> // WTL utility classes
	+#include <atlcrack.h> // WTL enhanced msg map macros
	+#include <atlctrls.h> // WTL controls
	+#include <atlddx.h> // WTL dialog data exchange
	+
	+#include <vector>
	+#include "hexedit.h"
	+
	+
	+class PeSection
	+{
	+public:
	+ WCHAR name[IMAGE_SIZEOF_SHORT_NAME + 1];
	+ DWORD_PTR virtualAddress;
	+ DWORD virtualSize;
	+ DWORD_PTR rawAddress;
	+ DWORD rawSize;
	+ DWORD characteristics;
	+
	+ bool highlightVirtualSize();
	+};
	+
	+class DumpSectionGui : public CDialogImpl<DumpSectionGui>, public CWinDataExchange<DumpSectionGui>, public CDialogResize<DumpSectionGui>
	+{
	+ public:
	+ enum { IDD = IDD_DLG_DUMPSECTION };
	+
	+ BEGIN_DDX_MAP(DumpSectionGui)
	+ DDX_CONTROL_HANDLE(IDC_LIST_DUMPSECTION, ListSectionSelect)
	+ DDX_CONTROL(IDC_EDIT_LISTCONTROL, EditListControl)
	+ END_DDX_MAP()
	+
	+ BEGIN_MSG_MAP(DumpSectionGui)
	+ MSG_WM_INITDIALOG(OnInitDialog)
	+
	+ NOTIFY_HANDLER_EX(IDC_LIST_DUMPSECTION, LVN_COLUMNCLICK, OnListSectionColumnClicked)
	+ NOTIFY_HANDLER_EX(IDC_LIST_DUMPSECTION, NM_CLICK, OnListSectionClick)
	+ NOTIFY_HANDLER_EX(IDC_LIST_DUMPSECTION, NM_CUSTOMDRAW, OnNMCustomdraw)
	+ NOTIFY_HANDLER_EX(IDC_LIST_DUMPSECTION, NM_DBLCLK, OnListDoubleClick)
	+
	+ COMMAND_ID_HANDLER_EX(IDC_BUTTON_SELECT_DESELECT, OnSectionSelectAll)
	+ COMMAND_ID_HANDLER_EX(IDC_BTN_DUMPSECTION_OK, OnOK)
	+ COMMAND_ID_HANDLER_EX(IDC_BTN_DUMPSECTION_CANCEL, OnCancel)
	+ COMMAND_ID_HANDLER_EX(IDCANCEL, OnCancel)
	+
	+ CHAIN_MSG_MAP(CDialogResize<DumpSectionGui>)
	+ END_MSG_MAP()
	+
	+ BEGIN_DLGRESIZE_MAP(DumpSectionGui)
	+ DLGRESIZE_CONTROL(IDC_LIST_DUMPSECTION, DLSZ_SIZE_X \| DLSZ_SIZE_Y)
	+ DLGRESIZE_CONTROL(IDC_BTN_DUMPSECTION_OK, DLSZ_MOVE_X \| DLSZ_MOVE_Y)
	+ DLGRESIZE_CONTROL(IDC_BTN_DUMPSECTION_CANCEL, DLSZ_MOVE_X \| DLSZ_MOVE_Y)
	+ DLGRESIZE_CONTROL(IDC_BUTTON_SELECT_DESELECT, DLSZ_MOVE_Y)
	+ END_DLGRESIZE_MAP()
	+
	+ DumpSectionGui()
	+ {
	+ imageBase = 0;
	+ sizeOfImage = 0;
	+ fullpath[0] = 0;
	+ }
	+ //~DumpSectionGui();
	+
	+ DWORD_PTR imageBase; //VA
	+ DWORD sizeOfImage;
	+ WCHAR fullpath[MAX_PATH];
	+private:
	+ CListViewCtrl ListSectionSelect;
	+ CHexEdit<DWORD> EditListControl;
	+
	+ std::vector<PeSection> sectionList;
	+
	+ PeSection *selectedSection;
	+
	+ enum ListColumns {
	+ COL_NAME = 0,
	+ COL_VA,
	+ COL_VSize,
	+ COL_RVA,
	+ COL_RSize,
	+ COL_Characteristics
	+ };
	+
	+ int prevColumn;
	+ bool ascending;
	+
	+ // Message handlers
	+
	+ BOOL OnInitDialog(CWindow wndFocus, LPARAM lInitParam);
	+
	+ LRESULT OnListSectionColumnClicked(NMHDR* pnmh);
	+ LRESULT OnListSectionClick(NMHDR* pnmh);
	+ LRESULT OnNMCustomdraw(NMHDR* pnmh);
	+ LRESULT OnListDoubleClick(NMHDR* pnmh);
	+
	+ void OnSectionSelectAll(UINT uNotifyCode, int nID, CWindow wndCtl);
	+ void OnOK(UINT uNotifyCode, int nID, CWindow wndCtl);
	+ void OnCancel(UINT uNotifyCode, int nID, CWindow wndCtl);
	+
	+ // GUI functions
	+
	+ void addColumnsToSectionList(CListViewCtrl& list);
	+ void displaySectionList(CListViewCtrl& list);
	+
	+ static int CALLBACK listviewCompareFunc(LPARAM lParam1, LPARAM lParam2, LPARAM lParamSort);
	+ WCHAR * getCharacteristicsString( DWORD characteristics );
	+ void getAllSectionsFromFile();
	+};
	\ No newline at end of file
	diff --git a/Scylla/ImportRebuild.cpp b/Scylla/ImportRebuild.cpp
	index 8324e26..c134187 100644
	--- a/Scylla/ImportRebuild.cpp
	+++ b/Scylla/ImportRebuild.cpp
	@@ -1,713 +1,717 @@
	#include "ImportRebuild.h"

	#include "Scylla.h"
	#include "StringConversion.h"

	//#define DEBUG_COMMENTS

	ImportRebuild::ImportRebuild()
	{
	imageData = NULL;
	sizeOfFile = 0;

	pDosStub = NULL;

	pOverlay = NULL;
	sizeOfOverlay = 0;

	pImportDescriptor = NULL;
	pThunkData = NULL;
	pImportByName = NULL;

	numberOfImportDescriptors = 0;
	sizeOfImportSection = 0;
	sizeOfApiAndModuleNames = 0;
	importSectionIndex = 0;
	}

	ImportRebuild::~ImportRebuild()
	{
	delete [] pDosStub;
	delete [] imageData;

	for (size_t i = 0; i < vecSectionData.size(); i++)
	{
	delete [] vecSectionData[i];
	}

	delete [] pOverlay;
	}

	bool ImportRebuild::splitTargetFile()
	{
	PIMAGE_SECTION_HEADER pSecHeader = 0;
	BYTE * data = 0;
	DWORD alignment = 0;

	DosHeader = (IMAGE_DOS_HEADER)imageData;

	if (DosHeader.e_magic != IMAGE_DOS_SIGNATURE)
	{
	return false;
	}

	NTHeader = (IMAGE_NT_HEADERS)(imageData + DosHeader.e_lfanew);

	if (NTHeader.Signature != IMAGE_NT_SIGNATURE)
	{
	return false;
	}

	if (DosHeader.e_lfanew > sizeof(IMAGE_DOS_HEADER))
	{
	size_t sizeOfStub = DosHeader.e_lfanew - sizeof(IMAGE_DOS_HEADER);
	pDosStub = new BYTE[sizeOfStub];
	CopyMemory(pDosStub, imageData + sizeof(IMAGE_DOS_HEADER), sizeOfStub);
	}

	pSecHeader = IMAGE_FIRST_SECTION((IMAGE_NT_HEADERS*)(imageData + DosHeader.e_lfanew));

	for (WORD i = 0; i < NTHeader.FileHeader.NumberOfSections; i++)
	{
	const DWORD SECTION_SIZE_MAX = 300000000;
	DWORD sizeOfSection = pSecHeader->SizeOfRawData;

	if (sizeOfSection > SECTION_SIZE_MAX)
	{
	sizeOfSection = SECTION_SIZE_MAX;
	}

	//TODO better use section alignment because it is better?
	alignment = alignValue(sizeOfSection, NTHeader.OptionalHeader.SectionAlignment);
	data = new BYTE[alignment];

	ZeroMemory(data, alignment);
	CopyMemory(data, imageData + pSecHeader->PointerToRawData, sizeOfSection);

	vecSectionData.push_back(data);
	vecSectionHeaders.push_back(*pSecHeader);

	pSecHeader++;
	}

	if(NTHeader.FileHeader.NumberOfSections > 0) // ??
	{
	const IMAGE_SECTION_HEADER* pLastSec = &(*vecSectionHeaders.rbegin());
	DWORD calcSize = pLastSec->PointerToRawData + pLastSec->SizeOfRawData;
	if (calcSize < sizeOfFile)
	{
	sizeOfOverlay = sizeOfFile - calcSize;
	pOverlay = new BYTE[sizeOfOverlay];
	memcpy(pOverlay, imageData + calcSize, sizeOfOverlay);
	}
	}

	delete [] imageData;
	imageData = 0;

	return true;
	}

	bool ImportRebuild::alignSectionHeaders()
	{
	for (WORD i = 0; i < vecSectionHeaders.size(); i++)
	{
	vecSectionHeaders[i].VirtualAddress = alignValue(vecSectionHeaders[i].VirtualAddress, NTHeader.OptionalHeader.SectionAlignment);
	vecSectionHeaders[i].Misc.VirtualSize = alignValue(vecSectionHeaders[i].Misc.VirtualSize, NTHeader.OptionalHeader.SectionAlignment);

	vecSectionHeaders[i].PointerToRawData = alignValue(vecSectionHeaders[i].PointerToRawData, NTHeader.OptionalHeader.FileAlignment);
	vecSectionHeaders[i].SizeOfRawData = alignValue(vecSectionHeaders[i].SizeOfRawData, NTHeader.OptionalHeader.FileAlignment);
	}

	return true;
	}

	bool ImportRebuild::saveNewFile(const WCHAR * filepath)
	{
	DWORD fileOffset = 0;
	DWORD dwWriteSize = 0;
	size_t i = 0;

	if (vecSectionHeaders.size() != vecSectionData.size())
	{
	return false;
	}

	HANDLE hFile = CreateFile(filepath, GENERIC_WRITE, FILE_SHARE_WRITE \| FILE_SHARE_READ, 0,CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, 0);

	if(hFile == INVALID_HANDLE_VALUE)
	{
	#ifdef DEBUG_COMMENTS
	Scylla::debugLog.log(L"saveNewFile :: INVALID_HANDLE_VALUE %u", GetLastError());
	#endif

	return false;
	}

	//alignSectionHeaders();
	updatePeHeader();

	fileOffset = 0;
	dwWriteSize = sizeof(IMAGE_DOS_HEADER);
	ProcessAccessHelp::writeMemoryToFile(hFile, fileOffset, dwWriteSize, &DosHeader);

	fileOffset += dwWriteSize;
	dwWriteSize = DosHeader.e_lfanew - sizeof(IMAGE_DOS_HEADER);
	ProcessAccessHelp::writeMemoryToFile(hFile, fileOffset, dwWriteSize, pDosStub);

	fileOffset += dwWriteSize;
	dwWriteSize = sizeof(IMAGE_NT_HEADERS);
	ProcessAccessHelp::writeMemoryToFile(hFile, fileOffset, dwWriteSize, &NTHeader);

	fileOffset += dwWriteSize;
	dwWriteSize = sizeof(IMAGE_SECTION_HEADER);

	for (i = 0; i < vecSectionHeaders.size(); i++)
	{
	if (!ProcessAccessHelp::writeMemoryToFile(hFile, fileOffset, dwWriteSize, &vecSectionHeaders[i]))
	{
	#ifdef DEBUG_COMMENTS
	Scylla::debugLog.log(L"saveNewFile :: writeMemoryToFile failed offset %X size %X", fileOffset, dwWriteSize);
	#endif
	CloseHandle(hFile);
	return false;
	}
	fileOffset += dwWriteSize;
	}

	for (i = 0; i < vecSectionHeaders.size(); i++)
	{
	dwWriteSize = vecSectionHeaders[i].PointerToRawData - fileOffset;

	if (dwWriteSize)
	{
	if (!writeZeroMemoryToFile(hFile, fileOffset, dwWriteSize))
	{
	#ifdef DEBUG_COMMENTS
	Scylla::debugLog.log(L"saveNewFile :: writeZeroMemoryToFile failed offset %X size %X", fileOffset, dwWriteSize);
	#endif
	CloseHandle(hFile);
	return false;
	}
	fileOffset += dwWriteSize;
	}

	dwWriteSize = vecSectionHeaders[i].SizeOfRawData;

	ProcessAccessHelp::writeMemoryToFile(hFile, fileOffset, dwWriteSize, vecSectionData[i]);
	fileOffset += dwWriteSize;
	}

	if(pOverlay)
	{
	ProcessAccessHelp::writeMemoryToFile(hFile, fileOffset, (DWORD)sizeOfOverlay, pOverlay);
	fileOffset += (DWORD)sizeOfOverlay;
	}

