diff --git a/Scylla/ApiReader.cpp b/Scylla/ApiReader.cpp
index 2794fb9..340878c 100644
--- a/Scylla/ApiReader.cpp
+++ b/Scylla/ApiReader.cpp
@@ -1,1183 +1,1186 @@
 
 #include "ApiReader.h"
 
 #include "Scylla.h"
 #include "Architecture.h"
 #include "SystemInformation.h"
 #include "StringConversion.h"
 
 stdext::hash_multimap<DWORD_PTR, ApiInfo *> ApiReader::apiList; //api look up table
 std::map<DWORD_PTR, ImportModuleThunk> *  ApiReader::moduleThunkList; //store found apis
 
 DWORD_PTR ApiReader::minApiAddress = 0xFFFFFFFF;
 DWORD_PTR ApiReader::maxApiAddress = 0;
 
 //#define DEBUG_COMMENTS
 
 void ApiReader::readApisFromModuleList()
 {
 	for (unsigned int i = 0; i < moduleList.size();i++)
 	{
 		setModulePriority(&moduleList[i]);
 
 		if (moduleList[i].modBaseAddr + moduleList[i].modBaseSize > maxValidAddress)
 		{
 			maxValidAddress = moduleList[i].modBaseAddr + moduleList[i].modBaseSize;
 		}
 
 		Scylla::windowLog.log(L"Module parsing: %s",moduleList[i].fullPath);
 
 		if (!moduleList[i].isAlreadyParsed)
 		{
 			parseModule(&moduleList[i]);
 		}
 	}
 
 #ifdef DEBUG_COMMENTS
 	Scylla::debugLog.log(L"Address Min " PRINTF_DWORD_PTR_FULL L" Max " PRINTF_DWORD_PTR_FULL L"\nimagebase " PRINTF_DWORD_PTR_FULL L" maxValidAddress " PRINTF_DWORD_PTR_FULL, minApiAddress, maxApiAddress, targetImageBase ,maxValidAddress);
 #endif
 }
 
 void ApiReader::parseModule(ModuleInfo *module)
 {
 	module->parsing = true;
 
 	if (isWinSxSModule(module))
 	{
 		parseModuleWithMapping(module);
 	}
 	else if (isModuleLoadedInOwnProcess(module))
 	{
 		parseModuleWithOwnProcess(module);
 	}
 	else
 	{
 		parseModuleWithProcess(module);
 	}
 	
 	module->isAlreadyParsed = true;
 }
 
 void ApiReader::parseModuleWithMapping(ModuleInfo *moduleInfo)
 {
 	LPVOID fileMapping = 0;
 	PIMAGE_NT_HEADERS pNtHeader = 0;
 	PIMAGE_DOS_HEADER pDosHeader = 0;
 
 	fileMapping = createFileMappingViewRead(moduleInfo->fullPath);
 
 	if (fileMapping == 0)
 		return;
 
 	pDosHeader = (PIMAGE_DOS_HEADER)fileMapping;
 	pNtHeader = (PIMAGE_NT_HEADERS)((DWORD_PTR)fileMapping + (DWORD_PTR)(pDosHeader->e_lfanew));
 
 	if (isPeAndExportTableValid(pNtHeader))
 	{
 		parseExportTable(moduleInfo, pNtHeader, (PIMAGE_EXPORT_DIRECTORY)((DWORD_PTR)fileMapping + pNtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress), (DWORD_PTR)fileMapping);
 	}
 
 
 	UnmapViewOfFile(fileMapping);
 
 }
 
 inline bool ApiReader::isApiForwarded(DWORD_PTR rva, PIMAGE_NT_HEADERS pNtHeader)
 {
 	if ((rva > pNtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress) && (rva < (pNtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress + pNtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].Size)))
 	{
 		return true;
 	}
 	else
 	{
 		return false;
 	}
 }
 
 void ApiReader::handleForwardedApi(DWORD_PTR vaStringPointer,char * functionNameParent, DWORD_PTR rvaParent, WORD ordinalParent, ModuleInfo *moduleParent)
 {
 	size_t dllNameLength = 0;
 	WORD ordinal = 0;
 	ModuleInfo *module = 0;
 	DWORD_PTR vaApi = 0;
 	DWORD_PTR rvaApi = 0;
 	char dllName[100] = {0};
 	WCHAR dllNameW[100] = {0};
 	char *fordwardedString = (char *)vaStringPointer;
 	char *searchFunctionName = strchr(fordwardedString, '.');
 	
 
 	if (!searchFunctionName)
 		return;
 
 	dllNameLength = searchFunctionName - fordwardedString;
 
 	if (dllNameLength >= 99)
 	{
 		return;
 	}
 	else
 	{
 		strncpy_s(dllName, fordwardedString, dllNameLength);
 	}
 
 	searchFunctionName++;
 
 	//Windows 7
 	if (!strncmp(dllName,"api-ms-win-", 11))
 	{
 		/* 
 		    Info: http://www.nirsoft.net/articles/windows_7_kernel_architecture_changes.html
 		*/
 
 		FARPROC addy = GetProcAddress(GetModuleHandleA(dllName), searchFunctionName);
 
 		if (addy != 0)
 		{
 			addApi(functionNameParent,0, ordinalParent, (DWORD_PTR)addy, (DWORD_PTR)addy - (DWORD_PTR)GetModuleHandleA(dllName), true, moduleParent);
 		}
 
 		return;
 	}
 
 	strcat_s(dllName, ".dll");
 	
 	StringConversion::ToUTF16(dllName, dllNameW, _countof(dllNameW));
 	
 	if (!_wcsicmp(dllNameW, moduleParent->getFilename()))
 	{
 		module = moduleParent;
 	}
 	else
 	{
 		module = findModuleByName(dllNameW);
 	}
 
 	if (module != 0) // module == 0 -> can be ignored
 	{
 		/*if ((module->isAlreadyParsed == false) && (module != moduleParent))
 		{
 			//do API extract
 			
 			if (module->parsing == true)
 			{
 				//some stupid circle dependency
 				printf("stupid circle dependency %s\n",module->getFilename());
 			}
 			else
 			{
 				parseModule(module);
 			}
 		}*/
 
 		if (strchr(searchFunctionName,'#'))
 		{
 			//forwarding by ordinal
 			searchFunctionName++;
 			ordinal = (WORD)atoi(searchFunctionName);
 			findApiByModuleAndOrdinal(module, ordinal, &vaApi, &rvaApi);
 		}
 		else
 		{
 			findApiByModuleAndName(module, searchFunctionName, &vaApi, &rvaApi);
 		}
 
 		if (rvaApi == 0)
 		{
 #ifdef DEBUG_COMMENTS
 			Scylla::debugLog.log(L"handleForwardedApi :: Api not found, this is really BAD! %S",fordwardedString);
 #endif
 		}
 		else
 		{
 			addApi(functionNameParent,0, ordinalParent, vaApi, rvaApi, true, moduleParent);
 		}
 	}
 
 }
 
 ModuleInfo * ApiReader::findModuleByName(WCHAR *name)
 {
 	for (unsigned int i = 0; i < moduleList.size(); i++) {
 		if (!_wcsicmp(moduleList[i].getFilename(), name))
 		{
 			return &moduleList[i];
 		}
 	}
 
 	return 0;
 }
 
 void ApiReader::addApiWithoutName(WORD ordinal, DWORD_PTR va, DWORD_PTR rva,bool isForwarded, ModuleInfo *moduleInfo)
 {
 	addApi(0, 0, ordinal, va, rva, isForwarded, moduleInfo);
 }
 
 void ApiReader::addApi(char *functionName, WORD hint, WORD ordinal, DWORD_PTR va, DWORD_PTR rva, bool isForwarded, ModuleInfo *moduleInfo)
 {
 	ApiInfo *apiInfo = new ApiInfo();
 
 	if ((functionName != 0) && (strlen(functionName) < _countof(apiInfo->name)))
 	{
 		strcpy_s(apiInfo->name, functionName);
 	}
 	else
 	{
 		apiInfo->name[0] = 0x00;
 	}
 
 	apiInfo->ordinal = ordinal;
 	apiInfo->isForwarded = isForwarded;
 	apiInfo->module = moduleInfo;
 	apiInfo->rva = rva;
 	apiInfo->va = va;
 	apiInfo->hint = hint;
 
 	setMinMaxApiAddress(va);
 
 	moduleInfo->apiList.push_back(apiInfo);
 
 	apiList.insert(API_Pair(va, apiInfo));
 }
 
 BYTE * ApiReader::getHeaderFromProcess(ModuleInfo * module)
 {
 	BYTE *bufferHeader = 0;
 	DWORD readSize = 0;
 
 	if (module->modBaseSize < PE_HEADER_BYTES_COUNT)
 	{
 		readSize = module->modBaseSize;
 	}
 	else
 	{
 		readSize = PE_HEADER_BYTES_COUNT;
 	}
 
 	bufferHeader = new BYTE[readSize];
 
 	if(!readMemoryFromProcess(module->modBaseAddr, readSize, bufferHeader))
 	{
 #ifdef DEBUG_COMMENTS
 		Scylla::debugLog.log(L"getHeaderFromProcess :: Error reading header");
 #endif
 		delete[] bufferHeader;
 		return 0;
 	}
 	else
 	{
 		return bufferHeader;
 	}
 }
 
 BYTE * ApiReader::getExportTableFromProcess(ModuleInfo * module, PIMAGE_NT_HEADERS pNtHeader)
 {
 	DWORD readSize = 0;
 	BYTE *bufferExportTable = 0;
 
 	readSize = pNtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].Size;
 
 	if (readSize < (sizeof(IMAGE_EXPORT_DIRECTORY) + 8))
 	{
 		//Something is wrong with the PE Header
 #ifdef DEBUG_COMMENTS
 		Scylla::debugLog.log(L"Something is wrong with the PE Header here Export table size %d", readSize);
 #endif
 		readSize = sizeof(IMAGE_EXPORT_DIRECTORY) + 100;
 	}
 
 	if (readSize)
 	{
 		bufferExportTable = new BYTE[readSize];
 
 		if(!readMemoryFromProcess(module->modBaseAddr + pNtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress, readSize, bufferExportTable))
 		{
 #ifdef DEBUG_COMMENTS
 			Scylla::debugLog.log(L"getExportTableFromProcess :: Error reading export table from process");
 #endif
 			delete[] bufferExportTable;
 			return 0;
 		}
 		else
 		{
 			return bufferExportTable;
 		}
 	}
 	else
 	{
 		return 0;
 	}
 }
 
 void ApiReader::parseModuleWithProcess(ModuleInfo * module)
 {
 	PIMAGE_NT_HEADERS pNtHeader = 0;
 	PIMAGE_DOS_HEADER pDosHeader = 0;
 	BYTE *bufferHeader = 0;
 	BYTE *bufferExportTable = 0;
 
 
 	bufferHeader = getHeaderFromProcess(module);
 
 	if (bufferHeader == 0)
 		return;
 
 	pDosHeader = (PIMAGE_DOS_HEADER)bufferHeader;
 	pNtHeader = (PIMAGE_NT_HEADERS)((DWORD_PTR)bufferHeader + (DWORD_PTR)(pDosHeader->e_lfanew));
 
 	if (isPeAndExportTableValid(pNtHeader))
 	{
 		bufferExportTable = getExportTableFromProcess(module, pNtHeader);
 
 		if(bufferExportTable)
 		{
 			parseExportTable(module,pNtHeader,(PIMAGE_EXPORT_DIRECTORY)bufferExportTable, (DWORD_PTR)bufferExportTable - pNtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress);
 			delete[] bufferExportTable;
 		}
 	}
 
 	delete[] bufferHeader;
 }
 
 void ApiReader::parseExportTable(ModuleInfo *module, PIMAGE_NT_HEADERS pNtHeader, PIMAGE_EXPORT_DIRECTORY pExportDir, DWORD_PTR deltaAddress)
 {
 	DWORD *addressOfFunctionsArray = 0,*addressOfNamesArray = 0;
 	WORD *addressOfNameOrdinalsArray = 0;
 	char *functionName = 0;
 	DWORD_PTR RVA = 0, VA = 0;
 	WORD ordinal = 0;
 	WORD i = 0, j = 0;
 	bool withoutName;
 
 
 	addressOfFunctionsArray = (DWORD *)((DWORD_PTR)pExportDir->AddressOfFunctions + deltaAddress);
 	addressOfNamesArray = (DWORD *)((DWORD_PTR)pExportDir->AddressOfNames + deltaAddress);
 	addressOfNameOrdinalsArray = (WORD *)((DWORD_PTR)pExportDir->AddressOfNameOrdinals + deltaAddress);
 
 #ifdef DEBUG_COMMENTS
 	Scylla::debugLog.log(L"parseExportTable :: module %s NumberOfNames %X", module->fullPath, pExportDir->NumberOfNames);
 #endif
 
 	for (i = 0; i < pExportDir->NumberOfNames; i++)
 	{
 		functionName = (char*)(addressOfNamesArray[i] + deltaAddress);
 		ordinal = (WORD)(addressOfNameOrdinalsArray[i] + pExportDir->Base);
 		RVA = addressOfFunctionsArray[addressOfNameOrdinalsArray[i]];
 		VA = addressOfFunctionsArray[addressOfNameOrdinalsArray[i]] + module->modBaseAddr;
 
 #ifdef DEBUG_COMMENTS
 		Scylla::debugLog.log(L"parseExportTable :: api %S ordinal %d imagebase " PRINTF_DWORD_PTR_FULL L" RVA " PRINTF_DWORD_PTR_FULL L" VA " PRINTF_DWORD_PTR_FULL, functionName, ordinal, module->modBaseAddr, RVA, VA);
 #endif
 		if (!isApiBlacklisted(functionName))
 		{
 			if (!isApiForwarded(RVA,pNtHeader))
 			{
 				addApi(functionName, i, ordinal,VA,RVA,false,module);
 			}
 			else
 			{
 				//printf("Forwarded: %s\n",functionName);
 				handleForwardedApi(RVA + deltaAddress,functionName,RVA,ordinal,module);
 			}
 		}
 
 	}
 
 	/*Exports without name*/
 	if (pExportDir->NumberOfNames != pExportDir->NumberOfFunctions)
 	{
 		for (i = 0; i < pExportDir->NumberOfFunctions; i++)
 		{
 			withoutName = true;
 			for (j = 0; j < pExportDir->NumberOfNames; j++)
 			{
 				if(addressOfNameOrdinalsArray[j] == i)
 				{
 					withoutName = false;
 					break;
 				}
 			}
 			if (withoutName && addressOfFunctionsArray[i] != 0)
 			{
 				ordinal = (WORD)(i+pExportDir->Base);
 				RVA = addressOfFunctionsArray[i];
 				VA = (addressOfFunctionsArray[i] + module->modBaseAddr);
 
 
 				if (!isApiForwarded(RVA,pNtHeader))
 				{
 					addApiWithoutName(ordinal,VA,RVA,false,module);
 				}
 				else
 				{
 					handleForwardedApi(RVA + deltaAddress,0,RVA,ordinal,module);
 				}
 
 			}
 		}
 	}
 }
 
 void ApiReader::findApiByModuleAndOrdinal(ModuleInfo * module, WORD ordinal, DWORD_PTR * vaApi, DWORD_PTR * rvaApi)
 {
 	findApiByModule(module,0,ordinal,vaApi,rvaApi);
 }
 
 void ApiReader::findApiByModuleAndName(ModuleInfo * module, char * searchFunctionName, DWORD_PTR * vaApi, DWORD_PTR * rvaApi)
 {
 	findApiByModule(module,searchFunctionName,0,vaApi,rvaApi);
 }
 
 void ApiReader::findApiByModule(ModuleInfo * module, char * searchFunctionName, WORD ordinal, DWORD_PTR * vaApi, DWORD_PTR * rvaApi)
 {
 	if (isModuleLoadedInOwnProcess(module))
 	{
 		HMODULE hModule = GetModuleHandle(module->getFilename());
 
 		if (hModule)
 		{
 			if (vaApi)
 			{
 				if (ordinal)
 				{
 					*vaApi = (DWORD_PTR)GetProcAddress(hModule, (LPCSTR)ordinal);
 				}
 				else
 				{
 					*vaApi = (DWORD_PTR)GetProcAddress(hModule, searchFunctionName);
 				}
 
 				*rvaApi = (*vaApi) - (DWORD_PTR)hModule;
 				*vaApi = (*rvaApi) + module->modBaseAddr;
 			}
 			else
 			{
 #ifdef DEBUG_COMMENTS
 				Scylla::debugLog.log(L"findApiByModule :: vaApi == NULL, should never happen %S", searchFunctionName);
 #endif
 			}
 		}
 		else
 		{
 #ifdef DEBUG_COMMENTS
 			Scylla::debugLog.log(L"findApiByModule :: hModule == NULL, should never happen %s", module->getFilename());
 #endif
 		}
 	}
 	else
 	{
 		//search api in extern process
 		findApiInProcess(module,searchFunctionName,ordinal,vaApi,rvaApi);
 	}
 }
 
 bool ApiReader::isModuleLoadedInOwnProcess(ModuleInfo * module)
 {
 	for (unsigned int i = 0; i < ownModuleList.size(); i++)
 	{
 		if (!_wcsicmp(module->fullPath, ownModuleList[i].fullPath))
 		{
 			//printf("isModuleLoadedInOwnProcess :: %s %s\n",module->fullPath,ownModuleList[i].fullPath);
 			return true;
 		}
 	}
 	return false;
 }
 
 void ApiReader::parseModuleWithOwnProcess( ModuleInfo * module )
 {
 	PIMAGE_NT_HEADERS pNtHeader = 0;
 	PIMAGE_DOS_HEADER pDosHeader = 0;
 	HMODULE hModule = GetModuleHandle(module->getFilename());
 
 	if (hModule)
 	{
 		pDosHeader = (PIMAGE_DOS_HEADER)hModule;
 		pNtHeader = (PIMAGE_NT_HEADERS)((DWORD_PTR)hModule + (DWORD_PTR)(pDosHeader->e_lfanew));
 
 		if (isPeAndExportTableValid(pNtHeader))
 		{
 			parseExportTable(module, pNtHeader, (PIMAGE_EXPORT_DIRECTORY)((DWORD_PTR)hModule + pNtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress), (DWORD_PTR)hModule);
 		}
 	}
 	else
 	{
 #ifdef DEBUG_COMMENTS
 		Scylla::debugLog.log(L"parseModuleWithOwnProcess :: hModule is NULL");
 #endif
 	}
 }
 
 bool ApiReader::isPeAndExportTableValid(PIMAGE_NT_HEADERS pNtHeader)
 {
 	if (pNtHeader->Signature != IMAGE_NT_SIGNATURE)
 	{
 		Scylla::windowLog.log(L"-> IMAGE_NT_SIGNATURE doesn't match.");
 		return false;
 	}
 	else if ((pNtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress == 0) || (pNtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].Size == 0))
 	{
 		Scylla::windowLog.log(L"-> No export table.");
 		return false;
 	}
 	else
 	{
 		return true;
 	}
 }
 
 void ApiReader::findApiInProcess(ModuleInfo * module, char * searchFunctionName, WORD ordinal, DWORD_PTR * vaApi, DWORD_PTR * rvaApi)
 {
 	PIMAGE_NT_HEADERS pNtHeader = 0;
 	PIMAGE_DOS_HEADER pDosHeader = 0;
 	BYTE *bufferHeader = 0;
 	BYTE *bufferExportTable = 0;
 
 
 	bufferHeader = getHeaderFromProcess(module);
 
 	if (bufferHeader == 0)
 		return;
 
 	pDosHeader = (PIMAGE_DOS_HEADER)bufferHeader;
 	pNtHeader = (PIMAGE_NT_HEADERS)((DWORD_PTR)bufferHeader + (DWORD_PTR)(pDosHeader->e_lfanew));
 
 	if (isPeAndExportTableValid(pNtHeader))
 	{
 		bufferExportTable = getExportTableFromProcess(module, pNtHeader);
 
 		if(bufferExportTable)
 		{
 			findApiInExportTable(module,(PIMAGE_EXPORT_DIRECTORY)bufferExportTable, (DWORD_PTR)bufferExportTable - pNtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress,searchFunctionName,ordinal,vaApi,rvaApi);
 			delete[] bufferExportTable;
 		}
 	}
 
 	delete[] bufferHeader;
 }
 
 bool ApiReader::findApiInExportTable(ModuleInfo *module, PIMAGE_EXPORT_DIRECTORY pExportDir, DWORD_PTR deltaAddress, char * searchFunctionName, WORD ordinal, DWORD_PTR * vaApi, DWORD_PTR * rvaApi)
 {
 	DWORD *addressOfFunctionsArray = 0,*addressOfNamesArray = 0;
 	WORD *addressOfNameOrdinalsArray = 0;
 	char *functionName = 0;
 	DWORD i = 0, j = 0;
 
 	addressOfFunctionsArray = (DWORD *)((DWORD_PTR)pExportDir->AddressOfFunctions + deltaAddress);
 	addressOfNamesArray = (DWORD *)((DWORD_PTR)pExportDir->AddressOfNames + deltaAddress);
 	addressOfNameOrdinalsArray = (WORD *)((DWORD_PTR)pExportDir->AddressOfNameOrdinals + deltaAddress);
 
 	if (searchFunctionName)
 	{
 		for (i = 0; i < pExportDir->NumberOfNames; i++)
 		{
 			functionName = (char*)(addressOfNamesArray[i] + deltaAddress);
 
 			if (!strcmp(functionName,searchFunctionName))
 			{
 				*rvaApi = addressOfFunctionsArray[addressOfNameOrdinalsArray[i]];
 				*vaApi = addressOfFunctionsArray[addressOfNameOrdinalsArray[i]] + module->modBaseAddr;
 				return true;
 			}
 		}
 	}
 	else
 	{
 		for (i = 0; i < pExportDir->NumberOfFunctions; i++)
 		{
 			if (ordinal == (i+pExportDir->Base))
 			{
 				*rvaApi = addressOfFunctionsArray[i];
 				*vaApi = (addressOfFunctionsArray[i] + module->modBaseAddr);
 				return true;
 			}
 		}
 	}
 
 	return false;
 }
 
 
 void ApiReader::setModulePriority(ModuleInfo * module)
 {
 	const WCHAR *moduleFileName = module->getFilename();
 
 	//imports by kernelbase don't exist
 	if (!_wcsicmp(moduleFileName, L"kernelbase.dll"))
 	{
 		module->priority = -1;
 	}
 	else if (!_wcsicmp(moduleFileName, L"ntdll.dll"))
 	{
 		module->priority = 0;
 	}
 	else if (!_wcsicmp(moduleFileName, L"shlwapi.dll"))
 	{
 		module->priority = 0;
 	}
 	else if (!_wcsicmp(moduleFileName, L"ShimEng.dll"))
 	{
 		module->priority = 0;
 	}
 	else if (!_wcsicmp(moduleFileName, L"kernel32.dll"))
 	{
 		module->priority = 2;
 	}
 	else
 	{
 		module->priority = 1;
 	}
 }
 
 bool ApiReader::isApiAddressValid(DWORD_PTR virtualAddress)
 {
 	return apiList.count(virtualAddress) > 0;
 }
 
 ApiInfo * ApiReader::getApiByVirtualAddress(DWORD_PTR virtualAddress, bool * isSuspect)
 {
 	stdext::hash_multimap<DWORD_PTR, ApiInfo *>::iterator it1, it2;
 	size_t c = 0;
 	size_t countDuplicates = apiList.count(virtualAddress);
 	int countHighPriority = 0;
 	ApiInfo *apiFound = 0;
 
 
 	if (countDuplicates == 0)
 	{
-		Scylla::windowLog.log(L"getApiByVirtualAddress :: No Api found " PRINTF_DWORD_PTR_FULL, virtualAddress);
 		return 0;
 	}
 	else if (countDuplicates == 1)
 	{
 		//API is 100% correct
 		*isSuspect = false;
 		it1 = apiList.find(virtualAddress); // Find first match.
 		return (ApiInfo *)((*it1).second);
 	}
 	else
 	{
 		it1 = apiList.find(virtualAddress); // Find first match.
 