	CloseHandle(hFile);
	return true;
	}

	bool ImportRebuild::writeZeroMemoryToFile(HANDLE hFile, DWORD fileOffset, DWORD size)
	{
	bool retValue = false;
	PVOID zeromemory = calloc(size, 1);

	if (zeromemory)
	{
	retValue = ProcessAccessHelp::writeMemoryToFile(hFile, fileOffset, size, zeromemory);
	free(zeromemory);
	}
	else
	{
	retValue = false;
	}

	return retValue;
	}

	bool ImportRebuild::addNewSection(char * sectionName, DWORD sectionSize, BYTE * sectionData)
	{
	BYTE * newBuffer = 0;
	IMAGE_SECTION_HEADER pNewSection = {0};
	size_t lastSectionIndex = vecSectionHeaders.size() - 1;
	size_t nameLength = strlen(sectionName);

	if (nameLength > IMAGE_SIZEOF_SHORT_NAME)
	{
	#ifdef DEBUG_COMMENTS
	Scylla::debugLog.log(L"addNewSection :: sectionname is too long %d", nameLength);
	#endif
	return false;
	}

	memcpy_s(pNewSection.Name, IMAGE_SIZEOF_SHORT_NAME, sectionName, nameLength);

	pNewSection.SizeOfRawData = alignValue(sectionSize, NTHeader.OptionalHeader.FileAlignment);
	pNewSection.Misc.VirtualSize = alignValue(sectionSize, NTHeader.OptionalHeader.SectionAlignment);

	pNewSection.PointerToRawData = alignValue(vecSectionHeaders[lastSectionIndex].PointerToRawData + vecSectionHeaders[lastSectionIndex].SizeOfRawData, NTHeader.OptionalHeader.FileAlignment);
	pNewSection.VirtualAddress = alignValue(vecSectionHeaders[lastSectionIndex].VirtualAddress + vecSectionHeaders[lastSectionIndex].Misc.VirtualSize, NTHeader.OptionalHeader.SectionAlignment);

	pNewSection.Characteristics = IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE\|IMAGE_SCN_CNT_CODE\|IMAGE_SCN_CNT_INITIALIZED_DATA;

	vecSectionHeaders.push_back(pNewSection);

	if ( (sectionSize != pNewSection.SizeOfRawData) \|\| (sectionData == 0) )
	{
	newBuffer = new BYTE[pNewSection.SizeOfRawData];
	ZeroMemory(newBuffer, pNewSection.SizeOfRawData);

	if (sectionData)
	{
	CopyMemory(newBuffer, sectionData, sectionSize);
	}

	}
	else
	{
	newBuffer = sectionData;
	}

	vecSectionData.push_back(newBuffer);

	return true;
	}

	bool ImportRebuild::loadTargetFile(const WCHAR * filepath)
	{
	HANDLE hTargetFile = INVALID_HANDLE_VALUE;
	DWORD fileSize = 0;
	bool retValue = false;

	hTargetFile = CreateFile(filepath, GENERIC_READ\|GENERIC_WRITE, FILE_SHARE_READ\|FILE_SHARE_WRITE, 0, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0);

	if(hTargetFile == INVALID_HANDLE_VALUE)
	{
	#ifdef DEBUG_COMMENTS
	Scylla::debugLog.log(L"loadTargetFile :: INVALID_HANDLE_VALUE %u", GetLastError());
	#endif

	return false;
	}

	fileSize = (DWORD)ProcessAccessHelp::getFileSize(hTargetFile);

	if (!fileSize)
	{
	CloseHandle(hTargetFile);
	hTargetFile = 0;
	return false;
	}

	imageData = new BYTE[fileSize];

	if (!imageData)
	{
	retValue = false;
	}
	else
	{
	sizeOfFile = fileSize;
	retValue = ProcessAccessHelp::readMemoryFromFile(hTargetFile, 0, fileSize, imageData);
	}

	CloseHandle(hTargetFile);
	hTargetFile = 0;

	return retValue;
	}

	DWORD ImportRebuild::alignValue(DWORD badValue, DWORD alignTo)
	{
	return (((badValue + alignTo - 1) / alignTo) * alignTo);
	}

	DWORD ImportRebuild::convertRVAToOffsetVector(DWORD dwRVA)
	{
	for (size_t i = 0; i < vecSectionHeaders.size(); i++)
	{
	if ((vecSectionHeaders[i].VirtualAddress <= dwRVA) && ((vecSectionHeaders[i].VirtualAddress + vecSectionHeaders[i].Misc.VirtualSize) > dwRVA))
	{
	return ((dwRVA - vecSectionHeaders[i].VirtualAddress) + vecSectionHeaders[i].PointerToRawData);
	}
	}

	return 0;
	}

	/*
	DWORD ImportRebuild::convertRVAToOffset(DWORD dwRVA)
	{
	PIMAGE_SECTION_HEADER pSectionHeader = IMAGE_FIRST_SECTION(&NTHeader);

	for (WORD i = 0; i < NTHeader.FileHeader.NumberOfSections; i++)
	{
	if ((pSectionHeader->VirtualAddress <= dwRVA) && ((pSectionHeader->VirtualAddress + pSectionHeader->Misc.VirtualSize) > dwRVA))
	{
	return ((dwRVA - pSectionHeader->VirtualAddress) + pSectionHeader->PointerToRawData);
	}
	pSectionHeader++;
	}

	return 0;
	}
	*/
	DWORD_PTR ImportRebuild::convertOffsetToRVAVector(DWORD dwOffset)
	{
	for (size_t i = 0; i < vecSectionHeaders.size(); i++)
	{
	if ((vecSectionHeaders[i].PointerToRawData <= dwOffset) && ((vecSectionHeaders[i].PointerToRawData + vecSectionHeaders[i].SizeOfRawData) > dwOffset))
	{
	return ((dwOffset - vecSectionHeaders[i].PointerToRawData) + vecSectionHeaders[i].VirtualAddress);
	}
	}

	return 0;
	}

	/*
	DWORD ImportRebuild::convertOffsetToRVA(DWORD dwOffset)
	{
	PIMAGE_SECTION_HEADER pSectionHeader = IMAGE_FIRST_SECTION(&NTHeader);

	for (WORD i = 0; i < NTHeader.FileHeader.NumberOfSections; i++)
	{
	if ((pSectionHeader->PointerToRawData <= dwOffset) && ((pSectionHeader->PointerToRawData + pSectionHeader->SizeOfRawData) > dwOffset))
	{
	return ((dwOffset - pSectionHeader->PointerToRawData) + pSectionHeader->VirtualAddress);
	}
	pSectionHeader++;
	}

	return 0;
	}
	*/

	void ImportRebuild::updatePeHeader()
	{
	size_t lastSectionIndex = vecSectionHeaders.size() - 1;

	NTHeader.FileHeader.NumberOfSections = (WORD)(lastSectionIndex + 1);
	NTHeader.OptionalHeader.SizeOfImage = vecSectionHeaders[lastSectionIndex].VirtualAddress + vecSectionHeaders[lastSectionIndex].Misc.VirtualSize;

	NTHeader.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT].VirtualAddress = 0;
	NTHeader.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT].Size = 0;

	if (NTHeader.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IAT].VirtualAddress)
	{
	for (size_t i = 0; i < vecSectionHeaders.size(); i++)
	{
	if ((vecSectionHeaders[i].VirtualAddress <= NTHeader.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IAT].VirtualAddress) && ((vecSectionHeaders[i].VirtualAddress + vecSectionHeaders[i].Misc.VirtualSize) > NTHeader.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IAT].VirtualAddress))
	{
	//section must be read and writeable
	vecSectionHeaders[i].Characteristics \|= IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE;
	}
	}

	NTHeader.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IAT].VirtualAddress = 0;
	NTHeader.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IAT].Size = 0;
	}


	NTHeader.OptionalHeader.NumberOfRvaAndSizes = 0x10;

	NTHeader.OptionalHeader.SizeOfHeaders = alignValue(DosHeader.e_lfanew + sizeof(DWORD) + sizeof(IMAGE_FILE_HEADER) + NTHeader.FileHeader.SizeOfOptionalHeader + (NTHeader.FileHeader.NumberOfSections * sizeof(IMAGE_SECTION_HEADER)), NTHeader.OptionalHeader.FileAlignment);

	}



	bool ImportRebuild::buildNewImportTable(std::map<DWORD_PTR, ImportModuleThunk> & moduleList)
	{
	createNewImportSection(moduleList);

	importSectionIndex = vecSectionHeaders.size() - 1;

	DWORD dwSize = fillImportSection(moduleList);

	if (!dwSize)
	{
	return false;
	}

	setFlagToIATSection((*moduleList.begin()).second.firstThunk);

	NTHeader.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress = vecSectionHeaders[importSectionIndex].VirtualAddress;
	NTHeader.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].Size = (DWORD)(numberOfImportDescriptors * sizeof(IMAGE_IMPORT_DESCRIPTOR));
	return true;
	}

	bool ImportRebuild::createNewImportSection(std::map<DWORD_PTR, ImportModuleThunk> & moduleList)
	{
	char sectionName[9] = {0};

	//DWORD sectionSize = calculateMinSize(moduleList);
	calculateImportSizes(moduleList);

	if (wcslen(Scylla::config[IAT_SECTION_NAME].getString()) > IMAGE_SIZEOF_SHORT_NAME)
	{
	strcpy_s(sectionName, ".SCY");
	}
	else
	{
	StringConversion::ToASCII(Scylla::config[IAT_SECTION_NAME].getString(), sectionName, _countof(sectionName));
	}

	return addNewSection(sectionName, (DWORD)sizeOfImportSection, 0);
	}

	/*DWORD ImportRebuild::calculateMinSize(std::map<DWORD_PTR, ImportModuleThunk> & moduleList)
	{
	DWORD dwSize = 0;
	std::map<DWORD_PTR, ImportModuleThunk>::iterator mapIt;
	std::map<DWORD_PTR, ImportThunk>::iterator mapIt2;

	dwSize = (DWORD)((moduleList.size() + 1) * sizeof(IMAGE_IMPORT_DESCRIPTOR)); //last is zero'ed

	for ( mapIt = moduleList.begin() ; mapIt != moduleList.end(); mapIt++ )
	{

	//dwSize += (DWORD)((*mapIt).second.thunkList.size() + sizeof(IMAGE_IMPORT_BY_NAME));
	dwSize += (DWORD)(wcslen((*mapIt).second.moduleName) + 1);

	for ( mapIt2 = (mapIt).second.thunkList.begin() ; mapIt2 != (mapIt).second.thunkList.end(); mapIt2++ )
	{
	if((*mapIt2).second.name[0] != '\0')
	{
	dwSize += sizeof(IMAGE_IMPORT_BY_NAME);
	dwSize += (DWORD)strlen((*mapIt2).second.name);
	}
	}
	}

	return dwSize;
	}*/

	BYTE * ImportRebuild::getMemoryPointerFromRVA(DWORD_PTR dwRVA)
	{
	DWORD_PTR offset = convertRVAToOffsetVector((DWORD)dwRVA);

	for (size_t i = 0; i < vecSectionHeaders.size(); i++)
	{
	if ((vecSectionHeaders[i].PointerToRawData <= offset) && ((vecSectionHeaders[i].PointerToRawData + vecSectionHeaders[i].SizeOfRawData) > offset))
	{
	return (BYTE *)((DWORD_PTR)vecSectionData[i] + (offset - vecSectionHeaders[i].PointerToRawData));
	}
	}

	return 0;
	}

	DWORD ImportRebuild::fillImportSection( std::map<DWORD_PTR, ImportModuleThunk> & moduleList )
	{
	std::map<DWORD_PTR, ImportModuleThunk>::iterator mapIt;
	std::map<DWORD_PTR, ImportThunk>::iterator mapIt2;
	PIMAGE_IMPORT_DESCRIPTOR pImportDesc = 0;
	PIMAGE_IMPORT_BY_NAME pImportByName = 0;
	PIMAGE_THUNK_DATA pThunk = 0;
	ImportModuleThunk * importModuleThunk = 0;
	ImportThunk * importThunk = 0;

	size_t stringLength = 0;
	DWORD_PTR lastRVA = 0;

	BYTE * sectionData = vecSectionData[importSectionIndex];
	DWORD offset = 0;

	pImportDescriptor = (PIMAGE_IMPORT_DESCRIPTOR)(sectionData);

	//skip the IMAGE_IMPORT_DESCRIPTOR
	offset += (DWORD)(numberOfImportDescriptors * sizeof(IMAGE_IMPORT_DESCRIPTOR));

	for ( mapIt = moduleList.begin() ; mapIt != moduleList.end(); mapIt++ )
	{
	importModuleThunk = &((*mapIt).second);

	stringLength = addImportDescriptor(importModuleThunk, offset);

	#ifdef DEBUG_COMMENTS
	Scylla::debugLog.log(L"fillImportSection :: importDesc.Name %X", pImportDescriptor->Name);
	#endif

	offset += (DWORD)stringLength; //stringLength has null termination char

	pImportByName = (PIMAGE_IMPORT_BY_NAME)((DWORD_PTR)sectionData + offset);

	//pThunk = (PIMAGE_THUNK_DATA)(getMemoryPointerFromRVA(importModuleThunk->firstThunk));

	lastRVA = importModuleThunk->firstThunk - sizeof(DWORD_PTR);

	for ( mapIt2 = (mapIt).second.thunkList.begin() ; mapIt2 != (mapIt).second.thunkList.end(); mapIt2++ )
	{
	importThunk = &((*mapIt2).second);

	pThunk = (PIMAGE_THUNK_DATA)(getMemoryPointerFromRVA(importThunk->rva));

	//check wrong iat pointer
	if (!pThunk)
	{
	#ifdef DEBUG_COMMENTS
	Scylla::debugLog.log(L"fillImportSection :: Failed to get pThunk RVA: %X", importThunk->rva);
	#endif
	return 0;
	}

	if ((lastRVA + sizeof(DWORD_PTR)) != importThunk->rva)
	{
	//add additional import desc
	addSpecialImportDescriptor(importThunk->rva);
	}
	lastRVA = importThunk->rva;