 		//any high priority with a name
 		apiFound = getScoredApi(it1,countDuplicates,true,false,false,true,false,false,false,false);
 
 		if (apiFound)
 			return apiFound;
 
 		*isSuspect = true;
 
 		//high priority with a name and ansi/unicode name
 		apiFound = getScoredApi(it1,countDuplicates,true,true,false,true,false,false,false,false);
 
 		if (apiFound)
 			return apiFound;
 
 		//priority 2 with no underline in name
 		apiFound = getScoredApi(it1,countDuplicates,true,false,true,false,false,false,true,false);
 
 		if (apiFound)
 			return apiFound;
 
 		//priority 1 with a name
 		apiFound = getScoredApi(it1,countDuplicates,true,false,false,false,false,true,false,false);
 
 		if (apiFound)
 			return apiFound;
 
 		//With a name
 		apiFound = getScoredApi(it1,countDuplicates,true,false,false,false,false,false,false,false);
 
 		if (apiFound)
 			return apiFound;
 
 		//any with priority, name, ansi/unicode
 		apiFound = getScoredApi(it1,countDuplicates,true,true,false,true,false,false,false,true);
 
 		if (apiFound)
 			return apiFound;
 
 		//any with priority
 		apiFound = getScoredApi(it1,countDuplicates,false,false,false,true,false,false,false,true);
 
 		if (apiFound)
 			return apiFound;
 
 		//has prio 0 and name
 		apiFound = getScoredApi(it1,countDuplicates,false,false,false,false,true,false,false,true);
 
 		if (apiFound)
 			return apiFound;
 	}
 
 	//is never reached
 	Scylla::windowLog.log(L"getApiByVirtualAddress :: There is a api resolving bug, VA: " PRINTF_DWORD_PTR_FULL, virtualAddress);
 	for (size_t c = 0; c < countDuplicates; c++, it1++)
 	{
 		apiFound = (ApiInfo *)((*it1).second);
 		Scylla::windowLog.log(L"-> Possible API: %S ord: %d ", apiFound->name, apiFound->ordinal);
 	}
 	return (ApiInfo *) 1; 
 }
 
 ApiInfo * ApiReader::getScoredApi(stdext::hash_multimap<DWORD_PTR, ApiInfo *>::iterator it1,size_t countDuplicates, bool hasName, bool hasUnicodeAnsiName, bool hasNoUnderlineInName, bool hasPrioDll,bool hasPrio0Dll,bool hasPrio1Dll, bool hasPrio2Dll, bool firstWin )
 {
 	ApiInfo * foundApi = 0;
 	ApiInfo * foundMatchingApi = 0;
 	int countFoundApis = 0;
 	int scoreNeeded = 0;
 	int scoreValue = 0;
 	size_t apiNameLength = 0;
 
 	if (hasUnicodeAnsiName || hasNoUnderlineInName)
 	{
 		hasName = true;
 	}
 
 	if (hasName)
 		scoreNeeded++;
 
 	if (hasUnicodeAnsiName)
 		scoreNeeded++;
 
 	if (hasNoUnderlineInName)
 		scoreNeeded++;
 
 	if (hasPrioDll)
 		scoreNeeded++;
 
 	if (hasPrio0Dll)
 		scoreNeeded++;
 
 	if (hasPrio1Dll)
 		scoreNeeded++;
 
 	if (hasPrio2Dll)
 		scoreNeeded++;
 
 	for (size_t c = 0; c < countDuplicates; c++, it1++)
 	{
 		foundApi = (ApiInfo *)((*it1).second);
 		scoreValue = 0;
 
 		if (hasName)
 		{
 			if (foundApi->name[0] != 0x00)
 			{
 				scoreValue++;
 
 				if (hasUnicodeAnsiName)
 				{
 					apiNameLength = strlen(foundApi->name);
 
 					if ((foundApi->name[apiNameLength - 1] == 'W') || (foundApi->name[apiNameLength - 1] == 'A'))
 					{
 						scoreValue++;
 					}
 				}
 
 				if (hasNoUnderlineInName)
 				{
 					if (!strrchr(foundApi->name, '_'))
 					{
 						scoreValue++;
 					}
 				}
 			}
 		}
 
 		if (hasPrioDll)
 		{
 			if (foundApi->module->priority >= 1)
 			{
 				scoreValue++;
 			}
 		}
 
 		if (hasPrio0Dll)
 		{
 			if (foundApi->module->priority == 0)
 			{
 				scoreValue++;
 			}
 		}
 
 		if (hasPrio1Dll)
 		{
 			if (foundApi->module->priority == 1)
 			{
 				scoreValue++;
 			}
 		}
 
 		if (hasPrio2Dll)
 		{
 			if (foundApi->module->priority == 2)
 			{
 				scoreValue++;
 			}
 		}
 
 
 		if (scoreValue == scoreNeeded)
 		{
 			foundMatchingApi = foundApi;
 			countFoundApis++;
 
 			if (firstWin)
 			{
 				return foundMatchingApi;
 			}
 		}
 	}
 
 	if (countFoundApis == 1)
 	{
 		return foundMatchingApi;
 	}
 	else
 	{
 		return (ApiInfo *)0;
 	}
 
 }
 
 void ApiReader::setMinMaxApiAddress(DWORD_PTR virtualAddress)
 {
 	if (virtualAddress < minApiAddress)
 	{
 		minApiAddress = virtualAddress - 1;
 	}
 	if (virtualAddress > maxApiAddress)
 	{
 		maxApiAddress = virtualAddress + 1;
 	}
 }
 
 void  ApiReader::readAndParseIAT(DWORD_PTR addressIAT, DWORD sizeIAT, std::map<DWORD_PTR, ImportModuleThunk> &moduleListNew)
 {
 	moduleThunkList = &moduleListNew;
 	BYTE *dataIat = new BYTE[sizeIAT];
 	if (readMemoryFromProcess(addressIAT,sizeIAT,dataIat))
 	{
 		parseIAT(addressIAT,dataIat,sizeIAT);
 	}
 	else
 	{
 #ifdef DEBUG_COMMENTS
 		Scylla::debugLog.log(L"ApiReader::readAndParseIAT :: error reading iat " PRINTF_DWORD_PTR_FULL, addressIAT);
 #endif
 	}
 
 	delete[] dataIat;
 }
 
 void ApiReader::parseIAT(DWORD_PTR addressIAT, BYTE * iatBuffer, SIZE_T size)
 {
 	ApiInfo *apiFound = 0;
 	ModuleInfo *module = 0;
 	bool isSuspect = false;
 	int countApiFound = 0, countApiNotFound = 0;
 	DWORD_PTR * pIATAddress = (DWORD_PTR *)iatBuffer;
 	SIZE_T sizeIAT = size / sizeof(DWORD_PTR);
 
 	bool foundModuleBreak = false;
 
 	for (SIZE_T i = 0; i < sizeIAT; i++)
 	{
 		//Scylla::windowLog.log(L"%08X %08X %d von %d", addressIAT + (DWORD_PTR)&pIATAddress[i] - (DWORD_PTR)iatBuffer, pIATAddress[i],i,sizeIAT);
 
 
 		if (pIATAddress[i] == 0 || pIATAddress[i] == -1)
 		{
 			/*if (pIATAddress[i+1] != 0)
 			{
 				printf("parseIAT :: Module break\n");
 			}*/
 			/*else
 			{
 				printf("parseIAT :: IAT finished\n");
 				break;
 			}*/
 			foundModuleBreak = true;
 		} 
 		else if ( (pIATAddress[i] > minApiAddress) && (pIATAddress[i] < maxApiAddress) )
 		{
 			
 			apiFound = getApiByVirtualAddress(pIATAddress[i], &isSuspect);
+			if (apiFound == 0)
+			{
+				Scylla::windowLog.log(L"getApiByVirtualAddress :: No Api found " PRINTF_DWORD_PTR_FULL, pIATAddress[i]);
+			}
 			if (apiFound == (ApiInfo *)1)
 			{
 #ifdef DEBUG_COMMENTS
 				Scylla::debugLog.log(L"apiFound == (ApiInfo *)1 -> " PRINTF_DWORD_PTR_FULL, pIATAddress[i]);
 #endif
 			}
 			else if (apiFound)
 			{
 				countApiFound++;
 #ifdef DEBUG_COMMENTS
 				Scylla::debugLog.log(PRINTF_DWORD_PTR_FULL L" %s %d %s", apiFound->va, apiFound->module->getFilename(), apiFound->ordinal, apiFound->name);
 #endif
 				if (module != apiFound->module)
 				{
 					module = apiFound->module;
 					addFoundApiToModuleList(addressIAT + (DWORD_PTR)&pIATAddress[i] - (DWORD_PTR)iatBuffer, apiFound, true, isSuspect);
 				}
 				else
 				{
 					addFoundApiToModuleList(addressIAT + (DWORD_PTR)&pIATAddress[i] - (DWORD_PTR)iatBuffer, apiFound, false, isSuspect);
 				}
 				
 			}
 			else
 			{
 				countApiNotFound++;
 				addNotFoundApiToModuleList(addressIAT + (DWORD_PTR)&pIATAddress[i] - (DWORD_PTR)iatBuffer, pIATAddress[i]);
 				//printf("parseIAT :: API not found %08X\n", pIATAddress[i]);
 			}
 		}
 		else
 		{
 			//printf("parseIAT :: API not found %08X\n", pIATAddress[i]);
 			countApiNotFound++;
 			addNotFoundApiToModuleList(addressIAT + (DWORD_PTR)&pIATAddress[i] - (DWORD_PTR)iatBuffer, pIATAddress[i]);
 		}
 	}
 
 	Scylla::windowLog.log(L"IAT parsing finished, found %d valid APIs, missed %d APIs", countApiFound, countApiNotFound);
 }
 
 void ApiReader::addFoundApiToModuleList(DWORD_PTR iatAddressVA, ApiInfo * apiFound, bool isNewModule, bool isSuspect)
 {
 	if (isNewModule)
 	{
 		addModuleToModuleList(apiFound->module->getFilename(), iatAddressVA - targetImageBase);
 	}
 	addFunctionToModuleList(apiFound, iatAddressVA, iatAddressVA - targetImageBase, apiFound->ordinal, true, isSuspect);
 }
 
 bool ApiReader::addModuleToModuleList(const WCHAR * moduleName, DWORD_PTR firstThunk)
 {
 	ImportModuleThunk module;
 
 	module.firstThunk = firstThunk;
 	wcscpy_s(module.moduleName, moduleName);
 
 	(*moduleThunkList).insert(std::pair<DWORD_PTR,ImportModuleThunk>(firstThunk,module));
 
 	return true;
 }
 
 void ApiReader::addUnknownModuleToModuleList(DWORD_PTR firstThunk)
 {
 	ImportModuleThunk module;
 
 	module.firstThunk = firstThunk;
 	wcscpy_s(module.moduleName, L"?");
 
 	(*moduleThunkList).insert(std::pair<DWORD_PTR,ImportModuleThunk>(firstThunk,module));
 }
 
 bool ApiReader::addFunctionToModuleList(ApiInfo * apiFound, DWORD_PTR va, DWORD_PTR rva, WORD ordinal, bool valid, bool suspect)
 {
 	ImportThunk import;
 	ImportModuleThunk  * module = 0;
 	std::map<DWORD_PTR, ImportModuleThunk>::iterator iterator1;
 
 	if ((*moduleThunkList).size() > 1)
 	{
 		iterator1 = (*moduleThunkList).begin();
 		while (iterator1 != (*moduleThunkList).end())
 		{
 			if (rva >= iterator1->second.firstThunk)
 			{
 				iterator1++;
 				if (iterator1 == (*moduleThunkList).end())
 				{
 					iterator1--;
 					module = &(iterator1->second);
 					break;
 				}
 				else if (rva < iterator1->second.firstThunk)
 				{
 					iterator1--;
 					module = &(iterator1->second);
 					break;
 				}
 			}
 			else
 			{
 #ifdef DEBUG_COMMENTS
 				Scylla::debugLog.log(L"Error iterator1 != (*moduleThunkList).end()");
 #endif
 				break;
 			}
 		}
 	}
 	else
 	{
 		iterator1 = (*moduleThunkList).begin();
 		module = &(iterator1->second);
 	}
 
 	if (!module)
 	{
 #ifdef DEBUG_COMMENTS
 		Scylla::debugLog.log(L"ImportsHandling::addFunction module not found rva " PRINTF_DWORD_PTR_FULL, rva);
 #endif
 		return false;
 	}
 
 
 	import.suspect = suspect;
 	import.valid = valid;
 	import.va = va;
 	import.rva = rva;
 	import.apiAddressVA = apiFound->va;
 	import.ordinal = ordinal;
 	import.hint = (WORD)apiFound->hint;
 
 	wcscpy_s(import.moduleName, apiFound->module->getFilename());
 	strcpy_s(import.name, apiFound->name);
 
 	module->thunkList.insert(std::pair<DWORD_PTR,ImportThunk>(import.rva, import));
 
 	return true;
 }
 
 void ApiReader::clearAll()
 {
 	minApiAddress = -1;
 	maxApiAddress = 0;
 
 	for ( stdext::hash_map<DWORD_PTR, ApiInfo *>::iterator it = apiList.begin(); it != apiList.end(); ++it )
 	{
 		delete it->second;
 	}
 	apiList.clear();
 
 	if (moduleThunkList != 0)
 	{
 		(*moduleThunkList).clear();
 	}
 }
 
 bool ApiReader::addNotFoundApiToModuleList(DWORD_PTR iatAddressVA, DWORD_PTR apiAddress)
 {
 	ImportThunk import;
 	ImportModuleThunk  * module = 0;
 	std::map<DWORD_PTR, ImportModuleThunk>::iterator iterator1;
 	DWORD_PTR rva = iatAddressVA - targetImageBase;
 
 	if ((*moduleThunkList).size() > 0)
 	{
 		iterator1 = (*moduleThunkList).begin();
 		while (iterator1 != (*moduleThunkList).end())
 		{
 			if (rva >= iterator1->second.firstThunk)
 			{
 				iterator1++;
 				if (iterator1 == (*moduleThunkList).end())
 				{
 					iterator1--;
 					//new unknown module
 					if (iterator1->second.moduleName[0] == L'?')
 					{
 						module = &(iterator1->second);
 					}
 					else
 					{
 						addUnknownModuleToModuleList(rva);
 						module = &((*moduleThunkList).find(rva)->second);
 					}
 
 					break;
 				}
 				else if (rva < iterator1->second.firstThunk)
 				{
 					iterator1--;
 					module = &(iterator1->second);
 					break;
 				}
 			}
 			else
 			{
 #ifdef DEBUG_COMMENTS
 				Scylla::debugLog.log(L"Error iterator1 != (*moduleThunkList).end()\r\n");
 #endif
 				break;
 			}
 		}
 	}
 	else
 	{
 		//new unknown module
 		addUnknownModuleToModuleList(rva);
 		module = &((*moduleThunkList).find(rva)->second);
 	}
 
 	if (!module)
 	{
 #ifdef DEBUG_COMMENTS
 		Scylla::debugLog.log(L"ImportsHandling::addFunction module not found rva " PRINTF_DWORD_PTR_FULL,rva);
 #endif
 		return false;
 	}
 
 
 	import.suspect = true;
 	import.valid = false;
 	import.va = iatAddressVA;
 	import.rva = rva;
 	import.apiAddressVA = apiAddress;
 	import.ordinal = 0;
 
 	wcscpy_s(import.moduleName, L"?");
 	strcpy_s(import.name, "?");
 
 	module->thunkList.insert(std::pair<DWORD_PTR,ImportThunk>(import.rva, import));
 
 	return true;
 }
 
 bool ApiReader::isApiBlacklisted( const char * functionName )
 {
 	if (SystemInformation::currenOS < WIN_VISTA_32)
 	{
 		if (!strcmp(functionName, "RestoreLastError"))
 		{
 			return true;
 		}
 		else
 		{
 			return false;
 		}
 	}
 	else
 	{
 		return false;
 	}
 
 
 	/*#ifdef _WIN64
 	else if (SystemInformation::currenOS == WIN_XP_64 && !strcmp(functionName, "DecodePointer"))
 	{
 		return true;
 	}
 #endif*/
 }
 
 bool ApiReader::isWinSxSModule( ModuleInfo * module )
 {
 	if (wcsstr(module->fullPath, L"\\WinSxS\\"))
 	{
 		return true;
 	}
 	else if (wcsstr(module->fullPath, L"\\winsxs\\"))
 	{
 		return true;
 	}
 	else
 	{
 		return false;
 	}
 }
diff --git a/Scylla/ConfigurationHolder.cpp b/Scylla/ConfigurationHolder.cpp
index 2090efb..0717204 100644
--- a/Scylla/ConfigurationHolder.cpp
+++ b/Scylla/ConfigurationHolder.cpp
@@ -1,206 +1,207 @@
 #include "ConfigurationHolder.h"
 
 #include <shlwapi.h>
 #include "Architecture.h"
 
 const WCHAR ConfigurationHolder::CONFIG_FILE_SECTION_NAME[] = L"SCYLLA_CONFIG";
 
 //#define DEBUG_COMMENTS
 
 ConfigurationHolder::ConfigurationHolder(const WCHAR* fileName)
 {
 	config[USE_PE_HEADER_FROM_DISK]     = Configuration(L"USE_PE_HEADER_FROM_DISK",      Configuration::Boolean);
 	config[DEBUG_PRIVILEGE]             = Configuration(L"DEBUG_PRIVILEGE",              Configuration::Boolean);
 	config[CREATE_BACKUP]               = Configuration(L"CREATE_BACKUP",                Configuration::Boolean);
 	config[DLL_INJECTION_AUTO_UNLOAD]   = Configuration(L"DLL_INJECTION_AUTO_UNLOAD",    Configuration::Boolean);
 	config[UPDATE_HEADER_CHECKSUM]      = Configuration(L"UPDATE_HEADER_CHECKSUM",       Configuration::Boolean);
 	config[IAT_SECTION_NAME]            = Configuration(L"IAT_SECTION_NAME",             Configuration::String);
 	config[REMOVE_DOS_HEADER_STUB]      = Configuration(L"REMOVE_DOS_HEADER_STUB",       Configuration::Boolean);
 	config[IAT_FIX_AND_OEP_FIX]         = Configuration(L"IAT_FIX_AND_OEP_FIX",          Configuration::Boolean);
 	config[SUSPEND_PROCESS_FOR_DUMPING] = Configuration(L"SUSPEND_PROCESS_FOR_DUMPING",  Configuration::Boolean);
 	config[OriginalFirstThunk_SUPPORT]  = Configuration(L"OriginalFirstThunk_SUPPORT",	 Configuration::Boolean);
 	config[USE_ADVANCED_IAT_SEARCH]     = Configuration(L"USE_ADVANCED_IAT_SEARCH",	     Configuration::Boolean);
 	config[SCAN_DIRECT_IMPORTS]			= Configuration(L"SCAN_DIRECT_IMPORTS",			 Configuration::Boolean);
-	config[FIX_DIRECT_IMPORTS]			= Configuration(L"FIX_DIRECT_IMPORTS",			 Configuration::Boolean);
+	config[FIX_DIRECT_IMPORTS_NORMAL]			= Configuration(L"FIX_DIRECT_IMPORTS_NORMAL",			 Configuration::Boolean);
+	config[FIX_DIRECT_IMPORTS_UNIVERSAL]		= Configuration(L"FIX_DIRECT_IMPORTS_UNIVERSAL",			 Configuration::Boolean);
 	config[CREATE_NEW_IAT_IN_SECTION]	= Configuration(L"CREATE_NEW_IAT_IN_SECTION",	 Configuration::Boolean);
 	buildConfigFilePath(fileName);
 }
 
 bool ConfigurationHolder::loadConfiguration()
 {
 	std::map<ConfigOption, Configuration>::iterator mapIter;
 
 	if (configPath[0] == '\0')
 	{
 		return false;
 	}
 
 	for (mapIter = config.begin() ; mapIter != config.end(); mapIter++)
 	{
 		Configuration& configObject = mapIter->second;
 		loadConfig(configObject);
 	}
 
 	return true;
 }
 
 bool ConfigurationHolder::saveConfiguration() const
 {
 	std::map<ConfigOption, Configuration>::const_iterator mapIter;
 
 	if (configPath[0] == '\0')
 	{
 		return false;
 	}
 
 	for (mapIter = config.begin() ; mapIter != config.end(); mapIter++)
 	{
 		const Configuration& configObject = mapIter->second;
 		if (!saveConfig(configObject))
 		{
 			return false;
 		}
 	}
 
 	return true;
 }
 
 Configuration& ConfigurationHolder::operator[](ConfigOption option)
 {
 	return config[option];
 }
 
 const Configuration& ConfigurationHolder::operator[](ConfigOption option) const
 {
 	static const Configuration dummy;
 
 	std::map<ConfigOption, Configuration>::const_iterator found = config.find(option);
 	if(found != config.end())
 	{
 		return found->second;
 	}
 	else
 	{
 		return dummy;
 	}
 }
 
 bool ConfigurationHolder::saveNumericToConfigFile(const Configuration & configObject, int nBase) const
 {
 	WCHAR buf[21]; // UINT64_MAX in dec has 20 digits
 
 	if (nBase == 16)
 	{
 		swprintf_s(buf, PRINTF_DWORD_PTR_FULL, configObject.getNumeric());
 	}
 	else
 	{
 		swprintf_s(buf, PRINTF_INTEGER, configObject.getNumeric());
 	}
 
 	BOOL ret = WritePrivateProfileString(CONFIG_FILE_SECTION_NAME, configObject.getName(), buf, configPath);
 	return ret == TRUE;
 }
 
 bool ConfigurationHolder::readNumericFromConfigFile(Configuration & configObject, int nBase)
 {
 	WCHAR buf[21]; // UINT64_MAX in dec has 20 digits
 	DWORD read = GetPrivateProfileString(CONFIG_FILE_SECTION_NAME, configObject.getName(), L"", buf, _countof(buf), configPath);
 
 	if (read > 0 && wcslen(buf) > 0)
 	{
 #ifdef _WIN64
 		configObject.setNumeric(_wcstoui64(buf, NULL, nBase));
 #else
 		configObject.setNumeric(wcstoul(buf, NULL, nBase));
 #endif
 		return true;
 	}
 
 	return false;
 }
 
 bool ConfigurationHolder::saveStringToConfigFile(const Configuration & configObject) const
 {
 	BOOL ret = WritePrivateProfileString(CONFIG_FILE_SECTION_NAME, configObject.getName(), configObject.getString(), configPath);
 	return ret == TRUE;
 }
 
 bool ConfigurationHolder::readStringFromConfigFile(Configuration & configObject)
 {
 	WCHAR buf[Configuration::CONFIG_STRING_LENGTH];
 	DWORD read = GetPrivateProfileString(CONFIG_FILE_SECTION_NAME, configObject.getName(), L"", buf, _countof(buf), configPath);
 	if(read > 0 && wcslen(buf) > 0)
 	{
 		configObject.setString(buf);
 		return true;
 	}
 
 	return false;
 }
 
 bool ConfigurationHolder::readBooleanFromConfigFile(Configuration & configObject)
 {
 	UINT val = GetPrivateProfileInt(CONFIG_FILE_SECTION_NAME, configObject.getName(), 0, configPath);
 	configObject.setBool(val != 0);
 	return true;
 }
 
 bool ConfigurationHolder::saveBooleanToConfigFile(const Configuration & configObject) const
 {
 	const WCHAR *boolValue = configObject.isTrue() ? L"1" : L"0";
 	BOOL ret = WritePrivateProfileString(CONFIG_FILE_SECTION_NAME, configObject.getName(), boolValue, configPath);
 	return ret == TRUE;
 }
 
 bool ConfigurationHolder::loadConfig(Configuration & configObject)
 {
 	switch (configObject.getType())
 	{
 	case Configuration::String:
 		return readStringFromConfigFile(configObject);
 	case Configuration::Boolean:
 		return readBooleanFromConfigFile(configObject);
 	case Configuration::Decimal:
 		return readNumericFromConfigFile(configObject, 10);
 	case Configuration::Hexadecimal:
 		return readNumericFromConfigFile(configObject, 16);
 	default:
 		return false;
 	}
 }
 
 bool ConfigurationHolder::saveConfig(const Configuration & configObject) const
 {
 	switch (configObject.getType())
 	{
 	case Configuration::String:
 		return saveStringToConfigFile(configObject);
 	case Configuration::Boolean:
 		return saveBooleanToConfigFile(configObject);
 	case Configuration::Decimal:
 		return saveNumericToConfigFile(configObject, 10);
 	case Configuration::Hexadecimal:
 		return saveNumericToConfigFile(configObject, 16);
 	default:
 		return false;
 	}
 }
 
 bool ConfigurationHolder::buildConfigFilePath(const WCHAR* fileName)
 {
 	ZeroMemory(configPath, sizeof(configPath));
 
 	if (!GetModuleFileName(0, configPath, _countof(configPath)))
 	{
 #ifdef DEBUG_COMMENTS
 		Scylla::debugLog.log(L"buildConfigFilePath :: GetModuleFileName failed %d", GetLastError());
 #endif
 		return false;
 	}
 
 	PathRemoveFileSpec(configPath);
 	PathAppend(configPath, fileName);
 
 	return true;
 }
diff --git a/Scylla/ConfigurationHolder.h b/Scylla/ConfigurationHolder.h
index f3cbcc2..8d9149c 100644
--- a/Scylla/ConfigurationHolder.h
+++ b/Scylla/ConfigurationHolder.h
@@ -1,56 +1,57 @@
 #pragma once
 
 #include <windows.h>
 #include <map>
 #include "Configuration.h"
 
 enum ConfigOption
 {
 	USE_PE_HEADER_FROM_DISK,
 	DEBUG_PRIVILEGE,
 	CREATE_BACKUP,
 	DLL_INJECTION_AUTO_UNLOAD,
 	IAT_SECTION_NAME,
 	UPDATE_HEADER_CHECKSUM,
 	REMOVE_DOS_HEADER_STUB,
 	IAT_FIX_AND_OEP_FIX,
 	SUSPEND_PROCESS_FOR_DUMPING,
 	OriginalFirstThunk_SUPPORT,
 	USE_ADVANCED_IAT_SEARCH,
 	SCAN_DIRECT_IMPORTS,
-	FIX_DIRECT_IMPORTS,
+	FIX_DIRECT_IMPORTS_NORMAL,
+	FIX_DIRECT_IMPORTS_UNIVERSAL,
 	CREATE_NEW_IAT_IN_SECTION
 };
 
 class ConfigurationHolder
 {
 public:
 
 	ConfigurationHolder(const WCHAR* fileName);
 
 	bool loadConfiguration();
 	bool saveConfiguration() const;
 