	#ifdef DEBUG_COMMENTS
	Scylla::debugLog.log(L"fillImportSection :: importThunk %X pThunk %X pImportByName %X offset %X", importThunk,pThunk,pImportByName,offset);
	#endif
	stringLength = addImportToImportTable(importThunk, pThunk, pImportByName, offset);

	offset += (DWORD)stringLength; //is 0 bei import by ordinal
	pImportByName = (PIMAGE_IMPORT_BY_NAME)((DWORD_PTR)pImportByName + stringLength);
	}

	pImportDescriptor++;
	}

	return offset;
	}

	bool ImportRebuild::rebuildImportTable(const WCHAR * targetFilePath, const WCHAR * newFilePath, std::map<DWORD_PTR, ImportModuleThunk> & moduleList)
	{
	bool retValue = false;

	if (loadTargetFile(targetFilePath))
	{
	splitTargetFile();

	retValue = buildNewImportTable(moduleList);

	if (retValue)
	{
	retValue = saveNewFile(newFilePath);
	}

	return retValue;
	}
	else
	{
	#ifdef DEBUG_COMMENTS
	Scylla::debugLog.log(L"rebuildImportTable ::Failed to load target %s", targetFilePath);
	#endif
	return false;
	}
	}

	void ImportRebuild::setFlagToIATSection(DWORD_PTR iatAddress)
	{
	for (size_t i = 0; i < vecSectionHeaders.size(); i++)
	{
	if ((vecSectionHeaders[i].VirtualAddress <= iatAddress) && ((vecSectionHeaders[i].VirtualAddress + vecSectionHeaders[i].Misc.VirtualSize) > iatAddress))
	{
	//section must be read and writeable
	vecSectionHeaders[i].Characteristics \|= IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE;
	}
	}
	}

	size_t ImportRebuild::addImportToImportTable( ImportThunk * pImport, PIMAGE_THUNK_DATA pThunk, PIMAGE_IMPORT_BY_NAME pImportByName, DWORD sectionOffset)
	{
	size_t stringLength = 0;

	if(pImport->name[0] == '\0')
	{
	pThunk->u1.AddressOfData = (IMAGE_ORDINAL(pImport->ordinal) \| IMAGE_ORDINAL_FLAG);
	}
	else
	{
	pImportByName->Hint = pImport->hint;

	stringLength = strlen(pImport->name) + 1;
	memcpy(pImportByName->Name, pImport->name, stringLength);

	pThunk->u1.AddressOfData = convertOffsetToRVAVector(vecSectionHeaders[importSectionIndex].PointerToRawData + sectionOffset);

	if (!pThunk->u1.AddressOfData)
	{
	#ifdef DEBUG_COMMENTS
	Scylla::debugLog.log(L"addImportToImportTable :: failed to get AddressOfData %X %X", vecSectionHeaders[importSectionIndex].PointerToRawData, sectionOffset);
	#endif
	}

	//next import should be nulled
	pThunk++;
	pThunk->u1.AddressOfData = 0;

	#ifdef DEBUG_COMMENTS
	Scylla::debugLog.log(L"addImportToImportTable :: pThunk->u1.AddressOfData %X %X %X", pThunk->u1.AddressOfData, pThunk, vecSectionHeaders[importSectionIndex].PointerToRawData + sectionOffset);
	#endif
	stringLength += sizeof(WORD);
	}

	return stringLength;
	}

	size_t ImportRebuild::addImportDescriptor(ImportModuleThunk * pImportModule, DWORD sectionOffset)
	{
	char dllName[MAX_PATH];

	StringConversion::ToASCII(pImportModule->moduleName, dllName, _countof(dllName));
	- size_t stringLength = strlen(dllName);
	+ size_t stringLength = strlen(dllName) + 1;
	+
	+ /*
	+ Warning: stringLength MUST include null termination char
	+ */

	memcpy((vecSectionData[importSectionIndex] + sectionOffset), dllName, stringLength); //copy module name to section

	pImportDescriptor->FirstThunk = (DWORD)pImportModule->firstThunk;
	pImportDescriptor->Name = (DWORD)convertOffsetToRVAVector(vecSectionHeaders[importSectionIndex].PointerToRawData + sectionOffset);

	return stringLength;
	}

	void ImportRebuild::addSpecialImportDescriptor(DWORD_PTR rvaFirstThunk)
	{
	PIMAGE_IMPORT_DESCRIPTOR oldID = pImportDescriptor;
	pImportDescriptor++;

	pImportDescriptor->FirstThunk = (DWORD)rvaFirstThunk;
	pImportDescriptor->Name = oldID->Name;
	}

	void ImportRebuild::calculateImportSizes(std::map<DWORD_PTR, ImportModuleThunk> & moduleList)
	{
	std::map<DWORD_PTR, ImportModuleThunk>::iterator mapIt;
	std::map<DWORD_PTR, ImportThunk>::iterator mapIt2;
	DWORD_PTR lastRVA = 0;

	numberOfImportDescriptors = 0;
	sizeOfImportSection = 0;
	sizeOfApiAndModuleNames = 0;

	numberOfImportDescriptors = moduleList.size() + 1; //last is zero'd

	for ( mapIt = moduleList.begin() ; mapIt != moduleList.end(); mapIt++ )
	{
	lastRVA = (*mapIt).second.firstThunk - sizeof(DWORD_PTR);

	sizeOfApiAndModuleNames += (DWORD)(wcslen((*mapIt).second.moduleName) + 1);

	for ( mapIt2 = (mapIt).second.thunkList.begin() ; mapIt2 != (mapIt).second.thunkList.end(); mapIt2++ )
	{
	if ((lastRVA + sizeof(DWORD_PTR)) != (*mapIt2).second.rva)
	{
	numberOfImportDescriptors++; //add additional import desc
	}

	if((*mapIt2).second.name[0] != '\0')
	{
	sizeOfApiAndModuleNames += sizeof(WORD); //Hint from IMAGE_IMPORT_BY_NAME
	sizeOfApiAndModuleNames += (DWORD)(strlen((*mapIt2).second.name) + 1);
	}

	lastRVA = (*mapIt2).second.rva;
	}
	}

	sizeOfImportSection = sizeOfApiAndModuleNames + (numberOfImportDescriptors * sizeof(IMAGE_IMPORT_DESCRIPTOR));
	}
	\ No newline at end of file
	diff --git a/Scylla/MainGui.cpp b/Scylla/MainGui.cpp
	index ce7d222..dbdce44 100644
	--- a/Scylla/MainGui.cpp
	+++ b/Scylla/MainGui.cpp
	@@ -1,1273 +1,1318 @@
	#include "MainGui.h"

	#include "Architecture.h"
	//#include "PluginLoader.h"
	//#include "ConfigurationHolder.h"
	#include "PeDump.h"
	#include "PeRebuild.h"
	#include "DllInjectionPlugin.h"
	#include "DisassemblerGui.h"
	#include "PickApiGui.h"
	//#include "NativeWinApi.h"
	#include "ImportRebuild.h"
	#include "SystemInformation.h"
	#include "Scylla.h"
	#include "AboutGui.h"
	#include "OptionsGui.h"
	#include "TreeImportExport.h"

	extern CAppModule _Module; // o_O

	const WCHAR MainGui::filterExe[] = L"Executable (.exe)\0.exe\0All files\0.\0";
	const WCHAR MainGui::filterDll[] = L"Dynamic Link Library (.dll)\0.dll\0All files\0.\0";
	const WCHAR MainGui::filterExeDll[] = L"Executable (.exe)\0.exe\0Dynamic Link Library (.dll)\0.dll\0All files\0.\0";
	const WCHAR MainGui::filterTxt[] = L"Text file (.txt)\0.txt\0All files\0.\0";
	const WCHAR MainGui::filterXml[] = L"XML file (.xml)\0.xml\0All files\0.\0";
	const WCHAR MainGui::filterMem[] = L"MEM file (.mem)\0.mem\0All files\0.\0";

	MainGui::MainGui() : selectedProcess(0), importsHandling(TreeImports), TreeImportsSubclass(this, IDC_TREE_IMPORTS)
	{
	/*
	Logger::getDebugLogFilePath();
	ConfigurationHolder::loadConfiguration();
	PluginLoader::findAllPlugins();
	NativeWinApi::initialize();
	SystemInformation::getSystemInformation();

	if(ConfigurationHolder::getConfigObject(DEBUG_PRIVILEGE)->isTrue())
	{
	processLister.setDebugPrivileges();
	}


	ProcessAccessHelp::getProcessModules(GetCurrentProcessId(), ProcessAccessHelp::ownModuleList);
	*/

	Scylla::init();

	hIcon.LoadIcon(IDI_ICON_SCYLLA);
	hMenuImports.LoadMenu(IDR_MENU_IMPORTS);
	hMenuLog.LoadMenu(IDR_MENU_LOG);
	accelerators.LoadAccelerators(IDR_ACCELERATOR_MAIN);

	hIconCheck.LoadIcon(IDI_ICON_CHECK, 16, 16);
	hIconWarning.LoadIcon(IDI_ICON_WARNING, 16, 16);
	hIconError.LoadIcon(IDI_ICON_ERROR, 16, 16);
	}

	BOOL MainGui::PreTranslateMessage(MSG* pMsg)
	{
	if(accelerators.TranslateAccelerator(m_hWnd, pMsg))
	{
	return TRUE; // handled keyboard shortcuts
	}
	else if(IsDialogMessage(pMsg))
	{
	return TRUE; // handled dialog messages
	}

	return FALSE;
	}

	BOOL MainGui::OnInitDialog(CWindow wndFocus, LPARAM lInitParam)
	{
	if (SystemInformation::currenOS == UNKNOWN_OS)
	{
	if(IDCANCEL == MessageBox(L"Operating System is not supported\r\nContinue anyway?", L"Scylla", MB_ICONWARNING \| MB_OKCANCEL))
	{
	SendMessage(WM_CLOSE);
	return FALSE;
	}
	}

	// register ourselves to receive PreTranslateMessage
	CMessageLoop* pLoop = _Module.GetMessageLoop();
	pLoop->AddMessageFilter(this);

	setupStatusBar();

	DoDataExchange(); // attach controls
	DlgResize_Init(true, true); // init CDialogResize

	Scylla::windowLog.setWindow(ListLog);

	appendPluginListToMenu(hMenuImports.GetSubMenu(0));
	appendPluginListToMenu(CMenuHandle(GetMenu()).GetSubMenu(MenuImportsOffsetTrace));

	enableDialogControls(FALSE);
	setIconAndDialogCaption();
	return TRUE;
	}

	void MainGui::OnDestroy()
	{
	PostQuitMessage(0);
	}

	void MainGui::OnSize(UINT nType, CSize size)
	{
	StatusBar.SendMessage(WM_SIZE);
	SetMsgHandled(FALSE);
	}

	void MainGui::OnContextMenu(CWindow wnd, CPoint point)
	{
	switch(wnd.GetDlgCtrlID())
	{
	case IDC_TREE_IMPORTS:
	DisplayContextMenuImports(wnd, point);
	return;
	case IDC_LIST_LOG:
	DisplayContextMenuLog(wnd, point);
	return;
	}

	SetMsgHandled(FALSE);
	}

	void MainGui::OnCommand(UINT uNotifyCode, int nID, CWindow wndCtl)
	{
	// Handle plugin trace menu selection
	if(uNotifyCode == 0 && !wndCtl.IsWindow()) // make sure it's a menu
	{
	if ((nID >= PLUGIN_MENU_BASE_ID) && (nID <= (int)(Scylla::plugins.getScyllaPluginList().size() + Scylla::plugins.getImprecPluginList().size() + PLUGIN_MENU_BASE_ID)))
	{
	pluginActionHandler(nID);
	return;
	}
	}
	SetMsgHandled(FALSE);
	}

	LRESULT MainGui::OnTreeImportsDoubleClick(const NMHDR* pnmh)
	{
	if(TreeImports.GetCount() < 1)
	return 0;

	// Get item under cursor
	CTreeItem over = findTreeItem(CPoint(GetMessagePos()), true);
	if(over && importsHandling.isImport(over))
	{
	pickApiActionHandler(over);
	}

	return 0;
	}

	LRESULT MainGui::OnTreeImportsKeyDown(const NMHDR* pnmh)
	{
	const NMTVKEYDOWN * tkd = (NMTVKEYDOWN *)pnmh;
	switch(tkd->wVKey)
	{
	case VK_RETURN:
	{
	CTreeItem selected = TreeImports.GetFocusItem();
	if(!selected.IsNull() && importsHandling.isImport(selected))
	{
	pickApiActionHandler(selected);
	}
	}
	return 1;
	case VK_DELETE:
	deleteSelectedImportsActionHandler();
	return 1;
	}

	SetMsgHandled(FALSE);
	return 0;
	}

	UINT MainGui::OnTreeImportsSubclassGetDlgCode(const MSG * lpMsg)
	{
	if(lpMsg)
	{
	switch(lpMsg->wParam)
	{
	case VK_RETURN:
	return DLGC_WANTMESSAGE;
	}
	}

	SetMsgHandled(FALSE);
	return 0;
	}

	void MainGui::OnTreeImportsSubclassChar(UINT nChar, UINT nRepCnt, UINT nFlags)
	{
	switch(nChar)
	{
	case VK_RETURN:
	break;
	default:
	SetMsgHandled(FALSE);
	break;
	}
	}

	void MainGui::OnProcessListDrop(UINT uNotifyCode, int nID, CWindow wndCtl)
	{
	fillProcessListComboBox(ComboProcessList);
	}

	void MainGui::OnProcessListSelected(UINT uNotifyCode, int nID, CWindow wndCtl)
	{
	processSelectedActionHandler(ComboProcessList.GetCurSel());
	}

	void MainGui::OnPickDLL(UINT uNotifyCode, int nID, CWindow wndCtl)
	{
	pickDllActionHandler();
	}

	void MainGui::OnOptions(UINT uNotifyCode, int nID, CWindow wndCtl)
	{
	optionsActionHandler();
	}

	void MainGui::OnDump(UINT uNotifyCode, int nID, CWindow wndCtl)
	{
	dumpActionHandler();
	}

	void MainGui::OnDumpMemory(UINT uNotifyCode, int nID, CWindow wndCtl)
	{
	dumpMemoryActionHandler();
	}