 	Configuration& operator[](ConfigOption option);
 	const Configuration& operator[](ConfigOption option) const;
 
 private:
 
 	static const WCHAR CONFIG_FILE_SECTION_NAME[];
 
 	WCHAR configPath[MAX_PATH];
 	std::map<ConfigOption, Configuration> config;
 
 	bool buildConfigFilePath(const WCHAR* fileName);
 
 	bool readStringFromConfigFile(Configuration & configObject);
 	bool readBooleanFromConfigFile(Configuration & configObject);
 	bool readNumericFromConfigFile(Configuration & configObject, int nBase);
 
 	bool saveStringToConfigFile(const Configuration & configObject) const;
 	bool saveBooleanToConfigFile(const Configuration & configObject) const;
 	bool saveNumericToConfigFile(const Configuration & configObject, int nBase) const;
 
 	bool loadConfig(Configuration & configObject);
 	bool saveConfig(const Configuration & configObject) const;
 };
diff --git a/Scylla/IATReferenceScan.cpp b/Scylla/IATReferenceScan.cpp
index ff48b8b..723e58d 100644
--- a/Scylla/IATReferenceScan.cpp
+++ b/Scylla/IATReferenceScan.cpp
@@ -1,506 +1,659 @@
 #include "IATReferenceScan.h"
 #include "Scylla.h"
 #include "Architecture.h"
 
 //#define DEBUG_COMMENTS
 
 
 FileLog IATReferenceScan::directImportLog(L"Scylla_direct_imports.log");
 
 int IATReferenceScan::numberOfFoundDirectImports()
 {
 	return (int)iatDirectImportList.size();
 }
 
+int IATReferenceScan::getSizeInBytesOfJumpTableInSection()
+{
+	return ((int)iatDirectImportList.size() * 6); //for x86 and x64 the same size
+}
+
 void IATReferenceScan::startScan(DWORD_PTR imageBase, DWORD imageSize, DWORD_PTR iatAddress, DWORD iatSize)
 {
 	MEMORY_BASIC_INFORMATION memBasic = {0};
 
 	IatAddressVA = iatAddress;
 	IatSize = iatSize;
 	ImageBase = imageBase;
 	ImageSize = imageSize;
 
-	iatReferenceList.clear();
-	iatDirectImportList.clear();
+	if (ScanForNormalImports)
+	{
+		iatReferenceList.clear();
+		iatReferenceList.reserve(200);
+	}
+	if (ScanForDirectImports)
+	{
+		iatDirectImportList.clear();
+		iatDirectImportList.reserve(50);
+	}
+
 
-	iatReferenceList.reserve(200);
-	iatDirectImportList.reserve(50);
 
 	DWORD_PTR section = imageBase;
 
 	do
 	{
 		if (!VirtualQueryEx(ProcessAccessHelp::hProcess, (LPCVOID)section, &memBasic, sizeof(MEMORY_BASIC_INFORMATION)))
 		{
 #ifdef DEBUG_COMMENTS
 			Scylla::debugLog.log(L"VirtualQueryEx failed %d", GetLastError());
 #endif
 
 			break;
 		}
 		else
 		{
 			if (isPageExecutable(memBasic.Protect))
 			{
 				//do read and scan
 				scanMemoryPage(memBasic.BaseAddress, memBasic.RegionSize);
 			}
 		}
 
 		section = (DWORD_PTR)((SIZE_T)section + memBasic.RegionSize);
 
 	} while (section < (imageBase + imageSize));
 
 
 }
 
 //void IATReferenceScan::patchNewIatBaseMemory(DWORD_PTR newIatBaseAddress)
 //{
 //	NewIatAddressVA = newIatBaseAddress;
 //
 //	for (std::vector<IATReference>::iterator iter = iatReferenceList.begin(); iter != iatReferenceList.end(); iter++)
 //	{
 //		patchReferenceInMemory(&(*iter));
 //	}
 //}
 //
 //void IATReferenceScan::patchNewIatBaseFile(DWORD_PTR newIatBaseAddress)
 //{
 //	NewIatAddressVA = newIatBaseAddress;
 //
 //	for (std::vector<IATReference>::iterator iter = iatReferenceList.begin(); iter != iatReferenceList.end(); iter++)
 //	{
 //		patchReferenceInFile(&(*iter));
 //	}
 //}
 
 void IATReferenceScan::patchDirectImportsMemory( bool junkByteAfterInstruction )
 {
 	JunkByteAfterInstruction = junkByteAfterInstruction;
 	for (std::vector<IATReference>::iterator iter = iatDirectImportList.begin(); iter != iatDirectImportList.end(); iter++)
 	{
 		patchDirectImportInMemory(&(*iter));
 	}
 }
 
 
 bool IATReferenceScan::isPageExecutable( DWORD Protect )
 {
 	if (Protect & PAGE_NOCACHE) Protect ^= PAGE_NOCACHE;
 
 	if (Protect & PAGE_WRITECOMBINE) Protect ^= PAGE_WRITECOMBINE;
 
 	switch(Protect)
 	{
 	case PAGE_EXECUTE:
 		{
 			return true;
 		}
 	case PAGE_EXECUTE_READ:
 		{
 			return true;
 		}
 	case PAGE_EXECUTE_READWRITE:
 		{
 			return true;
 		}
 	case PAGE_EXECUTE_WRITECOPY:
 		{
 			return true;
 		}
 	default:
 		return false;
 	}
 
 }
 
 void IATReferenceScan::scanMemoryPage( PVOID BaseAddress, SIZE_T RegionSize )
 {
 	BYTE * dataBuffer = (BYTE *)calloc(RegionSize, 1);
 	BYTE * currentPos = dataBuffer;
 	int currentSize = (int)RegionSize;
 	DWORD_PTR currentOffset = (DWORD_PTR)BaseAddress;
 	_DecodeResult res;
 	unsigned int instructionsCount = 0, next = 0;
 
 	if (!dataBuffer)
 		return;
 
 	if (ProcessAccessHelp::readMemoryFromProcess((DWORD_PTR)BaseAddress, RegionSize, (LPVOID)dataBuffer))
 	{
 		while (1)
 		{
 			ZeroMemory(&ProcessAccessHelp::decomposerCi, sizeof(_CodeInfo));
 			ProcessAccessHelp::decomposerCi.code = currentPos;
 			ProcessAccessHelp::decomposerCi.codeLen = currentSize;
 			ProcessAccessHelp::decomposerCi.dt = ProcessAccessHelp::dt;
 			ProcessAccessHelp::decomposerCi.codeOffset = currentOffset;
 
 			instructionsCount = 0;
 
 			res = distorm_decompose(&ProcessAccessHelp::decomposerCi, ProcessAccessHelp::decomposerResult, sizeof(ProcessAccessHelp::decomposerResult)/sizeof(ProcessAccessHelp::decomposerResult[0]), &instructionsCount);
 
 			if (res == DECRES_INPUTERR)
 			{
 				break;
 			}
 
 			for (unsigned int i = 0; i < instructionsCount; i++) 
 			{
 				if (ProcessAccessHelp::decomposerResult[i].flags != FLAG_NOT_DECODABLE)
 				{
 					analyzeInstruction(&ProcessAccessHelp::decomposerResult[i]);
 				}
 			}
 
 			if (res == DECRES_SUCCESS) break; // All instructions were decoded.
 			else if (instructionsCount == 0) break;
 
 			next = (unsigned long)(ProcessAccessHelp::decomposerResult[instructionsCount-1].addr - ProcessAccessHelp::decomposerResult[0].addr);
 
 			if (ProcessAccessHelp::decomposerResult[instructionsCount-1].flags != FLAG_NOT_DECODABLE)
 			{
 				next += ProcessAccessHelp::decomposerResult[instructionsCount-1].size;
 			}
 
 			currentPos += next;
 			currentOffset += next;
 			currentSize -= next;
 		}
 	}
 
 	free(dataBuffer);
 }
 
 void IATReferenceScan::analyzeInstruction( _DInst * instruction )
 {
 	if (ScanForNormalImports)
 	{
 		findNormalIatReference(instruction);
 	}
 	
 	if (ScanForDirectImports)
 	{
-		findDirectIatReferenceCallJmp(instruction);
 		findDirectIatReferenceMov(instruction);
+		
+#ifndef _WIN64
+		findDirectIatReferenceCallJmp(instruction);
+		findDirectIatReferenceLea(instruction);
+		findDirectIatReferencePush(instruction);
+#endif
 	}
 }
 
 void IATReferenceScan::findNormalIatReference( _DInst * instruction )
 {
 #ifdef DEBUG_COMMENTS
 	_DecodedInst inst;
 #endif
 
 	IATReference ref;
 
 
 	if (META_GET_FC(instruction->meta) == FC_CALL || META_GET_FC(instruction->meta) == FC_UNC_BRANCH)
 	{
 		if (instruction->size >= 5)
 		{
 			if (META_GET_FC(instruction->meta) == FC_CALL)
 			{
 				ref.type = IAT_REFERENCE_PTR_CALL;
 			}
 			else
 			{
 				ref.type = IAT_REFERENCE_PTR_JMP;
 			}
 			ref.addressVA = (DWORD_PTR)instruction->addr;
+			ref.instructionSize = instruction->size;
 
 #ifdef _WIN64
 			if (instruction->flags & FLAG_RIP_RELATIVE)
 			{
 
 #ifdef DEBUG_COMMENTS
 				distorm_format(&ProcessAccessHelp::decomposerCi, instruction, &inst);
 				Scylla::debugLog.log(PRINTF_DWORD_PTR_FULL L" " PRINTF_DWORD_PTR_FULL L" %S %S %d %d - target address: " PRINTF_DWORD_PTR_FULL, (DWORD_PTR)instruction->addr, ImageBase, inst.mnemonic.p, inst.operands.p, instruction->ops[0].type, instruction->size, INSTRUCTION_GET_RIP_TARGET(instruction));
 #endif
 
 				if (INSTRUCTION_GET_RIP_TARGET(instruction) >= IatAddressVA && INSTRUCTION_GET_RIP_TARGET(instruction) < (IatAddressVA + IatSize))
 				{
 					ref.targetPointer = INSTRUCTION_GET_RIP_TARGET(instruction);
 
 					getIatEntryAddress(&ref);
 
 					//Scylla::debugLog.log(L"iat entry "PRINTF_DWORD_PTR_FULL,ref.targetAddressInIat);
 
 					iatReferenceList.push_back(ref);
 				}
 			}
 #else
 
 			if (instruction->ops[0].type == O_DISP)
 			{
 				//jmp dword ptr || call dword ptr
 #ifdef DEBUG_COMMENTS
 				distorm_format(&ProcessAccessHelp::decomposerCi, instruction, &inst);
 				Scylla::debugLog.log(PRINTF_DWORD_PTR_FULL L" " PRINTF_DWORD_PTR_FULL L" %S %S %d %d - target address: " PRINTF_DWORD_PTR_FULL, (DWORD_PTR)instruction->addr, ImageBase, inst.mnemonic.p, inst.operands.p, instruction->ops[0].type, instruction->size, instruction->disp);
 #endif
 				
 				if (instruction->disp >= IatAddressVA && instruction->disp < (IatAddressVA + IatSize))
 				{
 					ref.targetPointer = (DWORD_PTR)instruction->disp;
 					
 					getIatEntryAddress(&ref);
 
 					//Scylla::debugLog.log(L"iat entry "PRINTF_DWORD_PTR_FULL,ref.targetAddressInIat);
 
 					iatReferenceList.push_back(ref);
 				}
 			}
 #endif
 		}
 	}
 }
 
 void IATReferenceScan::getIatEntryAddress( IATReference * ref )
 {
 	if (!ProcessAccessHelp::readMemoryFromProcess(ref->targetPointer, sizeof(DWORD_PTR), &ref->targetAddressInIat))
 	{
 		ref->targetAddressInIat = 0;
 	}
 }
 
 void IATReferenceScan::findDirectIatReferenceCallJmp( _DInst * instruction )
 {
-#ifdef DEBUG_COMMENTS
-	_DecodedInst inst;
-#endif
-
 	IATReference ref;
 	ref.targetPointer = 0;
 	
 
 	if (META_GET_FC(instruction->meta) == FC_CALL || META_GET_FC(instruction->meta) == FC_UNC_BRANCH)
 	{
 		if ((instruction->size >= 5) && (instruction->ops[0].type == O_PC)) //CALL/JMP 0x00000000
 		{
 			if (META_GET_FC(instruction->meta) == FC_CALL)
 			{
 				ref.type = IAT_REFERENCE_DIRECT_CALL;
 			}
 			else
 			{
 				ref.type = IAT_REFERENCE_DIRECT_JMP;
 			}
 			ref.addressVA = (DWORD_PTR)instruction->addr;
 			ref.targetAddressInIat = (DWORD_PTR)INSTRUCTION_GET_TARGET(instruction);
+			ref.instructionSize = instruction->size;
 
-			if ((ref.targetAddressInIat < ImageBase) || (ref.targetAddressInIat > (ImageBase+ImageSize))) //call/JMP outside pe image
-			{
-				if (isAddressValidImageMemory(ref.targetAddressInIat))
-				{
-#ifdef DEBUG_COMMENTS
-					distorm_format(&ProcessAccessHelp::decomposerCi, instruction, &inst);
-					Scylla::debugLog.log(PRINTF_DWORD_PTR_FULL L" " PRINTF_DWORD_PTR_FULL L" %S %S %d %d - target address: " PRINTF_DWORD_PTR_FULL,(DWORD_PTR)instruction->addr, ImageBase, inst.mnemonic.p, inst.operands.p, instruction->ops[0].type, instruction->size, INSTRUCTION_GET_TARGET(instruction));
-#endif
-
-					iatDirectImportList.push_back(ref);
-				}
-			}
+			checkMemoryRangeAndAddToList(&ref, instruction);
 		}
 	}
 }
 
 bool IATReferenceScan::isAddressValidImageMemory( DWORD_PTR address )
 {
 	MEMORY_BASIC_INFORMATION memBasic = {0};
 
 	if (!VirtualQueryEx(ProcessAccessHelp::hProcess, (LPCVOID)address, &memBasic, sizeof(MEMORY_BASIC_INFORMATION)))
 	{
 		return false;
 	}
 
 	return (memBasic.Type == MEM_IMAGE && isPageExecutable(memBasic.Protect));
 }
 
 void IATReferenceScan::patchReferenceInMemory( IATReference * ref )
 {
 	DWORD_PTR newIatAddressPointer = ref->targetPointer - IatAddressVA + NewIatAddressRVA;
 
 	DWORD patchBytes = 0;
 
 #ifdef _WIN64
 	patchBytes = (DWORD)(newIatAddressPointer - ref->addressVA - 6);
 #else
 	patchBytes = newIatAddressPointer;
 #endif
 	ProcessAccessHelp::writeMemoryToProcess(ref->addressVA + 2, sizeof(DWORD), &patchBytes);
 }
 
 void IATReferenceScan::patchDirectImportInMemory( IATReference * ref )
 {
 	DWORD patchBytes = 0;
 	BYTE patchPreBytes[2];
 
 	ref->targetPointer = lookUpIatForPointer(ref->targetAddressInIat);
 	if (ref->targetPointer)
 	{
 		patchPreBytes[0] = 0xFF;
 
 		if (ref->type == IAT_REFERENCE_DIRECT_CALL) //FF15
 		{
 			patchPreBytes[1] = 0x15;
 		}
 		else if (ref->type == IAT_REFERENCE_DIRECT_JMP) //FF25
 		{
 			patchPreBytes[1] = 0x25;
 		}
 		else
 		{
 			return;
 		}
 
 		if (!JunkByteAfterInstruction)
 		{
 			ref->addressVA -= 1;
 		}
 
 		ProcessAccessHelp::writeMemoryToProcess(ref->addressVA, 2, patchPreBytes);
 
 #ifdef _WIN64
 		patchBytes = (DWORD)(ref->targetPointer - ref->addressVA - 6);
 #else
 		patchBytes = ref->targetPointer;
 #endif
 		ProcessAccessHelp::writeMemoryToProcess(ref->addressVA + 2, sizeof(DWORD), &patchBytes);
 	}
 }
 
 DWORD_PTR IATReferenceScan::lookUpIatForPointer( DWORD_PTR addr )
 {
 	if (!iatBackup)
 	{
 		iatBackup = (DWORD_PTR *)calloc(IatSize + sizeof(DWORD_PTR), 1);
 		if (!iatBackup)
 		{
 			return 0;
 		}
 		if (!ProcessAccessHelp::readMemoryFromProcess(IatAddressVA, IatSize, iatBackup))
 		{
 			free(iatBackup);
 			iatBackup = 0;
 			return 0;
 		}
 	}
 
 	for (int i = 0; i < ((int)IatSize / (int)sizeof(DWORD_PTR));i++)
 	{
 		if (iatBackup[i] == addr)
 		{
 			return (DWORD_PTR)&iatBackup[i] - (DWORD_PTR)iatBackup + IatAddressVA;
 		}
 	}
 
 	return 0;
 }
 
 void IATReferenceScan::patchNewIat(DWORD_PTR stdImagebase, DWORD_PTR newIatBaseAddress, PeParser * peParser)
 {
 	NewIatAddressRVA = newIatBaseAddress;
 	DWORD patchBytes = 0;
 
 	for (std::vector<IATReference>::iterator iter = iatReferenceList.begin(); iter != iatReferenceList.end(); iter++)
 	{
 		IATReference * ref = &(*iter);
 
 		DWORD_PTR newIatAddressPointer = (ref->targetPointer - IatAddressVA) + NewIatAddressRVA + stdImagebase;
 
 #ifdef _WIN64
 		patchBytes = (DWORD)(newIatAddressPointer - (ref->addressVA - ImageBase + stdImagebase) - 6);
 #else
 		patchBytes = newIatAddressPointer;
 #endif
 		DWORD_PTR patchOffset = peParser->convertRVAToOffsetRelative(ref->addressVA - ImageBase);
 		int index = peParser->convertRVAToOffsetVectorIndex(ref->addressVA - ImageBase);
 		BYTE * memory = peParser->getSectionMemoryByIndex(index);
 		DWORD memorySize = peParser->getSectionMemorySizeByIndex(index);
 
 
 		if (memorySize < (DWORD)(patchOffset + 6))
 		{
 			Scylla::debugLog.log(L"Error - Cannot fix IAT reference RVA: " PRINTF_DWORD_PTR_FULL, ref->addressVA - ImageBase);
 		}
 		else
 		{
 			memory += patchOffset + 2;		
 
 			*((DWORD *)memory) = patchBytes;
 		}
 		//Scylla::debugLog.log(L"address %X old %X new %X",ref->addressVA, ref->targetPointer, newIatAddressPointer);
 
 	}
 }
 
 void IATReferenceScan::findDirectIatReferenceMov( _DInst * instruction )
 {
-#ifdef DEBUG_COMMENTS
-	_DecodedInst inst;
-#endif
-
 	IATReference ref;
 	ref.targetPointer = 0;
 	ref.type = IAT_REFERENCE_DIRECT_MOV;
 
-	if (instruction->size >= 5 && instruction->opcode == I_MOV)
+	if (instruction->opcode == I_MOV)
 	{
-		//MOV REGISTER, 0xFFFFFFFF
-		if (instruction->ops[0].type == O_REG && instruction->ops[1].type == O_IMM)
+#ifdef _WIN64
+		if (instruction->size >= 7) //MOV REGISTER, 0xFFFFFFFFFFFFFFFF
+#else
+		if (instruction->size >= 5) //MOV REGISTER, 0xFFFFFFFF
+#endif
 		{
-			ref.targetAddressInIat = (DWORD_PTR)instruction->imm.qword;
-			ref.addressVA = (DWORD_PTR)instruction->addr;
-
-			if (ref.targetAddressInIat > 0x000FFFFF && ref.targetAddressInIat != (DWORD_PTR)-1)
+			if (instruction->ops[0].type == O_REG && instruction->ops[1].type == O_IMM)
 			{
-				if ((ref.targetAddressInIat < ImageBase) || (ref.targetAddressInIat > (ImageBase+ImageSize)))
-				{
-					if (isAddressValidImageMemory(ref.targetAddressInIat))
-					{
-#ifdef DEBUG_COMMENTS
-						distorm_format(&ProcessAccessHelp::decomposerCi, instruction, &inst);
-						Scylla::debugLog.log(PRINTF_DWORD_PTR_FULL L" " PRINTF_DWORD_PTR_FULL L" %S %S %d %d - target address: " PRINTF_DWORD_PTR_FULL,(DWORD_PTR)instruction->addr, ImageBase, inst.mnemonic.p, inst.operands.p, instruction->ops[0].type, instruction->size, INSTRUCTION_GET_TARGET(instruction));
-#endif
-						iatDirectImportList.push_back(ref);
-					}
-				}
+				ref.targetAddressInIat = (DWORD_PTR)instruction->imm.qword;
+				ref.addressVA = (DWORD_PTR)instruction->addr;
+				ref.instructionSize = instruction->size;
+
+				checkMemoryRangeAndAddToList(&ref, instruction);
 			}
 		}
 	}
 }
 
 void IATReferenceScan::printDirectImportLog()
 {
 	IATReferenceScan::directImportLog.log(L"------------------------------------------------------------");
 	IATReferenceScan::directImportLog.log(L"ImageBase " PRINTF_DWORD_PTR_FULL L" ImageSize %08X IATAddress " PRINTF_DWORD_PTR_FULL L" IATSize 0x%X", ImageBase, ImageSize, IatAddressVA, IatSize);
 	int count = 0;
+	bool isSuspect = false;
+
 	for (std::vector<IATReference>::iterator iter = iatDirectImportList.begin(); iter != iatDirectImportList.end(); iter++)
 	{
 		IATReference * ref = &(*iter);
+		
+		ApiInfo * apiInfo = apiReader->getApiByVirtualAddress(ref->targetAddressInIat, &isSuspect);
 
 		ref->targetPointer = lookUpIatForPointer(ref->targetAddressInIat);
 
 		count++;
-		WCHAR * type;
+		WCHAR * type = L"U";
 
 		if (ref->type == IAT_REFERENCE_DIRECT_CALL)
 		{
 			type = L"CALL";
 		}
 		else if (ref->type == IAT_REFERENCE_DIRECT_JMP)
 		{
 			type = L"JMP";
 		}
 		else if (ref->type == IAT_REFERENCE_DIRECT_MOV)
 		{
 			type = L"MOV";
 		}
+		else if (ref->type == IAT_REFERENCE_DIRECT_PUSH)
+		{
+			type = L"PUSH";
+		}
+		else if (ref->type == IAT_REFERENCE_DIRECT_LEA)
+		{
+			type = L"LEA";
+		}
 
-		IATReferenceScan::directImportLog.log(L"%04d AddrVA " PRINTF_DWORD_PTR_FULL L" Type %s Value " PRINTF_DWORD_PTR_FULL L" IatRefPointer " PRINTF_DWORD_PTR_FULL, count, ref->addressVA, type, ref->targetAddressInIat, ref->targetPointer);
+		IATReferenceScan::directImportLog.log(L"%04d AddrVA " PRINTF_DWORD_PTR_FULL L" Type %s Value " PRINTF_DWORD_PTR_FULL L" IatRefPointer " PRINTF_DWORD_PTR_FULL L" Api %s %S", count, ref->addressVA, type, ref->targetAddressInIat, ref->targetPointer,apiInfo->module->getFilename(), apiInfo->name);
 