	+void MainGui::OnDumpSection(UINT uNotifyCode, int nID, CWindow wndCtl)
	+{
	+ dumpSectionActionHandler();
	+}
	+
	void MainGui::OnFixDump(UINT uNotifyCode, int nID, CWindow wndCtl)
	{
	dumpFixActionHandler();
	}

	void MainGui::OnPERebuild(UINT uNotifyCode, int nID, CWindow wndCtl)
	{
	peRebuildActionHandler();
	}

	void MainGui::OnDLLInject(UINT uNotifyCode, int nID, CWindow wndCtl)
	{
	dllInjectActionHandler();
	}

	void MainGui::OnIATAutoSearch(UINT uNotifyCode, int nID, CWindow wndCtl)
	{
	iatAutosearchActionHandler();
	}

	void MainGui::OnGetImports(UINT uNotifyCode, int nID, CWindow wndCtl)
	{
	getImportsActionHandler();
	}

	void MainGui::OnInvalidImports(UINT uNotifyCode, int nID, CWindow wndCtl)
	{
	showInvalidImportsActionHandler();
	}

	void MainGui::OnSuspectImports(UINT uNotifyCode, int nID, CWindow wndCtl)
	{
	showSuspectImportsActionHandler();
	}

	void MainGui::OnClearImports(UINT uNotifyCode, int nID, CWindow wndCtl)
	{
	clearImportsActionHandler();
	}

	void MainGui::OnInvalidateSelected(UINT uNotifyCode, int nID, CWindow wndCtl)
	{
	invalidateSelectedImportsActionHandler();
	}

	void MainGui::OnCutSelected(UINT uNotifyCode, int nID, CWindow wndCtl)
	{
	deleteSelectedImportsActionHandler();
	}

	void MainGui::OnSaveTree(UINT uNotifyCode, int nID, CWindow wndCtl)
	{
	saveTreeActionHandler();
	}

	void MainGui::OnLoadTree(UINT uNotifyCode, int nID, CWindow wndCtl)
	{
	loadTreeActionHandler();
	}

	void MainGui::OnAutotrace(UINT uNotifyCode, int nID, CWindow wndCtl)
	{
	// TODO
	}

	void MainGui::OnExit(UINT uNotifyCode, int nID, CWindow wndCtl)
	{
	DestroyWindow();
	}

	void MainGui::OnAbout(UINT uNotifyCode, int nID, CWindow wndCtl)
	{
	showAboutDialog();
	}

	void MainGui::setupStatusBar()
	{
	StatusBar.Create(m_hWnd, NULL, L"", WS_CHILD \| WS_VISIBLE \| WS_CLIPCHILDREN \| WS_CLIPSIBLINGS \| SBARS_TOOLTIPS, NULL, IDC_STATUS_BAR);

	CRect rcMain, rcStatus;
	GetClientRect(&rcMain);
	StatusBar.GetWindowRect(&rcStatus);

	const int PARTS = 4;
	int widths[PARTS];

	widths[PART_COUNT] = rcMain.Width() / 5;
	widths[PART_INVALID] = widths[PART_COUNT] + rcMain.Width() / 5;
	widths[PART_IMAGEBASE] = widths[PART_INVALID] + rcMain.Width() / 3;
	widths[PART_MODULE] = -1;

	StatusBar.SetParts(PARTS, widths);

	ResizeClient(rcMain.Width(), rcMain.Height() + rcStatus.Height(), FALSE);
	}

	void MainGui::updateStatusBar()
	{
	// Rewrite ImportsHandling so we get these easily
	unsigned int totalImports = importsHandling.thunkCount();
	unsigned int invalidImports = importsHandling.invalidThunkCount();

	// \t = center, \t\t = right-align
	swprintf_s(stringBuffer, L"\tImports: %u", totalImports);
	StatusBar.SetText(PART_COUNT, stringBuffer);

	if(invalidImports > 0)
	{
	StatusBar.SetIcon(PART_INVALID, hIconError);
	}
	else
	{
	StatusBar.SetIcon(PART_INVALID, hIconCheck);
	}

	swprintf_s(stringBuffer, L"\tInvalid: %u", invalidImports);
	StatusBar.SetText(PART_INVALID, stringBuffer);

	if(selectedProcess)
	{
	DWORD_PTR imageBase = 0;
	const WCHAR * fileName = 0;

	if(ProcessAccessHelp::selectedModule)
	{
	imageBase = ProcessAccessHelp::selectedModule->modBaseAddr;
	fileName = ProcessAccessHelp::selectedModule->getFilename();
	}
	else
	{
	imageBase = selectedProcess->imageBase;
	fileName = selectedProcess->filename;
	}

	swprintf_s(stringBuffer, L"\tImagebase: " PRINTF_DWORD_PTR_FULL, imageBase);
	StatusBar.SetText(PART_IMAGEBASE, stringBuffer);
	StatusBar.SetText(PART_MODULE, fileName);
	StatusBar.SetTipText(PART_MODULE, fileName);
	}
	else
	{
	StatusBar.SetText(PART_IMAGEBASE, L"");
	StatusBar.SetText(PART_MODULE, L"");
	}
	}

	bool MainGui::showFileDialog(WCHAR * selectedFile, bool save, const WCHAR * defFileName, const WCHAR * filter, const WCHAR * defExtension, const WCHAR * directory)
	{
	OPENFILENAME ofn = {0};

	// WTL doesn't support new explorer styles on Vista and up
	// This is because it uses a custom hook, we could remove it or derive
	// from CFileDialog but this solution is easier and allows more control anyway (e.g. initial dir)

	if(defFileName)
	{
	wcscpy_s(selectedFile, MAX_PATH, defFileName);
	}
	else
	{
	selectedFile[0] = L'\0';
	}

	ofn.lStructSize = sizeof(ofn);
	ofn.hwndOwner = m_hWnd;
	ofn.lpstrFilter = filter;
	ofn.lpstrDefExt = defExtension; // only first 3 chars are used, no dots!
	ofn.lpstrFile = selectedFile;
	ofn.lpstrInitialDir = directory;
	ofn.nMaxFile = MAX_PATH;
	ofn.Flags = OFN_PATHMUSTEXIST \| OFN_HIDEREADONLY;

	/*
	*OFN_EXPLORER is automatically used, it only has to be specified
	*if using a custom hook
	*OFN_LONGNAMES is automatically used by explorer-style dialogs
	*/

	if(save)
	ofn.Flags \|= OFN_OVERWRITEPROMPT;
	else
	ofn.Flags \|= OFN_FILEMUSTEXIST;

	if(save)
	return 0 != GetSaveFileName(&ofn);
	else
	return 0 != GetOpenFileName(&ofn);
	}

	void MainGui::setIconAndDialogCaption()
	{
	SetIcon(hIcon, TRUE);
	SetIcon(hIcon, FALSE);

	SetWindowText(APPNAME L" " ARCHITECTURE L" " APPVERSION);
	}

	void MainGui::pickDllActionHandler()
	{
	if(!selectedProcess)
	return;

	PickDllGui dlgPickDll(ProcessAccessHelp::moduleList);
	if(dlgPickDll.DoModal())
	{
	//get selected module
	ProcessAccessHelp::selectedModule = dlgPickDll.getSelectedModule();

	ProcessAccessHelp::targetImageBase = ProcessAccessHelp::selectedModule->modBaseAddr;

	Scylla::windowLog.log(L"->>> Module %s selected.", ProcessAccessHelp::selectedModule->getFilename());
	Scylla::windowLog.log(L"Imagebase: " PRINTF_DWORD_PTR_FULL L" Size: %08X", ProcessAccessHelp::selectedModule->modBaseAddr, ProcessAccessHelp::selectedModule->modBaseSize);
	}
	else
	{
	ProcessAccessHelp::selectedModule = 0;
	}

	updateStatusBar();
	}

	void MainGui::pickApiActionHandler(CTreeItem item)
	{
	if(!importsHandling.isImport(item))
	return;

	// TODO: new node when user picked an API from another DLL?

	PickApiGui dlgPickApi(ProcessAccessHelp::moduleList);
	if(dlgPickApi.DoModal())
	{
	const ApiInfo* api = dlgPickApi.getSelectedApi();
	if(api && api->module)
	{
	importsHandling.setImport(item, api->module->getFilename(), api->name, api->ordinal, api->hint, true, api->isForwarded);
	}
	}

	updateStatusBar();
	}

	void MainGui::startDisassemblerGui(CTreeItem selectedTreeNode)
	{
	if(!selectedProcess)
	return;

	DWORD_PTR address = importsHandling.getApiAddressByNode(selectedTreeNode);
	if (address)
	{
	BYTE test;
	if(!ProcessAccessHelp::readMemoryFromProcess(address, sizeof(test), &test))
	{
	swprintf_s(stringBuffer, L"Can't read memory at " PRINTF_DWORD_PTR_FULL, address);
	MessageBox(stringBuffer, L"Failure", MB_ICONERROR);
	}
	else
	{
	DisassemblerGui dlgDisassembler(address);
	dlgDisassembler.DoModal();
	}
	}
	}

	void MainGui::processSelectedActionHandler(int index)
	{
	std::vector<Process>& processList = Scylla::processLister.getProcessList();
	Process &process = processList.at(index);
	selectedProcess = 0;

	clearImportsActionHandler();

	Scylla::windowLog.log(L"Analyzing %s", process.fullPath);

	if (ProcessAccessHelp::hProcess != 0)
	{
	ProcessAccessHelp::closeProcessHandle();
	apiReader.clearAll();
	}

	if (!ProcessAccessHelp::openProcessHandle(process.PID))
	{
	enableDialogControls(FALSE);
	Scylla::windowLog.log(L"Error: Cannot open process handle.");
	updateStatusBar();
	return;
	}

	ProcessAccessHelp::getProcessModules(process.PID, ProcessAccessHelp::moduleList);

	apiReader.readApisFromModuleList();

	Scylla::windowLog.log(L"Loading modules done.");

	//TODO improve
	ProcessAccessHelp::selectedModule = 0;
	ProcessAccessHelp::targetSizeOfImage = process.imageSize;
	ProcessAccessHelp::targetImageBase = process.imageBase;

	ProcessAccessHelp::getSizeOfImageCurrentProcess();

	process.imageSize = (DWORD)ProcessAccessHelp::targetSizeOfImage;


	Scylla::windowLog.log(L"Imagebase: " PRINTF_DWORD_PTR_FULL L" Size: %08X", process.imageBase, process.imageSize);

	process.entryPoint = ProcessAccessHelp::getEntryPointFromFile(process.fullPath);

	EditOEPAddress.SetValue(process.entryPoint + process.imageBase);

	selectedProcess = &process;
	enableDialogControls(TRUE);

	updateStatusBar();
	}

	void MainGui::fillProcessListComboBox(CComboBox& hCombo)
	{
	hCombo.ResetContent();

	std::vector<Process>& processList = Scylla::processLister.getProcessListSnapshot();

	for (size_t i = 0; i < processList.size(); i++)
	{
	swprintf_s(stringBuffer, L"0x%04X - %s - %s", processList[i].PID, processList[i].filename, processList[i].fullPath);
	hCombo.AddString(stringBuffer);
	}
	}

	/*
	void MainGui::addTextToOutputLog(const WCHAR * text)
	{
	if (m_hWnd)
	{
	ListLog.SetCurSel(ListLog.AddString(text));
	}
	}
	*/

	void MainGui::clearOutputLog()
	{
	if (m_hWnd)
	{
	ListLog.ResetContent();
	}
	}

	bool MainGui::saveLogToFile(const WCHAR * file)
	{
	const BYTE BOM[] = {0xFF, 0xFE}; // UTF-16 little-endian
	const WCHAR newLine[] = L"\r\n";
	bool success = true;

	HANDLE hFile = CreateFile(file, GENERIC_WRITE, FILE_SHARE_READ, 0, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, 0);
	if(hFile != INVALID_HANDLE_VALUE)
	{
	ProcessAccessHelp::writeMemoryToFileEnd(hFile, sizeof(BOM), BOM);

	WCHAR * buffer = 0;
	size_t bufsize = 0;
	for(int i = 0; i < ListLog.GetCount(); i++)
	{
	size_t size = ListLog.GetTextLen(i);
	size += _countof(newLine)-1;
	if(size+1 > bufsize)
	{
	bufsize = size+1;
	delete[] buffer;
	try
	{
	buffer = new WCHAR[bufsize];
	}
	catch(std::bad_alloc&)
	{
	buffer = 0;
	success = false;
	break;
	}
	}

	ListLog.GetText(i, buffer);
	wcscat_s(buffer, bufsize, newLine);

	ProcessAccessHelp::writeMemoryToFileEnd(hFile, (DWORD)(size * sizeof(WCHAR)), buffer);
	}
	delete[] buffer;
	CloseHandle(hFile);
	}
	return success;
	}

	void MainGui::showInvalidImportsActionHandler()
	{
	importsHandling.selectImports(true, false);
	GotoDlgCtrl(TreeImports);
	}

	void MainGui::showSuspectImportsActionHandler()
	{
	importsHandling.selectImports(false, true);
	GotoDlgCtrl(TreeImports);
	}

	void MainGui::deleteSelectedImportsActionHandler()
	{
	CTreeItem selected = TreeImports.GetFirstSelectedItem();
	while(!selected.IsNull())
	{
	if(importsHandling.isModule(selected))
	{
	importsHandling.cutModule(selected);
	}
	else
	{
	importsHandling.cutImport(selected);
	}
	selected = TreeImports.GetNextSelectedItem(selected);
	}
	updateStatusBar();
	}

	void MainGui::invalidateSelectedImportsActionHandler()
	{
	CTreeItem selected = TreeImports.GetFirstSelectedItem();
	while(!selected.IsNull())
	{
	if(importsHandling.isImport(selected))
	{
	importsHandling.invalidateImport(selected);
	}
	selected = TreeImports.GetNextSelectedItem(selected);
	}
	updateStatusBar();
	}

	void MainGui::loadTreeActionHandler()
	{
	if(!selectedProcess)
	return;

	WCHAR selectedFilePath[MAX_PATH];
	getCurrentModulePath(stringBuffer, _countof(stringBuffer));
	if(showFileDialog(selectedFilePath, false, NULL, filterXml, NULL, stringBuffer))
	{
	TreeImportExport treeIO(selectedFilePath);
	DWORD_PTR addrOEP = 0;
	DWORD_PTR addrIAT = 0;
	DWORD sizeIAT = 0;

	if(!treeIO.importTreeList(importsHandling.moduleList, &addrOEP, &addrIAT, &sizeIAT))
	{
	Scylla::windowLog.log(L"Loading tree file failed %s", selectedFilePath);
	MessageBox(L"Loading tree file failed.", L"Failure", MB_ICONERROR);
	}
	else
	{
	EditOEPAddress.SetValue(addrOEP);
	EditIATAddress.SetValue(addrIAT);
	EditIATSize.SetValue(sizeIAT);

	importsHandling.displayAllImports();
	updateStatusBar();

	Scylla::windowLog.log(L"Loaded tree file %s", selectedFilePath);
	Scylla::windowLog.log(L"-> OEP: " PRINTF_DWORD_PTR_FULL, addrOEP);
	Scylla::windowLog.log(L"-> IAT: " PRINTF_DWORD_PTR_FULL L" Size: " PRINTF_DWORD_PTR, addrIAT, sizeIAT);
	}
	}
	}

	void MainGui::saveTreeActionHandler()
	{
	if(!selectedProcess)
	return;

	WCHAR selectedFilePath[MAX_PATH];
	getCurrentModulePath(stringBuffer, _countof(stringBuffer));
	if(showFileDialog(selectedFilePath, true, NULL, filterXml, L"xml", stringBuffer))
	{
	TreeImportExport treeIO(selectedFilePath);
	DWORD_PTR addrOEP = EditOEPAddress.GetValue();
	DWORD_PTR addrIAT = EditIATAddress.GetValue();
	DWORD sizeIAT = EditIATSize.GetValue();

	if(!treeIO.exportTreeList(importsHandling.moduleList, selectedProcess, addrOEP, addrIAT, sizeIAT))
	{
	Scylla::windowLog.log(L"Saving tree file failed %s", selectedFilePath);
	MessageBox(L"Saving tree file failed.", L"Failure", MB_ICONERROR);
	}
	else
	{
	Scylla::windowLog.log(L"Saved tree file %s", selectedFilePath);
	}
	}
	}

	void MainGui::iatAutosearchActionHandler()
	{
	DWORD_PTR searchAddress = 0;
	DWORD_PTR addressIAT = 0;
	DWORD sizeIAT = 0;
	IATSearch iatSearch;

	if(!selectedProcess)
	return;

	if(EditOEPAddress.GetWindowTextLength() > 0)
	{
	searchAddress = EditOEPAddress.GetValue();
	if (searchAddress)
	{
	if (iatSearch.searchImportAddressTableInProcess(searchAddress, &addressIAT, &sizeIAT))
	{
	Scylla::windowLog.log(L"IAT found at VA " PRINTF_DWORD_PTR_FULL L" RVA " PRINTF_DWORD_PTR_FULL L" Size 0x%04X (%d)", addressIAT, addressIAT - ProcessAccessHelp::targetImageBase, sizeIAT, sizeIAT);

	EditIATAddress.SetValue(addressIAT);
	EditIATSize.SetValue(sizeIAT);

	swprintf_s(stringBuffer, L"IAT found:\r\n\r\nStart: " PRINTF_DWORD_PTR_FULL L"\r\nSize: 0x%04X (%d) ", addressIAT, sizeIAT, sizeIAT);
	MessageBox(stringBuffer, L"IAT found", MB_ICONINFORMATION);
	}
	else
	{
	Scylla::windowLog.log(L"IAT not found at OEP " PRINTF_DWORD_PTR_FULL L"!", searchAddress);
	}
	}
	}
	}

	void MainGui::getImportsActionHandler()
	{
	if(!selectedProcess)
	return;

	DWORD_PTR addressIAT = EditIATAddress.GetValue();
	DWORD sizeIAT = EditIATSize.GetValue();

	if (addressIAT && sizeIAT)
	{
	apiReader.readAndParseIAT(addressIAT, sizeIAT, importsHandling.moduleList);
	importsHandling.displayAllImports();

	updateStatusBar();
	}
	}

	void MainGui::SetupImportsMenuItems(CTreeItem item)
	{
	bool isItem, isImport = false;
	isItem = !item.IsNull();
	if(isItem)
	{
	isImport = importsHandling.isImport(item);
	}

	CMenuHandle hSub = hMenuImports.GetSubMenu(0);

	UINT itemOnly = isItem ? MF_ENABLED : MF_GRAYED;
	UINT importOnly = isImport ? MF_ENABLED : MF_GRAYED;

	hSub.EnableMenuItem(ID__INVALIDATE, itemOnly);
	hSub.EnableMenuItem(ID__DISASSEMBLE, importOnly);
	hSub.EnableMenuItem(ID__CUTTHUNK, importOnly);

	hSub.EnableMenuItem(ID__DELETETREENODE, itemOnly);
	}

	void MainGui::DisplayContextMenuImports(CWindow hwnd, CPoint pt)
	{
	if(TreeImports.GetCount() < 1)
	return;

	CTreeItem over, parent;

	if(pt.x == -1 && pt.y == -1) // invoked by keyboard
	{
	CRect pos;
	over = TreeImports.GetFocusItem();
	if(over)
	{
	over.EnsureVisible();
	over.GetRect(&pos, TRUE);
	TreeImports.ClientToScreen(&pos);
	}
	else
	{
	TreeImports.GetWindowRect(&pos);
	}
	pt = pos.TopLeft();
	}
	else
	{
	// Get item under cursor
	over = findTreeItem(pt, true);
	}

	SetupImportsMenuItems(over);

	CMenuHandle hSub = hMenuImports.GetSubMenu(0);
	BOOL menuItem = hSub.TrackPopupMenu(TPM_LEFTALIGN \| TPM_RIGHTBUTTON \| TPM_RETURNCMD, pt.x, pt.y, hwnd);
	if (menuItem)
	{
	if ((menuItem >= PLUGIN_MENU_BASE_ID) && (menuItem <= (int)(Scylla::plugins.getScyllaPluginList().size() + Scylla::plugins.getImprecPluginList().size() + PLUGIN_MENU_BASE_ID)))
	{
	//wsprintf(stringBuffer, L"%d %s\n",menuItem,pluginList[menuItem - PLUGIN_MENU_BASE_ID].pluginName);
	//MessageBox(stringBuffer, L"plugin selection");

	pluginActionHandler(menuItem);
	return;
	}
	switch (menuItem)
	{
	case ID__INVALIDATE:
	if(importsHandling.isModule(over))
	importsHandling.invalidateModule(over);
	else
	importsHandling.invalidateImport(over);
	break;
	case ID__DISASSEMBLE:
	startDisassemblerGui(over);
	break;
	case ID__EXPANDALLNODES:
	importsHandling.expandAllTreeNodes();
	break;
	case ID__COLLAPSEALLNODES:
	importsHandling.collapseAllTreeNodes();
	break;
	case ID__CUTTHUNK:
	importsHandling.cutImport(over);
	break;
	case ID__DELETETREENODE:
	importsHandling.cutModule(importsHandling.isImport(over) ? over.GetParent() : over);
	break;
	}
	}

	updateStatusBar();
	}

	void MainGui::DisplayContextMenuLog(CWindow hwnd, CPoint pt)
	{
	if(pt.x == -1 && pt.y == -1) // invoked by keyboard
	{
	CRect pos;
	ListLog.GetWindowRect(&pos);
	pt = pos.TopLeft();
	}

	CMenuHandle hSub = hMenuLog.GetSubMenu(0);
	BOOL menuItem = hSub.TrackPopupMenu(TPM_LEFTALIGN \| TPM_RIGHTBUTTON \| TPM_RETURNCMD, pt.x, pt.y, hwnd);
	if (menuItem)
	{
	switch (menuItem)
	{
	case ID__SAVE:
	WCHAR selectedFilePath[MAX_PATH];
	getCurrentModulePath(stringBuffer, _countof(stringBuffer));
	if(showFileDialog(selectedFilePath, true, NULL, filterTxt, L"txt", stringBuffer))
	{
	saveLogToFile(selectedFilePath);
	}
	break;
	case ID__CLEAR:
	clearOutputLog();
	break;
	}
	}
	}

	void MainGui::appendPluginListToMenu(CMenuHandle hMenu)
	{
	std::vector<Plugin> &scyllaPluginList = Scylla::plugins.getScyllaPluginList();
	std::vector<Plugin> &imprecPluginList = Scylla::plugins.getImprecPluginList();

	if (scyllaPluginList.size() > 0)
	{
	CMenuHandle newMenu;
	newMenu.CreatePopupMenu();

	for (size_t i = 0; i < scyllaPluginList.size(); i++)
	{
	newMenu.AppendMenu(MF_STRING, i + PLUGIN_MENU_BASE_ID, scyllaPluginList[i].pluginName);
	}

	hMenu.AppendMenu(MF_MENUBARBREAK);
	hMenu.AppendMenu(MF_POPUP, newMenu, L"Scylla Plugins");
	}

	if (imprecPluginList.size() > 0)
	{
	CMenuHandle newMenu;
	newMenu.CreatePopupMenu();

	for (size_t i = 0; i < imprecPluginList.size(); i++)
	{
	newMenu.AppendMenu(MF_STRING, scyllaPluginList.size() + i + PLUGIN_MENU_BASE_ID, imprecPluginList[i].pluginName);
	}

	hMenu.AppendMenu(MF_MENUBARBREAK);
	hMenu.AppendMenu(MF_POPUP, newMenu, L"ImpREC Plugins");
	}
	}

	void MainGui::dumpMemoryActionHandler()
	{
	WCHAR selectedFilePath[MAX_PATH];
	DumpMemoryGui dlgDumpMemory;

	if(dlgDumpMemory.DoModal())
	{
	getCurrentModulePath(stringBuffer, _countof(stringBuffer));
	if(showFileDialog(selectedFilePath, true, dlgDumpMemory.dumpFilename, filterMem, L"mem", stringBuffer))
	{
	if (ProcessAccessHelp::writeMemoryToNewFile(selectedFilePath,dlgDumpMemory.dumpedMemorySize,dlgDumpMemory.dumpedMemory))
	{
	Scylla::windowLog.log(L"Memory dump saved %s", selectedFilePath);
	}
	else
	{
	Scylla::windowLog.log(L"Error! Cannot write memory dump to disk");
	}
	}
	}
	}

	+void MainGui::dumpSectionActionHandler()
	+{
	+ WCHAR selectedFilePath[MAX_PATH];
	+ DumpSectionGui dlgDumpSection;
	+
	+ if (ProcessAccessHelp::selectedModule)
	+ {
	+ //dump DLL
	+
	+ dlgDumpSection.imageBase = ProcessAccessHelp::selectedModule->modBaseAddr;
	+ dlgDumpSection.sizeOfImage = ProcessAccessHelp::selectedModule->modBaseSize;
	+ //get it from gui
	+ wcscpy_s(dlgDumpSection.fullpath, ProcessAccessHelp::selectedModule->fullPath);
	+ }
	+ else
	+ {
	+ dlgDumpSection.imageBase = ProcessAccessHelp::targetImageBase;
	+ dlgDumpSection.sizeOfImage = (DWORD)ProcessAccessHelp::targetSizeOfImage;
	+ //get it from gui
	+ wcscpy_s(dlgDumpSection.fullpath, selectedProcess->fullPath);
	+ }
	+
	+ if(dlgDumpSection.DoModal())
	+ {
	+ //getCurrentModulePath(stringBuffer, _countof(stringBuffer));
	+ //if(showFileDialog(selectedFilePath, true, dlgDumpMemory.dumpFilename, filterMem, L"mem", stringBuffer))
	+ //{
	+ // if (ProcessAccessHelp::writeMemoryToNewFile(selectedFilePath,dlgDumpMemory.dumpedMemorySize,dlgDumpMemory.dumpedMemory))
	+ // {
	+ // Scylla::windowLog.log(L"Memory dump saved %s", selectedFilePath);
	+ // }
	+ // else
	+ // {
	+ // Scylla::windowLog.log(L"Error! Cannot write memory dump to disk");
	+ // }
	+ //}
	+ }
	+}
	+
	void MainGui::dumpActionHandler()
	{
	if(!selectedProcess)
	return;

	WCHAR selectedFilePath[MAX_PATH];
	const WCHAR * fileFilter;
	const WCHAR * defExtension;
	PeDump peDump;

	if (ProcessAccessHelp::selectedModule)
	{
	fileFilter = filterDll;
	defExtension = L"dll";
	}
	else
	{
	fileFilter = filterExe;
	defExtension = L"exe";
	}

	getCurrentModulePath(stringBuffer, _countof(stringBuffer));
	if(showFileDialog(selectedFilePath, true, NULL, fileFilter, defExtension, stringBuffer))
	{
	if (ProcessAccessHelp::selectedModule)
	{
	//dump DLL

	peDump.imageBase = ProcessAccessHelp::selectedModule->modBaseAddr;
	peDump.sizeOfImage = ProcessAccessHelp::selectedModule->modBaseSize;
	//get it from gui
	peDump.entryPoint = EditOEPAddress.GetValue();
	wcscpy_s(peDump.fullpath, ProcessAccessHelp::selectedModule->fullPath);
	}
	else
	{
	peDump.imageBase = ProcessAccessHelp::targetImageBase;
	peDump.sizeOfImage = (DWORD)ProcessAccessHelp::targetSizeOfImage;
	//get it from gui
	peDump.entryPoint = EditOEPAddress.GetValue();
	wcscpy_s(peDump.fullpath, selectedProcess->fullPath);
	}

	peDump.useHeaderFromDisk = Scylla::config[USE_PE_HEADER_FROM_DISK].isTrue();
	if (peDump.dumpCompleteProcessToDisk(selectedFilePath))
	{
	Scylla::windowLog.log(L"Dump success %s", selectedFilePath);
	}
	else
	{
	Scylla::windowLog.log(L"Error: Cannot dump image.");
	MessageBox(L"Cannot dump image.", L"Failure", MB_ICONERROR);
	}
	}
	}

	void MainGui::peRebuildActionHandler()
	{
	DWORD newSize = 0;
	WCHAR selectedFilePath[MAX_PATH];
	PeRebuild peRebuild;

	getCurrentModulePath(stringBuffer, _countof(stringBuffer));
	if(showFileDialog(selectedFilePath, false, NULL, filterExeDll, NULL, stringBuffer))
	{
	if (Scylla::config[CREATE_BACKUP].isTrue())
	{
	if (!ProcessAccessHelp::createBackupFile(selectedFilePath))
	{
	Scylla::windowLog.log(L"Creating backup file failed %s", selectedFilePath);
	}
	}