 	}
 
 	IATReferenceScan::directImportLog.log(L"------------------------------------------------------------");
 }
+
+
+void IATReferenceScan::findDirectIatReferencePush( _DInst * instruction )
+{
+	IATReference ref;
+	ref.targetPointer = 0;
+	ref.type = IAT_REFERENCE_DIRECT_PUSH;
+
+	if (instruction->size >= 5 && instruction->opcode == I_PUSH)
+	{
+		ref.targetAddressInIat = (DWORD_PTR)instruction->imm.qword;
+		ref.addressVA = (DWORD_PTR)instruction->addr;
+		ref.instructionSize = instruction->size;
+
+		checkMemoryRangeAndAddToList(&ref, instruction);
+	}
+}
+
+void IATReferenceScan::findDirectIatReferenceLea( _DInst * instruction )
+{
+	IATReference ref;
+	ref.targetPointer = 0;
+	ref.type = IAT_REFERENCE_DIRECT_LEA;
+
+	if (instruction->size >= 5 && instruction->opcode == I_LEA)
+	{
+		if (instruction->ops[0].type == O_REG && instruction->ops[1].type == O_DISP) //LEA EDX, [0xb58bb8]
+		{
+			ref.targetAddressInIat = (DWORD_PTR)instruction->disp;
+			ref.addressVA = (DWORD_PTR)instruction->addr;
+			ref.instructionSize = instruction->size;
+
+			checkMemoryRangeAndAddToList(&ref, instruction);
+		}
+	}
+}
+
+void IATReferenceScan::checkMemoryRangeAndAddToList( IATReference * ref, _DInst * instruction )
+{
+#ifdef DEBUG_COMMENTS
+	_DecodedInst inst;
+#endif
+
+	if (ref->targetAddressInIat > 0x000FFFFF && ref->targetAddressInIat != (DWORD_PTR)-1)
+	{
+		if ((ref->targetAddressInIat < ImageBase) || (ref->targetAddressInIat > (ImageBase+ImageSize))) //outside pe image
+		{
+			//if (isAddressValidImageMemory(ref->targetAddressInIat))
+			{
+				bool isSuspect = false;
+				if (apiReader->getApiByVirtualAddress(ref->targetAddressInIat, &isSuspect) != 0)
+				{
+#ifdef DEBUG_COMMENTS
+					distorm_format(&ProcessAccessHelp::decomposerCi, instruction, &inst);
+					Scylla::debugLog.log(PRINTF_DWORD_PTR_FULL L" " PRINTF_DWORD_PTR_FULL L" %S %S %d %d - target address: " PRINTF_DWORD_PTR_FULL,(DWORD_PTR)instruction->addr, ImageBase, inst.mnemonic.p, inst.operands.p, instruction->ops[0].type, instruction->size, ref->targetAddressInIat);
+#endif
+					iatDirectImportList.push_back(*ref);
+				}
+			}
+		}
+	}
+}
+
+void IATReferenceScan::patchDirectJumpTable( DWORD_PTR stdImagebase, DWORD directImportsJumpTableRVA, PeParser * peParser, BYTE * jmpTableMemory, DWORD newIatBase )
+{
+	DWORD patchBytes = 0;
+	for (std::vector<IATReference>::iterator iter = iatDirectImportList.begin(); iter != iatDirectImportList.end(); iter++)
+	{
+		IATReference * ref = &(*iter);
+
+		DWORD_PTR refTargetPointer = ref->targetPointer;
+		if (newIatBase) //create new iat in section
+		{
+			refTargetPointer = (ref->targetPointer - IatAddressVA) + newIatBase + ImageBase;
+		}
+		//create jump table in section
+		DWORD_PTR newIatAddressPointer = refTargetPointer - ImageBase + stdImagebase;
+
+#ifdef _WIN64
+		patchBytes = (DWORD)(newIatAddressPointer - (ref->addressVA - ImageBase + stdImagebase) - 6);
+#else
+		patchBytes = newIatAddressPointer; //dont forget relocation here
+		directImportLog.log(L"Relocation direct imports fix: Base RVA %08X Offset %04X Type IMAGE_REL_BASED_HIGHLOW", (directImportsJumpTableRVA + 2) & 0xFFFFF000, (directImportsJumpTableRVA + 2) & 0x00000FFF);
+#endif
+		jmpTableMemory[0] = 0xFF;
+		jmpTableMemory[1] = 0x25;
+		*((DWORD *)&jmpTableMemory[2]) = patchBytes;
+
+		//patch dump
+		DWORD_PTR patchOffset = peParser->convertRVAToOffsetRelative(ref->addressVA - ImageBase);
+		int index = peParser->convertRVAToOffsetVectorIndex(ref->addressVA - ImageBase);
+		BYTE * memory = peParser->getSectionMemoryByIndex(index);
+		DWORD memorySize = peParser->getSectionMemorySizeByIndex(index);
+		DWORD sectionRVA = peParser->getSectionAddressRVAByIndex(index);
+
+		if (ref->type == IAT_REFERENCE_DIRECT_CALL || ref->type == IAT_REFERENCE_DIRECT_JMP)
+		{
+			if (ref->instructionSize == 5)
+			{
+				patchBytes = directImportsJumpTableRVA - (ref->addressVA - ImageBase) - 5;
+				patchDirectImportInDump32(1, 5, patchBytes, memory, memorySize, false, patchOffset, sectionRVA);
+			}
+		}
+		else if (ref->type == IAT_REFERENCE_DIRECT_PUSH || ref->type == IAT_REFERENCE_DIRECT_MOV)
+		{
+			if (ref->instructionSize == 5)
+			{
+				patchBytes = directImportsJumpTableRVA + stdImagebase;
+				patchDirectImportInDump32(1, 5, patchBytes, memory, memorySize, true, patchOffset, sectionRVA);				
+			}
+		}
+		else if (ref->type == IAT_REFERENCE_DIRECT_LEA)
+		{
+			if (ref->instructionSize == 6)
+			{
+				patchBytes = directImportsJumpTableRVA + stdImagebase;
+				patchDirectImportInDump32(2, 6, patchBytes, memory, memorySize, true, patchOffset, sectionRVA);
+			}
+		}
+
+
+		jmpTableMemory += 6;
+		directImportsJumpTableRVA += 6;
+	}
+
+}
+
+void IATReferenceScan::patchDirectImportInDump32( int patchPreFixBytes, int instructionSize, DWORD patchBytes, BYTE * memory, DWORD memorySize, bool generateReloc, DWORD patchOffset, DWORD sectionRVA )
+{
+
+	if (memorySize < (DWORD)(patchOffset + instructionSize))
+	{
+		Scylla::debugLog.log(L"Error - Cannot fix direct import reference RVA: %X", sectionRVA + patchOffset);
+	}
+	else
+	{
+		memory += patchOffset + patchPreFixBytes;
+		if (generateReloc)
+		{
+			directImportLog.log(L"Relocation direct imports fix: Base RVA %08X Offset %04X Type IMAGE_REL_BASED_HIGHLOW", (sectionRVA + patchOffset + patchPreFixBytes) & 0xFFFFF000, (sectionRVA + patchOffset+ patchPreFixBytes) & 0x00000FFF);
+		}
+
+		*((DWORD *)memory) = patchBytes;
+	}
+}
+
+
diff --git a/Scylla/IATReferenceScan.h b/Scylla/IATReferenceScan.h
index 29c051c..78c69a5 100644
--- a/Scylla/IATReferenceScan.h
+++ b/Scylla/IATReferenceScan.h
@@ -1,108 +1,122 @@
 #pragma once
 #include <vector>
 #include "ProcessAccessHelp.h"
 #include "PeParser.h"
 #include "Logger.h"
+#include "ApiReader.h"
 
 enum IATReferenceType {
 	IAT_REFERENCE_PTR_JMP,
 	IAT_REFERENCE_PTR_CALL,
 	IAT_REFERENCE_DIRECT_JMP,
 	IAT_REFERENCE_DIRECT_CALL,
-	IAT_REFERENCE_DIRECT_MOV
+	IAT_REFERENCE_DIRECT_MOV,
+	IAT_REFERENCE_DIRECT_PUSH,
+	IAT_REFERENCE_DIRECT_LEA
 };
 
 class IATReference
 {
 public:
 	DWORD_PTR addressVA; //Address of reference
 	DWORD_PTR targetPointer; //Place inside IAT
 	DWORD_PTR targetAddressInIat; //WIN API?
+	BYTE instructionSize;
 	IATReferenceType type;
 };
 
 
 class IATReferenceScan
 {
 public:
 
 	IATReferenceScan()
 	{
+		apiReader = 0;
 		IatAddressVA = 0;
 		IatSize = 0;
 		ImageBase = 0;
 		ImageSize = 0;
 		iatBackup = 0;
 		ScanForDirectImports = false;
 		ScanForNormalImports = true;
 	}
 
 	~IATReferenceScan()
 	{
 		iatReferenceList.clear();
 		iatDirectImportList.clear();
 
 		if (iatBackup)
 		{
 			free(iatBackup);
 		}
 	}
 
 	bool ScanForDirectImports;
 	bool ScanForNormalImports;
 	bool JunkByteAfterInstruction;
+	ApiReader * apiReader;
 
 	void startScan(DWORD_PTR imageBase, DWORD imageSize, DWORD_PTR iatAddress, DWORD iatSize);
 	//void patchNewIatBaseMemory(DWORD_PTR newIatBaseAddress);
 	//void patchNewIatBaseFile(DWORD_PTR newIatBaseAddress);
 
 	void patchNewIat(DWORD_PTR stdImagebase, DWORD_PTR newIatBaseAddress, PeParser * peParser);
+	void patchDirectJumpTable( DWORD_PTR imageBase, DWORD directImportsJumpTableRVA, PeParser * peParser, BYTE * jmpTableMemory, DWORD newIatBase);
 	void patchDirectImportsMemory(bool junkByteAfterInstruction);
 	int numberOfFoundDirectImports();
-
+	int getSizeInBytesOfJumpTableInSection();
 	static FileLog directImportLog;
 	void printDirectImportLog();
+	void changeIatBaseOfDirectImports( DWORD newIatBaseAddressRVA );
 private:
 	DWORD_PTR NewIatAddressRVA;
 
 	DWORD_PTR IatAddressVA;
 	DWORD IatSize;
 	DWORD_PTR ImageBase;
 	DWORD ImageSize;
 
 
 	DWORD_PTR * iatBackup;
 
 	std::vector<IATReference> iatReferenceList;
 	std::vector<IATReference> iatDirectImportList;
 
 	bool isPageExecutable( DWORD Protect );
 	void scanMemoryPage( PVOID BaseAddress, SIZE_T RegionSize );
 	void analyzeInstruction( _DInst * instruction );
 	void findNormalIatReference( _DInst * instruction );
 	void getIatEntryAddress( IATReference* ref );
 	void findDirectIatReferenceCallJmp( _DInst * instruction );
 	bool isAddressValidImageMemory( DWORD_PTR address );
 	void patchReferenceInMemory( IATReference * ref );
 	void patchReferenceInFile( IATReference* ref );
 	void patchDirectImportInMemory( IATReference * iter );
 	DWORD_PTR lookUpIatForPointer( DWORD_PTR addr );
 	void findDirectIatReferenceMov( _DInst * instruction );
+	void findDirectIatReferencePush( _DInst * instruction );
+	void checkMemoryRangeAndAddToList( IATReference * ref, _DInst * instruction );
+	void findDirectIatReferenceLea( _DInst * instruction );
+	void patchDirectImportInDump32( int patchPreFixBytes, int instructionSize, DWORD patchBytes, BYTE * memory, DWORD memorySize, bool generateReloc, DWORD patchOffset, DWORD sectionRVA );
+
+
 };
 
 /*
 PE64
 ----------
 000000013FF82D87 FF15 137C0A00 CALL QWORD [RIP+0xA7C13]
 Result: 000000014002A9A0
 
 000000013F65C952 FF25 F8EA0B00 JMP QWORD [RIP+0xBEAF8]
 Result: 000000013F71B450
 
 PE32
 ----------
 0120FFA5 FF15 8C6D2601 CALL DWORD [0x01266D8C]
 
 0120FF52 FF25 D4722601 JMP DWORD [0x012672D4]
 */
 
diff --git a/Scylla/IATSearch.cpp b/Scylla/IATSearch.cpp
index c49e7d5..def09a9 100644
--- a/Scylla/IATSearch.cpp
+++ b/Scylla/IATSearch.cpp
@@ -1,532 +1,538 @@
 #include "IATSearch.h"
 #include "Scylla.h"
 #include "Architecture.h"
 
 
 //#define DEBUG_COMMENTS
 
 bool IATSearch::searchImportAddressTableInProcess( DWORD_PTR startAddress, DWORD_PTR* addressIAT, DWORD* sizeIAT, bool advanced )
 {
 	DWORD_PTR addressInIAT = 0;
 
 	*addressIAT = 0;
 	*sizeIAT = 0;
 
 	if (advanced)
 	{
 		return findIATAdvanced(startAddress, addressIAT, sizeIAT);
 	}
 	
 	addressInIAT = findAPIAddressInIAT(startAddress);
 	
 
 	if(!addressInIAT)
 	{
 #ifdef DEBUG_COMMENTS
 		Scylla::debugLog.log(L"searchImportAddressTableInProcess :: addressInIAT not found, startAddress " PRINTF_DWORD_PTR_FULL, startAddress);
 #endif
 		return false;
 	}
 	else
 	{
 		return findIATStartAndSize(addressInIAT, addressIAT,sizeIAT);
 	}
 }
 
 bool IATSearch::findIATAdvanced( DWORD_PTR startAddress, DWORD_PTR* addressIAT, DWORD* sizeIAT )
 {
 	BYTE *dataBuffer;
 	DWORD_PTR baseAddress;
 	SIZE_T memorySize;
 
 	findExecutableMemoryPagesByStartAddress(startAddress, &baseAddress, &memorySize);
 
 	if (memorySize == 0)
 		return false;
 
 	dataBuffer = new BYTE[memorySize];
 
 	if (!readMemoryFromProcess((DWORD_PTR)baseAddress, memorySize,dataBuffer))
 	{
 #ifdef DEBUG_COMMENTS
 		Scylla::debugLog.log(L"findAPIAddressInIAT2 :: error reading memory");
 #endif
 		return false;
 	}
 
 	std::set<DWORD_PTR> iatPointers;
 	DWORD_PTR next;
 	BYTE * tempBuf = dataBuffer;
 	while(decomposeMemory(tempBuf, memorySize, (DWORD_PTR)baseAddress) && decomposerInstructionsCount != 0)
 	{
 		findIATPointers(iatPointers);
 
 		next = (DWORD_PTR)(decomposerResult[decomposerInstructionsCount - 1].addr - baseAddress);
 		next += decomposerResult[decomposerInstructionsCount - 1].size;
 		// Advance ptr and recalc offset.
 		tempBuf += next;
 
 		if (memorySize <= next)
 		{
 			break;
 		}
 		memorySize -= next;
 		baseAddress += next;
 	}
 
 	if (iatPointers.size() == 0)
 		return false;
 
 	filterIATPointersList(iatPointers);
 
 	*addressIAT = *(iatPointers.begin());
 	*sizeIAT = (DWORD)(*(--iatPointers.end()) - *(iatPointers.begin()) + sizeof(DWORD_PTR));
 
 	Scylla::windowLog.log(L"IAT Search Advanced: Found %d (0x%X) possible IAT entries.", iatPointers.size(), iatPointers.size());
 	Scylla::windowLog.log(L"IAT Search Advanced: Possible IAT first " PRINTF_DWORD_PTR_FULL L" last " PRINTF_DWORD_PTR_FULL L" entry.", *(iatPointers.begin()), *(--iatPointers.end()));
 
 	delete [] dataBuffer;
 
 	return true;
 }
 
 DWORD_PTR IATSearch::findAPIAddressInIAT(DWORD_PTR startAddress)
 {
 	const size_t MEMORY_READ_SIZE = 200;
 	BYTE dataBuffer[MEMORY_READ_SIZE];
 
 	DWORD_PTR iatPointer = 0;
 	int counter = 0;
 
 	// to detect stolen api
 	memoryAddress = 0;
 	memorySize = 0;
 
 	do 
 	{
 		counter++;
 
 		if (!readMemoryFromProcess(startAddress, sizeof(dataBuffer), dataBuffer))
 		{
 #ifdef DEBUG_COMMENTS
 			Scylla::debugLog.log(L"findAPIAddressInIAT :: error reading memory " PRINTF_DWORD_PTR_FULL, startAddress);
 #endif
 			return 0;
 		}
 
 		if (decomposeMemory(dataBuffer, sizeof(dataBuffer), startAddress))
 		{
 			iatPointer = findIATPointer();
 			if (iatPointer)
 			{
 				if (isIATPointerValid(iatPointer))
 				{
 					return iatPointer;
 				}
 			}
 		}
 
 		startAddress = findNextFunctionAddress();
 		//printf("startAddress %08X\n",startAddress);
 	} while (startAddress != 0 && counter != 8);
 
 	return 0;
 }
 
 DWORD_PTR IATSearch::findNextFunctionAddress()
 {
 #ifdef DEBUG_COMMENTS
 	_DecodedInst inst;
 #endif
 
 	for (unsigned int i = 0; i < decomposerInstructionsCount; i++)
 	{
 
 		if (decomposerResult[i].flags != FLAG_NOT_DECODABLE)
 		{
 			if (META_GET_FC(decomposerResult[i].meta) == FC_CALL || META_GET_FC(decomposerResult[i].meta) == FC_UNC_BRANCH)
 			{
 				if (decomposerResult[i].size >= 5)
 				{
 					if (decomposerResult[i].ops[0].type == O_PC)
 					{
 #ifdef DEBUG_COMMENTS
 						distorm_format(&decomposerCi, &decomposerResult[i], &inst);
 						Scylla::debugLog.log(L"%S %S %d %d - target address: " PRINTF_DWORD_PTR_FULL, inst.mnemonic.p, inst.operands.p, decomposerResult[i].ops[0].type, decomposerResult[i].size, INSTRUCTION_GET_TARGET(&decomposerResult[i]));
 #endif
 						return (DWORD_PTR)INSTRUCTION_GET_TARGET(&decomposerResult[i]);
 					}
 				}
 			}
 		}
 	}
 
 	return 0;
 }
 
 DWORD_PTR IATSearch::findIATPointer()
 {
 #ifdef DEBUG_COMMENTS
 	_DecodedInst inst;
 #endif
 
 	for (unsigned int i = 0; i < decomposerInstructionsCount; i++)
 	{
 		if (decomposerResult[i].flags != FLAG_NOT_DECODABLE)
 		{
 			if (META_GET_FC(decomposerResult[i].meta) == FC_CALL || META_GET_FC(decomposerResult[i].meta) == FC_UNC_BRANCH)
 			{
 				if (decomposerResult[i].size >= 5)
 				{
 #ifdef _WIN64
 					if (decomposerResult[i].flags & FLAG_RIP_RELATIVE)
 					{
 #ifdef DEBUG_COMMENTS
 						distorm_format(&decomposerCi, &decomposerResult[i], &inst);
 						Scylla::debugLog.log(L"%S %S %d %d - target address: " PRINTF_DWORD_PTR_FULL, inst.mnemonic.p, inst.operands.p, decomposerResult[i].ops[0].type, decomposerResult[i].size, INSTRUCTION_GET_RIP_TARGET(&decomposerResult[i]));
 #endif
 						return INSTRUCTION_GET_RIP_TARGET(&decomposerResult[i]);
 					}
 #else
 					if (decomposerResult[i].ops[0].type == O_DISP)
 					{
 						//jmp dword ptr || call dword ptr
 #ifdef DEBUG_COMMENTS
 						distorm_format(&decomposerCi, &decomposerResult[i], &inst);
 						Scylla::debugLog.log(L"%S %S %d %d - target address: " PRINTF_DWORD_PTR_FULL, inst.mnemonic.p, inst.operands.p, decomposerResult[i].ops[0].type, decomposerResult[i].size, decomposerResult[i].disp);
 #endif
 						return (DWORD_PTR)decomposerResult[i].disp;
 					}
 #endif
 				}
 			}
 		}
 	}
 
 	return 0;
 }
 
 bool IATSearch::isIATPointerValid(DWORD_PTR iatPointer)
 {
 	DWORD_PTR apiAddress = 0;
 
 	if (!readMemoryFromProcess(iatPointer,sizeof(DWORD_PTR),&apiAddress))
 	{
 #ifdef DEBUG_COMMENTS
 		Scylla::debugLog.log(L"isIATPointerValid :: error reading memory");
 #endif
 		return false;
 	}
 
 	//printf("Win api ? %08X\n",apiAddress);
 
 	if (isApiAddressValid(apiAddress) != 0)
 	{
 		return true;
 	}
 	else
 	{
 		//maybe redirected import?
 		//if the address is 2 times inside a memory region it is possible a redirected api
 		if (apiAddress > memoryAddress && apiAddress < (memoryAddress+memorySize))
 		{
 			return true;
 		}
 		else
 		{
 			getMemoryRegionFromAddress(apiAddress, &memoryAddress, &memorySize);
 			return false;
 		}
 		
 	}
 }
 
 bool IATSearch::isPageExecutable(DWORD value)
 {
 	if (value & PAGE_NOCACHE) value ^= PAGE_NOCACHE;
 
 	if (value & PAGE_WRITECOMBINE) value ^= PAGE_WRITECOMBINE;
 
 	switch(value)
 	{
 	case PAGE_EXECUTE:
 		{
 			return true;
 		}
 	case PAGE_EXECUTE_READ:
 		{
 			return true;
 		}
 	case PAGE_EXECUTE_READWRITE:
 		{
 			return true;
 		}
 	case PAGE_EXECUTE_WRITECOPY:
 		{
 			return true;
 		}
 	default:
 		return false;
 	}
 }
 
 bool IATSearch::findIATStartAndSize(DWORD_PTR address, DWORD_PTR * addressIAT, DWORD * sizeIAT)
 {
 	MEMORY_BASIC_INFORMATION memBasic = {0};
 	BYTE *dataBuffer = 0;
 
 	if (VirtualQueryEx(hProcess,(LPCVOID)address, &memBasic, sizeof(MEMORY_BASIC_INFORMATION)) != sizeof(MEMORY_BASIC_INFORMATION))
 	{
 #ifdef DEBUG_COMMENTS
 		Scylla::debugLog.log(L"findIATStartAddress :: VirtualQueryEx error %u", GetLastError());
 #endif
 		return false;
 	}
 
 
 	//(sizeof(DWORD_PTR) * 3) added to prevent buffer overflow
 	dataBuffer = new BYTE[memBasic.RegionSize + (sizeof(DWORD_PTR) * 3)];
 
 	ZeroMemory(dataBuffer, memBasic.RegionSize + (sizeof(DWORD_PTR) * 3));
 
 	if (!readMemoryFromProcess((DWORD_PTR)memBasic.BaseAddress, memBasic.RegionSize, dataBuffer))
 	{
 #ifdef DEBUG_COMMENTS
 		Scylla::debugLog.log(L"findIATStartAddress :: error reading memory");
 #endif
 		return false;
 	}
 
 	//printf("address %X memBasic.BaseAddress %X memBasic.RegionSize %X\n",address,memBasic.BaseAddress,memBasic.RegionSize);
 
 	*addressIAT = findIATStartAddress((DWORD_PTR)memBasic.BaseAddress, address, dataBuffer);
 
 	*sizeIAT = findIATSize((DWORD_PTR)memBasic.BaseAddress, *addressIAT, dataBuffer, (DWORD)memBasic.RegionSize);
 
 	delete [] dataBuffer;
 
 	return true;
 }
 
 DWORD_PTR IATSearch::findIATStartAddress(DWORD_PTR baseAddress, DWORD_PTR startAddress, BYTE * dataBuffer)
 {
 	DWORD_PTR *pIATAddress = 0;
 
 	pIATAddress = (DWORD_PTR *)((startAddress - baseAddress) + (DWORD_PTR)dataBuffer);
 
 	while((DWORD_PTR)pIATAddress != (DWORD_PTR)dataBuffer)
 	{
 		if ( (*pIATAddress < 0xFFFF) || !isAddressAccessable(*pIATAddress) )
 		{
 			if ( (*(pIATAddress - 1) < 0xFFFF) || !isAddressAccessable(*(pIATAddress - 1)) )
 			{
 				//IAT end
 
 				if ((DWORD_PTR)(pIATAddress - 2) >= (DWORD_PTR)dataBuffer)
 				{
 					if (!isApiAddressValid(*(pIATAddress - 2)))
 					{
 						return (((DWORD_PTR)pIATAddress - (DWORD_PTR)dataBuffer) + baseAddress);
 					}
 				}
 				else
 				{
 					return (((DWORD_PTR)pIATAddress - (DWORD_PTR)dataBuffer) + baseAddress);
 				}
 			}
 		}
 
 		pIATAddress--;
 	}
 
 	return baseAddress;
 }
 
 DWORD IATSearch::findIATSize(DWORD_PTR baseAddress, DWORD_PTR iatAddress, BYTE * dataBuffer, DWORD bufferSize)
 {
 	DWORD_PTR *pIATAddress = 0;
 
 	pIATAddress = (DWORD_PTR *)((iatAddress - baseAddress) + (DWORD_PTR)dataBuffer);
 
 #ifdef DEBUG_COMMENTS
 	Scylla::debugLog.log(L"findIATSize :: baseAddress %X iatAddress %X dataBuffer %X pIATAddress %X", baseAddress, iatAddress, dataBuffer, pIATAddress);
 #endif
 
 	while((DWORD_PTR)pIATAddress < ((DWORD_PTR)dataBuffer + bufferSize - 1))
 	{
 #ifdef DEBUG_COMMENTS
 		Scylla::debugLog.log(L"findIATSize :: %X %X %X", pIATAddress, *pIATAddress, *(pIATAddress + 1));
 #endif
 		if ( (*pIATAddress < 0xFFFF) || !isAddressAccessable(*pIATAddress) ) //normal is 0
 		{
 			if ( (*(pIATAddress + 1) < 0xFFFF) || !isAddressAccessable(*(pIATAddress + 1)) )
 			{
 				//IAT end
 				if (!isApiAddressValid(*(pIATAddress + 2)))
 				{
 					return (DWORD)((DWORD_PTR)pIATAddress - (DWORD_PTR)dataBuffer - (iatAddress - baseAddress));
 				}
 			}
 		}
 
 		pIATAddress++;
 	}
 
 	return bufferSize;
 }
 
 bool IATSearch::isAddressAccessable(DWORD_PTR address)
 {
 	BYTE junk[3];
 	SIZE_T numberOfBytesRead = 0;
 
 	if (ReadProcessMemory(hProcess, (LPCVOID)address, junk, sizeof(junk), &numberOfBytesRead))
 	{
 		if (numberOfBytesRead == sizeof(junk))
 		{
 			if (junk[0] != 0x00)
 			{
 				return true;
 			}
 		}
 	}
 
 	return false;
 }
 
 void IATSearch::findIATPointers(std::set<DWORD_PTR> & iatPointers)
 {
 #ifdef DEBUG_COMMENTS
 	_DecodedInst inst;
 #endif
 
 	for (unsigned int i = 0; i < decomposerInstructionsCount; i++)
 	{
 		if (decomposerResult[i].flags != FLAG_NOT_DECODABLE)
 		{
 			if (META_GET_FC(decomposerResult[i].meta) == FC_CALL || META_GET_FC(decomposerResult[i].meta) == FC_UNC_BRANCH)
 			{
 				if (decomposerResult[i].size >= 5)
 				{
 #ifdef _WIN64
 