	LONGLONG fileSize = ProcessAccessHelp::getFileSize(selectedFilePath);
	LPVOID mapped = peRebuild.createFileMappingViewFull(selectedFilePath);

	newSize = peRebuild.realignPE(mapped, (DWORD)fileSize);
	peRebuild.closeAllMappingHandles();

	if (newSize < 10)
	{
	Scylla::windowLog.log(L"Rebuild failed %s", selectedFilePath);
	MessageBox(L"Rebuild failed.", L"Failure", MB_ICONERROR);
	}
	else
	{
	peRebuild.truncateFile(selectedFilePath, newSize);

	Scylla::windowLog.log(L"Rebuild success %s", selectedFilePath);
	Scylla::windowLog.log(L"-> Old file size 0x%08X new file size 0x%08X (%d %%)", (DWORD)fileSize, newSize, (DWORD)((newSize * 100) / (DWORD)fileSize) );
	}
	}
	}

	void MainGui::dumpFixActionHandler()
	{
	if(!selectedProcess)
	return;

	if (TreeImports.GetCount() < 2)
	{
	Scylla::windowLog.log(L"Nothing to rebuild");
	return;
	}

	WCHAR newFilePath[MAX_PATH];
	WCHAR selectedFilePath[MAX_PATH];
	const WCHAR * fileFilter;

	if (ProcessAccessHelp::selectedModule)
	{
	fileFilter = filterDll;
	}
	else
	{
	fileFilter = filterExe;
	}

	getCurrentModulePath(stringBuffer, _countof(stringBuffer));
	if (showFileDialog(selectedFilePath, false, NULL, fileFilter, NULL, stringBuffer))
	{
	wcscpy_s(newFilePath, selectedFilePath);

	const WCHAR * extension = 0;

	WCHAR* dot = wcsrchr(newFilePath, L'.');
	if (dot)
	{
	*dot = L'\0';
	extension = selectedFilePath + (dot - newFilePath); //wcsrchr(selectedFilePath, L'.');
	}

	wcscat_s(newFilePath, L"_SCY");

	if(extension)
	{
	wcscat_s(newFilePath, extension);
	}

	ImportRebuild importRebuild;
	if (importRebuild.rebuildImportTable(selectedFilePath,newFilePath,importsHandling.moduleList))
	{
	Scylla::windowLog.log(L"Import Rebuild success %s", newFilePath);
	}
	else
	{
	Scylla::windowLog.log(L"Import Rebuild failed %s", selectedFilePath);
	MessageBox(L"Import Rebuild failed", L"Failure", MB_ICONERROR);
	}
	}
	}

	void MainGui::enableDialogControls(BOOL value)
	{
	BOOL valButton = value ? TRUE : FALSE;

	GetDlgItem(IDC_BTN_PICKDLL).EnableWindow(valButton);
	GetDlgItem(IDC_BTN_DUMP).EnableWindow(valButton);
	GetDlgItem(IDC_BTN_FIXDUMP).EnableWindow(valButton);
	GetDlgItem(IDC_BTN_IATAUTOSEARCH).EnableWindow(valButton);
	GetDlgItem(IDC_BTN_GETIMPORTS).EnableWindow(valButton);
	GetDlgItem(IDC_BTN_SUSPECTIMPORTS).EnableWindow(valButton);
	GetDlgItem(IDC_BTN_INVALIDIMPORTS).EnableWindow(valButton);
	GetDlgItem(IDC_BTN_CLEARIMPORTS).EnableWindow(valButton);

	CMenuHandle menu = GetMenu();

	UINT valMenu = value ? MF_ENABLED : MF_GRAYED;

	menu.EnableMenuItem(ID_FILE_DUMP, valMenu);
	menu.EnableMenuItem(ID_FILE_DUMPMEMORY, valMenu);
	+ menu.EnableMenuItem(ID_FILE_DUMPSECTION, valMenu);
	menu.EnableMenuItem(ID_FILE_FIXDUMP, valMenu);
	menu.EnableMenuItem(ID_IMPORTS_INVALIDATESELECTED, valMenu);
	menu.EnableMenuItem(ID_IMPORTS_CUTSELECTED, valMenu);
	menu.EnableMenuItem(ID_IMPORTS_SAVETREE, valMenu);
	menu.EnableMenuItem(ID_IMPORTS_LOADTREE, valMenu);
	menu.EnableMenuItem(ID_MISC_DLLINJECTION, valMenu);
	menu.GetSubMenu(MenuImportsOffsetTrace).EnableMenuItem(MenuImportsTraceOffsetScylla, MF_BYPOSITION \| valMenu);
	menu.GetSubMenu(MenuImportsOffsetTrace).EnableMenuItem(MenuImportsTraceOffsetImpRec, MF_BYPOSITION \| valMenu);

	//not yet implemented
	GetDlgItem(IDC_BTN_AUTOTRACE).EnableWindow(FALSE);
	menu.EnableMenuItem(ID_TRACE_AUTOTRACE, MF_GRAYED);
	}

	CTreeItem MainGui::findTreeItem(CPoint pt, bool screenCoordinates)
	{
	if(screenCoordinates)
	{
	TreeImports.ScreenToClient(&pt);
	}

	UINT flags;
	CTreeItem over = TreeImports.HitTest(pt, &flags);
	if(over)
	{
	if(!(flags & TVHT_ONITEM))
	{
	over.m_hTreeItem = NULL;
	}
	}

	return over;
	}

	void MainGui::showAboutDialog()
	{
	AboutGui dlgAbout;
	dlgAbout.DoModal();
	}

	void MainGui::dllInjectActionHandler()
	{
	if(!selectedProcess)
	return;

	WCHAR selectedFilePath[MAX_PATH];
	HMODULE hMod = 0;
	DllInjection dllInjection;

	getCurrentModulePath(stringBuffer, _countof(stringBuffer));
	if (showFileDialog(selectedFilePath, false, NULL, filterDll, NULL, stringBuffer))
	{
	hMod = dllInjection.dllInjection(ProcessAccessHelp::hProcess, selectedFilePath);
	if (hMod && Scylla::config[DLL_INJECTION_AUTO_UNLOAD].isTrue())
	{
	if (!dllInjection.unloadDllInProcess(ProcessAccessHelp::hProcess, hMod))
	{
	Scylla::windowLog.log(L"DLL unloading failed, target %s", selectedFilePath);
	}
	}

	if (hMod)
	{
	Scylla::windowLog.log(L"DLL Injection was successful, target %s", selectedFilePath);
	}
	else
	{
	Scylla::windowLog.log(L"DLL Injection failed, target %s", selectedFilePath);
	}
	}
	}

	void MainGui::optionsActionHandler()
	{
	OptionsGui dlgOptions;
	dlgOptions.DoModal();
	}

	void MainGui::clearImportsActionHandler()
	{
	importsHandling.clearAllImports();
	updateStatusBar();
	}

	void MainGui::pluginActionHandler( int menuItem )
	{
	if(!selectedProcess)
	return;

	DllInjectionPlugin dllInjectionPlugin;

	std::vector<Plugin> &scyllaPluginList = Scylla::plugins.getScyllaPluginList();
	std::vector<Plugin> &imprecPluginList = Scylla::plugins.getImprecPluginList();

	menuItem -= PLUGIN_MENU_BASE_ID;

	dllInjectionPlugin.hProcess = ProcessAccessHelp::hProcess;
	dllInjectionPlugin.apiReader = &apiReader;

	if (menuItem < (int)scyllaPluginList.size())
	{
	//scylla plugin
	dllInjectionPlugin.injectPlugin(scyllaPluginList[menuItem], importsHandling.moduleList,selectedProcess->imageBase, selectedProcess->imageSize);
	}
	else
	{
	#ifndef _WIN64

	menuItem -= (int)scyllaPluginList.size();
	//imprec plugin
	dllInjectionPlugin.injectImprecPlugin(imprecPluginList[menuItem], importsHandling.moduleList,selectedProcess->imageBase, selectedProcess->imageSize);

	#endif
	}

	importsHandling.scanAndFixModuleList();
	importsHandling.displayAllImports();
	updateStatusBar();
	}

	bool MainGui::getCurrentModulePath(WCHAR * buffer, size_t bufferSize)
	{
	if(!selectedProcess)
	return false;

	if(ProcessAccessHelp::selectedModule)
	{
	wcscpy_s(buffer, bufferSize, ProcessAccessHelp::selectedModule->fullPath);
	}
	else
	{
	wcscpy_s(buffer, bufferSize, selectedProcess->fullPath);
	}

	WCHAR * slash = wcsrchr(buffer, L'\\');
	if(slash)
	{
	*(slash+1) = L'\0';
	}

	return true;
	}
	diff --git a/Scylla/MainGui.h b/Scylla/MainGui.h
	index 9e397e3..0201bd9 100644
	--- a/Scylla/MainGui.h
	+++ b/Scylla/MainGui.h
	@@ -1,300 +1,304 @@
	#pragma once

	#include <windows.h>
	#include "resource.h"

	// WTL
	#include <atlbase.h> // base ATL classes
	#include <atlapp.h> // base WTL classes
	#include <atlwin.h> // ATL GUI classes
	#include <atlframe.h> // WTL window frame helpers
	#include <atlmisc.h> // WTL utility classes
	#include <atlcrack.h> // WTL enhanced msg map macros
	#include <atlctrls.h> // WTL controls
	#include <atlddx.h> // WTL dialog data exchange
	#include "multitree.h"
	#include "hexedit.h"

	#include "Logger.h"
	#include "ProcessLister.h"
	#include "IATSearch.h"
	#include "PickDllGui.h"
	#include "DumpMemoryGui.h"
	+#include "DumpSectionGui.h"
	#include "ImportsHandling.h"

	class MainGui : public CDialogImpl<MainGui>, public CWinDataExchange<MainGui>, public CDialogResize<MainGui>, public CMessageFilter
	{
	public:
	enum { IDD = IDD_DLG_MAIN };

	// Dialog Data eXchange, attaches/subclasses child controls to wrappers
	// DDX_CONTROL : subclass
	// DDX_CONTROL_HANDLE : attach
	BEGIN_DDX_MAP(MainGui)
	DDX_CONTROL(IDC_TREE_IMPORTS, TreeImportsSubclass) // needed for message reflection
	DDX_CONTROL(IDC_TREE_IMPORTS, TreeImports)
	DDX_CONTROL_HANDLE(IDC_CBO_PROCESSLIST, ComboProcessList)
	DDX_CONTROL_HANDLE(IDC_LIST_LOG, ListLog)
	DDX_CONTROL(IDC_EDIT_OEPADDRESS, EditOEPAddress)
	DDX_CONTROL(IDC_EDIT_IATADDRESS, EditIATAddress)
	DDX_CONTROL(IDC_EDIT_IATSIZE, EditIATSize)
	END_DDX_MAP()

	// Our message map
	// Messages are passed from top to bottom
	// The first handler that doesn't call SetMsgHandled(FALSE) aborts the chain
	// If none signals the message as handled, it will be passed to mixins (CHAIN_MSG_MAP)
	// or ultimately passed to DefWindowProc
	BEGIN_MSG_MAP_EX(MainGui)

	MSG_WM_INITDIALOG(OnInitDialog)
	MSG_WM_DESTROY(OnDestroy)
	MSG_WM_SIZE(OnSize)
	MSG_WM_CONTEXTMENU(OnContextMenu)
	MSG_WM_COMMAND(OnCommand)

	NOTIFY_HANDLER_EX(IDC_TREE_IMPORTS, NM_DBLCLK, OnTreeImportsDoubleClick)
	NOTIFY_HANDLER_EX(IDC_TREE_IMPORTS, TVN_KEYDOWN, OnTreeImportsKeyDown)

	COMMAND_HANDLER_EX(IDC_CBO_PROCESSLIST, CBN_DROPDOWN, OnProcessListDrop)
	COMMAND_HANDLER_EX(IDC_CBO_PROCESSLIST, CBN_SELENDOK, OnProcessListSelected)
	COMMAND_ID_HANDLER_EX(IDC_BTN_PICKDLL, OnPickDLL)
	COMMAND_ID_HANDLER_EX(IDC_BTN_OPTIONS, OnOptions)
	COMMAND_ID_HANDLER_EX(IDC_BTN_DUMP, OnDump)
	COMMAND_ID_HANDLER_EX(IDC_BTN_FIXDUMP, OnFixDump)
	COMMAND_ID_HANDLER_EX(IDC_BTN_PEREBUILD, OnPERebuild)
	COMMAND_ID_HANDLER_EX(IDC_BTN_IATAUTOSEARCH, OnIATAutoSearch)
	COMMAND_ID_HANDLER_EX(IDC_BTN_GETIMPORTS, OnGetImports)
	COMMAND_ID_HANDLER_EX(IDC_BTN_INVALIDIMPORTS, OnInvalidImports)
	COMMAND_ID_HANDLER_EX(IDC_BTN_SUSPECTIMPORTS, OnSuspectImports)
	COMMAND_ID_HANDLER_EX(IDC_BTN_CLEARIMPORTS, OnClearImports)
	COMMAND_ID_HANDLER_EX(ID_FILE_DUMP, OnDump)
	COMMAND_ID_HANDLER_EX(ID_FILE_DUMPMEMORY, OnDumpMemory)
	+ COMMAND_ID_HANDLER_EX(ID_FILE_DUMPSECTION, OnDumpSection)
	COMMAND_ID_HANDLER_EX(ID_FILE_PEREBUILD, OnPERebuild)
	COMMAND_ID_HANDLER_EX(ID_FILE_FIXDUMP, OnFixDump)
	COMMAND_ID_HANDLER_EX(ID_FILE_EXIT, OnExit)
	COMMAND_ID_HANDLER_EX(ID_IMPORTS_SHOWINVALID, OnInvalidImports)
	COMMAND_ID_HANDLER_EX(ID_IMPORTS_SHOWSUSPECT, OnSuspectImports)
	COMMAND_ID_HANDLER_EX(ID_IMPORTS_INVALIDATESELECTED, OnInvalidateSelected)
	COMMAND_ID_HANDLER_EX(ID_IMPORTS_CUTSELECTED, OnCutSelected)
	COMMAND_ID_HANDLER_EX(ID_IMPORTS_CLEARIMPORTS, OnClearImports)
	COMMAND_ID_HANDLER_EX(ID_IMPORTS_SAVETREE, OnSaveTree)
	COMMAND_ID_HANDLER_EX(ID_IMPORTS_LOADTREE, OnLoadTree)
	COMMAND_ID_HANDLER_EX(ID_TRACE_AUTOTRACE, OnAutotrace)
	COMMAND_ID_HANDLER_EX(ID_MISC_DLLINJECTION, OnDLLInject)
	COMMAND_ID_HANDLER_EX(ID_MISC_OPTIONS, OnOptions)
	COMMAND_ID_HANDLER_EX(ID_HELP_ABOUT, OnAbout)
	COMMAND_ID_HANDLER_EX(IDCANCEL, OnExit)

	REFLECT_NOTIFY_ID(IDC_TREE_IMPORTS) // pass WM_NOTIFY to child control
	CHAIN_MSG_MAP(CDialogResize<MainGui>)

	// Message map for subclassed treeview
	// CContainedWindow forwards all messages to this map
	ALT_MSG_MAP(IDC_TREE_IMPORTS)

	MSG_WM_GETDLGCODE(OnTreeImportsSubclassGetDlgCode)
	MSG_WM_CHAR(OnTreeImportsSubclassChar)

	END_MSG_MAP()

	// Dialog resize 'table'
	// States if child controls move or resize or center in a specific direction
	// when the parent dialog is resized
	BEGIN_DLGRESIZE_MAP(MainGui)
	DLGRESIZE_CONTROL(IDC_GROUP_ATTACH, DLSZ_SIZE_X)
	DLGRESIZE_CONTROL(IDC_CBO_PROCESSLIST, DLSZ_SIZE_X)
	DLGRESIZE_CONTROL(IDC_BTN_PICKDLL, DLSZ_MOVE_X)

	DLGRESIZE_CONTROL(IDC_GROUP_IMPORTS, DLSZ_SIZE_X \| DLSZ_SIZE_Y)
	DLGRESIZE_CONTROL(IDC_TREE_IMPORTS, DLSZ_SIZE_X \| DLSZ_SIZE_Y)
	DLGRESIZE_CONTROL(IDC_BTN_INVALIDIMPORTS, DLSZ_MOVE_Y)
	DLGRESIZE_CONTROL(IDC_BTN_SUSPECTIMPORTS, DLSZ_MOVE_Y)
	DLGRESIZE_CONTROL(IDC_BTN_CLEARIMPORTS, DLSZ_MOVE_X \| DLSZ_MOVE_Y)

	DLGRESIZE_CONTROL(IDC_GROUP_IATINFO, DLSZ_MOVE_Y)
	DLGRESIZE_CONTROL(IDC_STATIC_OEPADDRESS, DLSZ_MOVE_Y)
	DLGRESIZE_CONTROL(IDC_STATIC_IATADDRESS, DLSZ_MOVE_Y)
	DLGRESIZE_CONTROL(IDC_STATIC_IATSIZE, DLSZ_MOVE_Y)
	DLGRESIZE_CONTROL(IDC_EDIT_OEPADDRESS, DLSZ_MOVE_Y)
	DLGRESIZE_CONTROL(IDC_EDIT_IATADDRESS, DLSZ_MOVE_Y)
	DLGRESIZE_CONTROL(IDC_EDIT_IATSIZE, DLSZ_MOVE_Y)
	DLGRESIZE_CONTROL(IDC_BTN_IATAUTOSEARCH, DLSZ_MOVE_Y)
	DLGRESIZE_CONTROL(IDC_BTN_GETIMPORTS, DLSZ_MOVE_Y)

	DLGRESIZE_CONTROL(IDC_GROUP_ACTIONS, DLSZ_MOVE_Y)
	DLGRESIZE_CONTROL(IDC_BTN_AUTOTRACE, DLSZ_MOVE_Y)

	DLGRESIZE_CONTROL(IDC_GROUP_DUMP, DLSZ_MOVE_Y)
	DLGRESIZE_CONTROL(IDC_BTN_DUMP, DLSZ_MOVE_Y)
	DLGRESIZE_CONTROL(IDC_BTN_PEREBUILD, DLSZ_MOVE_Y)
	DLGRESIZE_CONTROL(IDC_BTN_FIXDUMP, DLSZ_MOVE_Y)

	DLGRESIZE_CONTROL(IDC_GROUP_LOG, DLSZ_MOVE_Y \| DLSZ_SIZE_X)
	DLGRESIZE_CONTROL(IDC_LIST_LOG, DLSZ_MOVE_Y \| DLSZ_SIZE_X)
	END_DLGRESIZE_MAP()

	MainGui();

	//void addTextToOutputLog(const WCHAR * text);

	//CWindow getLogListboxHandle() const { return ListLog; }

	protected:

	// Variables


	WCHAR stringBuffer[600];

	ImportsHandling importsHandling;
	//ProcessAccessHelp processAccessHelp;
	ApiReader apiReader;

	Process * selectedProcess;

	// File selection filters

	static const WCHAR filterExe[];
	static const WCHAR filterDll[];
	static const WCHAR filterExeDll[];
	static const WCHAR filterTxt[];
	static const WCHAR filterXml[];
	static const WCHAR filterMem[];

	// Controls

	CMultiSelectTreeViewCtrl TreeImports;
	CComboBox ComboProcessList;
	CHexEdit<DWORD_PTR> EditOEPAddress;
	CHexEdit<DWORD_PTR> EditIATAddress;
	CHexEdit<DWORD> EditIATSize;
	CListBox ListLog;
	CStatusBarCtrl StatusBar;

	enum StatusParts {
	PART_COUNT = 0,
	PART_INVALID,
	PART_IMAGEBASE,
	PART_MODULE
	};

	CContainedWindow TreeImportsSubclass;

	// Handles

	CIcon hIcon;
	CMenu hMenuImports;
	CMenu hMenuLog;
	CAccelerator accelerators;
	CIcon hIconCheck;
	CIcon hIconWarning;
	CIcon hIconError;

	static const int MenuImportsOffsetTrace = 2;
	static const int MenuImportsTraceOffsetScylla = 2;
	static const int MenuImportsTraceOffsetImpRec = 4;

	static const int PLUGIN_MENU_BASE_ID = 0x10;

	protected:

	virtual BOOL PreTranslateMessage(MSG* pMsg);

	// Message handlers

	BOOL OnInitDialog(CWindow wndFocus, LPARAM lInitParam);
	void OnDestroy();
	void OnSize(UINT nType, CSize size);
	void OnContextMenu(CWindow wnd, CPoint point);
	void OnCommand(UINT uNotifyCode, int nID, CWindow wndCtl);

	// WM_NOTIFY handlers

	LRESULT OnTreeImportsDoubleClick(const NMHDR* pnmh);
	LRESULT OnTreeImportsKeyDown(const NMHDR* pnmh);

	// Forwarded messages from subclassed treeview
	UINT OnTreeImportsSubclassGetDlgCode(const MSG * lpMsg);
	void OnTreeImportsSubclassChar(UINT nChar, UINT nRepCnt, UINT nFlags);

	// WM_COMMAND handlers

	void OnProcessListDrop(UINT uNotifyCode, int nID, CWindow wndCtl);
	void OnProcessListSelected(UINT uNotifyCode, int nID, CWindow wndCtl);

	void OnPickDLL(UINT uNotifyCode, int nID, CWindow wndCtl);
	void OnOptions(UINT uNotifyCode, int nID, CWindow wndCtl);
	void OnDump(UINT uNotifyCode, int nID, CWindow wndCtl);
	void OnDumpMemory(UINT uNotifyCode, int nID, CWindow wndCtl);
	+ void OnDumpSection(UINT uNotifyCode, int nID, CWindow wndCtl);
	void OnFixDump(UINT uNotifyCode, int nID, CWindow wndCtl);
	void OnPERebuild(UINT uNotifyCode, int nID, CWindow wndCtl);
	void OnDLLInject(UINT uNotifyCode, int nID, CWindow wndCtl);

	void OnIATAutoSearch(UINT uNotifyCode, int nID, CWindow wndCtl);
	void OnGetImports(UINT uNotifyCode, int nID, CWindow wndCtl);
	void OnInvalidImports(UINT uNotifyCode, int nID, CWindow wndCtl);
	void OnSuspectImports(UINT uNotifyCode, int nID, CWindow wndCtl);
	void OnClearImports(UINT uNotifyCode, int nID, CWindow wndCtl);

	void OnInvalidateSelected(UINT uNotifyCode, int nID, CWindow wndCtl);
	void OnCutSelected(UINT uNotifyCode, int nID, CWindow wndCtl);
	void OnSaveTree(UINT uNotifyCode, int nID, CWindow wndCtl);
	void OnLoadTree(UINT uNotifyCode, int nID, CWindow wndCtl);
	void OnAutotrace(UINT uNotifyCode, int nID, CWindow wndCtl);

	void OnExit(UINT uNotifyCode, int nID, CWindow wndCtl);
	void OnAbout(UINT uNotifyCode, int nID, CWindow wndCtl);

	// GUI functions

	bool showFileDialog(WCHAR * selectedFile, bool save, const WCHAR * defFileName, const WCHAR * filter = NULL, const WCHAR * defExtension = NULL, const WCHAR * directory = NULL);

	void setupStatusBar();
	void updateStatusBar();
	void fillProcessListComboBox(CComboBox& hCombo);
	void setIconAndDialogCaption();
	void enableDialogControls(BOOL value);

	CTreeItem findTreeItem(CPoint pt, bool screenCoordinates);

	// Actions

	void pickDllActionHandler();
	void pickApiActionHandler(CTreeItem item);
	void processSelectedActionHandler(int index);
	void showInvalidImportsActionHandler();
	void showSuspectImportsActionHandler();
	void deleteSelectedImportsActionHandler();
	void invalidateSelectedImportsActionHandler();
	void loadTreeActionHandler();
	void saveTreeActionHandler();
	void iatAutosearchActionHandler();
	void getImportsActionHandler();
	void dumpActionHandler();
	void dumpMemoryActionHandler();
	+ void dumpSectionActionHandler();
	void peRebuildActionHandler();
	void startDisassemblerGui(CTreeItem selectedTreeNode);
	void dumpFixActionHandler();
	void showAboutDialog();
	void dllInjectActionHandler();
	void optionsActionHandler();
	void clearImportsActionHandler();
	void pluginActionHandler(int menuItem);

	// Popup menu functions

	void SetupImportsMenuItems(CTreeItem item);
	void appendPluginListToMenu(CMenuHandle hMenuTrackPopup);
	void DisplayContextMenuImports(CWindow, CPoint);
	void DisplayContextMenuLog(CWindow, CPoint);

	// Log

	void clearOutputLog();
	bool saveLogToFile(const WCHAR * file);

	// Misc

	bool getCurrentModulePath(WCHAR * buffer, size_t bufferSize);
	};
	diff --git a/Scylla/MainGui.rc b/Scylla/MainGui.rc
	index 3806cec..b90752d 100644
	Binary files a/Scylla/MainGui.rc and b/Scylla/MainGui.rc differ
	diff --git a/Scylla/Scylla.h b/Scylla/Scylla.h
	index aff4d13..8bb0893 100644
	--- a/Scylla/Scylla.h
	+++ b/Scylla/Scylla.h
	@@ -1,31 +1,31 @@
	#pragma once

	#include "ConfigurationHolder.h"
	#include "PluginLoader.h"
	#include "ProcessLister.h"
	#include "Logger.h"

	#define APPNAME_S "Scylla"
	-#define APPVERSION_S "v0.6 Beta 2"
	+#define APPVERSION_S "v0.6 Beta 3"

	#define APPNAME TEXT(APPNAME_S)
	#define APPVERSION TEXT(APPVERSION_S)

	class Scylla
	{
	public:

	static void init();

	static ConfigurationHolder config;
	static PluginLoader plugins;

	static ProcessLister processLister;

	static FileLog debugLog;
	static ListboxLog windowLog;

	private:

	static const WCHAR DEBUG_LOG_FILENAME[];
	};
	diff --git a/Scylla/Scylla.vcxproj b/Scylla/Scylla.vcxproj
	index 7238499..d0de2f9 100644
	--- a/Scylla/Scylla.vcxproj
	+++ b/Scylla/Scylla.vcxproj
	@@ -1,248 +1,250 @@
	<?xml version="1.0" encoding="utf-8"?>
	<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
	<ItemGroup Label="ProjectConfigurations">
	<ProjectConfiguration Include="Debug\|Win32">
	<Configuration>Debug</Configuration>
	<Platform>Win32</Platform>
	</ProjectConfiguration>
	<ProjectConfiguration Include="Debug\|x64">
	<Configuration>Debug</Configuration>
	<Platform>x64</Platform>
	</ProjectConfiguration>
	<ProjectConfiguration Include="Release\|Win32">
	<Configuration>Release</Configuration>
	<Platform>Win32</Platform>
	</ProjectConfiguration>
	<ProjectConfiguration Include="Release\|x64">
	<Configuration>Release</Configuration>
	<Platform>x64</Platform>
	</ProjectConfiguration>
	</ItemGroup>
	<PropertyGroup Label="Globals">
	<ProjectGuid>{710434C9-FC4B-4F1D-B318-E10ADC78499F}</ProjectGuid>
	<Keyword>Win32Proj</Keyword>
	<RootNamespace>Scylla</RootNamespace>
	</PropertyGroup>
	<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
	<PropertyGroup Condition="'$(Configuration)\|$(Platform)'=='Debug\|Win32'" Label="Configuration">
	<ConfigurationType>Application</ConfigurationType>
	<UseDebugLibraries>true</UseDebugLibraries>
	<CharacterSet>Unicode</CharacterSet>
	<PlatformToolset>v90</PlatformToolset>
	</PropertyGroup>
	<PropertyGroup Condition="'$(Configuration)\|$(Platform)'=='Debug\|x64'" Label="Configuration">
	<ConfigurationType>Application</ConfigurationType>
	<UseDebugLibraries>true</UseDebugLibraries>
	<CharacterSet>Unicode</CharacterSet>
	</PropertyGroup>
	<PropertyGroup Condition="'$(Configuration)\|$(Platform)'=='Release\|Win32'" Label="Configuration">
	<ConfigurationType>Application</ConfigurationType>
	<UseDebugLibraries>false</UseDebugLibraries>
	<WholeProgramOptimization>true</WholeProgramOptimization>
	<CharacterSet>Unicode</CharacterSet>
	<PlatformToolset>v90</PlatformToolset>
	</PropertyGroup>
	<PropertyGroup Condition="'$(Configuration)\|$(Platform)'=='Release\|x64'" Label="Configuration">
	<ConfigurationType>Application</ConfigurationType>
	<UseDebugLibraries>false</UseDebugLibraries>
	<WholeProgramOptimization>true</WholeProgramOptimization>
	<CharacterSet>Unicode</CharacterSet>
	</PropertyGroup>
	<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
	<ImportGroup Label="ExtensionSettings">
	</ImportGroup>
	<ImportGroup Label="PropertySheets" Condition="'$(Configuration)\|$(Platform)'=='Debug\|Win32'">
	<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
	</ImportGroup>
	<ImportGroup Condition="'$(Configuration)\|$(Platform)'=='Debug\|x64'" Label="PropertySheets">
	<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
	</ImportGroup>
	<ImportGroup Label="PropertySheets" Condition="'$(Configuration)\|$(Platform)'=='Release\|Win32'">
	<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
	</ImportGroup>
	<ImportGroup Condition="'$(Configuration)\|$(Platform)'=='Release\|x64'" Label="PropertySheets">
	<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
	</ImportGroup>
	<PropertyGroup Label="UserMacros" />
	<PropertyGroup Condition="'$(Configuration)\|$(Platform)'=='Debug\|Win32'">
	<LinkIncremental>true</LinkIncremental>
	<OutDir>$(SolutionDir)$(Platform)\$(Configuration)\</OutDir>
	<IntDir>$(Platform)\$(Configuration)\</IntDir>
	<IncludePath>$(SolutionDir)WTL81_9127_Include;$(IncludePath)</IncludePath>
	</PropertyGroup>
	<PropertyGroup Condition="'$(Configuration)\|$(Platform)'=='Debug\|x64'">
	<LinkIncremental>true</LinkIncremental>
	<IncludePath>$(SolutionDir)WTL81_9127_Include;$(IncludePath)</IncludePath>
	</PropertyGroup>
	<PropertyGroup Condition="'$(Configuration)\|$(Platform)'=='Release\|Win32'">
	<LinkIncremental>false</LinkIncremental>
	<OutDir>$(SolutionDir)$(Platform)\$(Configuration)\</OutDir>
	<IntDir>$(Platform)\$(Configuration)\</IntDir>
	<IncludePath>$(SolutionDir)WTL81_9127_Include;$(IncludePath)</IncludePath>
	</PropertyGroup>
	<PropertyGroup Condition="'$(Configuration)\|$(Platform)'=='Release\|x64'">
	<LinkIncremental>false</LinkIncremental>
	<IncludePath>$(SolutionDir)WTL81_9127_Include;$(IncludePath)</IncludePath>
	</PropertyGroup>
	<ItemDefinitionGroup Condition="'$(Configuration)\|$(Platform)'=='Debug\|Win32'">
	<ClCompile>
	<PrecompiledHeader>
	</PrecompiledHeader>
	<WarningLevel>Level3</WarningLevel>
	<Optimization>Disabled</Optimization>
	<PreprocessorDefinitions>WIN32;_DEBUG;_WINDOWS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
	<AdditionalIncludeDirectories>$(SolutionDir)tinyxml;$(SolutionDir)diStorm\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
	</ClCompile>
	<Link>
	<SubSystem>Windows</SubSystem>
	<GenerateDebugInformation>true</GenerateDebugInformation>
	<AdditionalDependencies>$(SolutionDir)$(Platform)\$(Configuration)\diStorm.lib;$(SolutionDir)$(Platform)\$(Configuration)\tinyxml.lib;%(AdditionalDependencies)</AdditionalDependencies>
	<AdditionalManifestDependencies>type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='*' publicKeyToken='6595b64144ccf1df' </AdditionalManifestDependencies>
	<GenerateMapFile>true</GenerateMapFile>
	<MapFileName>$(TargetDir)$(TargetName).map</MapFileName>
	</Link>
	</ItemDefinitionGroup>
	<ItemDefinitionGroup Condition="'$(Configuration)\|$(Platform)'=='Debug\|x64'">
	<ClCompile>
	<PrecompiledHeader>
	</PrecompiledHeader>
	<WarningLevel>Level3</WarningLevel>
	<Optimization>Disabled</Optimization>
	<PreprocessorDefinitions>WIN32;_DEBUG;_WINDOWS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
	<AdditionalIncludeDirectories>$(SolutionDir)tinyxml;$(SolutionDir)diStorm\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
	</ClCompile>
	<Link>
	<SubSystem>Windows</SubSystem>
	<GenerateDebugInformation>true</GenerateDebugInformation>
	<AdditionalDependencies>$(SolutionDir)$(Platform)\$(Configuration)\diStorm.lib;$(SolutionDir)$(Platform)\$(Configuration)\tinyxml.lib;%(AdditionalDependencies)</AdditionalDependencies>
	<AdditionalManifestDependencies>type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='*' publicKeyToken='6595b64144ccf1df' </AdditionalManifestDependencies>
	</Link>
	</ItemDefinitionGroup>
	<ItemDefinitionGroup Condition="'$(Configuration)\|$(Platform)'=='Release\|Win32'">
	<ClCompile>
	<WarningLevel>Level3</WarningLevel>
	<PrecompiledHeader>
	</PrecompiledHeader>
	<Optimization>MaxSpeed</Optimization>
	<FunctionLevelLinking>true</FunctionLevelLinking>
	<IntrinsicFunctions>true</IntrinsicFunctions>
	<PreprocessorDefinitions>WIN32;NDEBUG;_WINDOWS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
	<RuntimeLibrary>MultiThreaded</RuntimeLibrary>
	<AdditionalIncludeDirectories>$(SolutionDir)tinyxml;$(SolutionDir)diStorm\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
	<MinimalRebuild>true</MinimalRebuild>
	<FavorSizeOrSpeed>Speed</FavorSizeOrSpeed>
	</ClCompile>
	<Link>
	<SubSystem>Windows</SubSystem>
	<GenerateDebugInformation>false</GenerateDebugInformation>
	<EnableCOMDATFolding>true</EnableCOMDATFolding>
	<OptimizeReferences>true</OptimizeReferences>
	<AdditionalDependencies>$(SolutionDir)$(Platform)\$(Configuration)\diStorm.lib;$(SolutionDir)$(Platform)\$(Configuration)\tinyxml.lib;%(AdditionalDependencies)</AdditionalDependencies>
	<AdditionalManifestDependencies>type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='*' publicKeyToken='6595b64144ccf1df' </AdditionalManifestDependencies>
	</Link>
	</ItemDefinitionGroup>
	<ItemDefinitionGroup Condition="'$(Configuration)\|$(Platform)'=='Release\|x64'">
	<ClCompile>
	<WarningLevel>Level3</WarningLevel>
	<PrecompiledHeader>
	</PrecompiledHeader>
	<Optimization>MaxSpeed</Optimization>
	<FunctionLevelLinking>true</FunctionLevelLinking>
	<IntrinsicFunctions>true</IntrinsicFunctions>
	<PreprocessorDefinitions>WIN32;NDEBUG;_WINDOWS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
	<RuntimeLibrary>MultiThreaded</RuntimeLibrary>
	<AdditionalIncludeDirectories>$(SolutionDir)tinyxml;$(SolutionDir)diStorm\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
	<MinimalRebuild>true</MinimalRebuild>
	</ClCompile>
	<Link>
	<SubSystem>Windows</SubSystem>
	<GenerateDebugInformation>false</GenerateDebugInformation>
	<EnableCOMDATFolding>true</EnableCOMDATFolding>
	<OptimizeReferences>true</OptimizeReferences>
	<AdditionalDependencies>$(SolutionDir)$(Platform)\$(Configuration)\diStorm.lib;$(SolutionDir)$(Platform)\$(Configuration)\tinyxml.lib;%(AdditionalDependencies)</AdditionalDependencies>
	<AdditionalManifestDependencies>type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='*' publicKeyToken='6595b64144ccf1df' </AdditionalManifestDependencies>
	</Link>
	</ItemDefinitionGroup>
	<ItemGroup>
	<ClCompile Include="AboutGui.cpp" />
	<ClCompile Include="ApiReader.cpp" />
	<ClCompile Include="Architecture.cpp" />
	<ClCompile Include="Configuration.cpp" />
	<ClCompile Include="ConfigurationHolder.cpp" />
	<ClCompile Include="DeviceNameResolver.cpp" />
	<ClCompile Include="DisassemblerGui.cpp" />
	<ClCompile Include="DllInjection.cpp" />
	<ClCompile Include="DllInjectionPlugin.cpp" />
	<ClCompile Include="DumpMemoryGui.cpp" />
	+ <ClCompile Include="DumpSectionGui.cpp" />
	<ClCompile Include="IATSearch.cpp" />
	<ClCompile Include="ImportRebuild.cpp" />
	<ClCompile Include="ImportsHandling.cpp" />
	<ClCompile Include="Logger.cpp" />
	<ClCompile Include="main.cpp" />
	<ClCompile Include="MainGui.cpp" />
	<ClCompile Include="NativeWinApi.cpp" />
	<ClCompile Include="OptionsGui.cpp" />
	<ClCompile Include="PeDump.cpp" />
	<ClCompile Include="PeRebuild.cpp" />
	<ClCompile Include="PickApiGui.cpp" />
	<ClCompile Include="PickDllGui.cpp" />
	<ClCompile Include="PluginLoader.cpp" />
	<ClCompile Include="ProcessAccessHelp.cpp" />
	<ClCompile Include="ProcessLister.cpp" />
	<ClCompile Include="Scylla.cpp" />
	<ClCompile Include="StringConversion.cpp" />
	<ClCompile Include="SystemInformation.cpp" />
	<ClCompile Include="TreeImportExport.cpp" />
	</ItemGroup>
	<ItemGroup>
	<ClInclude Include="AboutGui.h" />
	<ClInclude Include="ApiReader.h" />
	<ClInclude Include="Architecture.h" />
	<ClInclude Include="Configuration.h" />
	<ClInclude Include="ConfigurationHolder.h" />
	<ClInclude Include="DeviceNameResolver.h" />
	<ClInclude Include="DisassemblerGui.h" />
	<ClInclude Include="DllInjection.h" />
	<ClInclude Include="DllInjectionPlugin.h" />
	<ClInclude Include="DumpMemoryGui.h" />
	+ <ClInclude Include="DumpSectionGui.h" />
	<ClInclude Include="hexedit.h" />
	<ClInclude Include="IATSearch.h" />
	<ClInclude Include="ImportRebuild.h" />
	<ClInclude Include="ImportsHandling.h" />
	<ClInclude Include="Logger.h" />
	<ClInclude Include="MainGui.h" />
	<ClInclude Include="multitree.h" />
	<ClInclude Include="NativeWinApi.h" />
	<ClInclude Include="OptionsGui.h" />
	<ClInclude Include="PeDump.h" />
	<ClInclude Include="PeRebuild.h" />
	<ClInclude Include="PickApiGui.h" />
	<ClInclude Include="PickDllGui.h" />
	<ClInclude Include="PluginLoader.h" />
	<ClInclude Include="ProcessAccessHelp.h" />
	<ClInclude Include="ProcessLister.h" />
	<ClInclude Include="resource.h" />
	<ClInclude Include="Scylla.h" />
	<ClInclude Include="StringConversion.h" />
	<ClInclude Include="SystemInformation.h" />
	<ClInclude Include="Thunks.h" />
	<ClInclude Include="TreeImportExport.h" />
	</ItemGroup>
	<ItemGroup>
	<ResourceCompile Include="MainGui.rc" />
	</ItemGroup>
	<ItemGroup>
	<None Include="check.ico" />
	<None Include="error.ico" />
	<None Include="scylla.ico" />
	<None Include="warning.ico" />
	</ItemGroup>
	<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
	<ImportGroup Label="ExtensionTargets">
	</ImportGroup>
	<ProjectExtensions>
	<VisualStudio>
	<UserProperties RESOURCE_FILE="MainGui.rc" />
	</VisualStudio>
	</ProjectExtensions>
	</Project>
	\ No newline at end of file
	diff --git a/Scylla/resource.h b/Scylla/resource.h
	index aeddc30..8281203 100644
	Binary files a/Scylla/resource.h and b/Scylla/resource.h differ

File Metadata

Mime Type: text/x-diff
Expires: Tue, Jun 17, 1:13 AM (19 h, 3 m)
Storage Engine: local-disk
Storage Format: Raw Data
Storage Handle: 61/0f/147387c87a25c016d63ea4928ded

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions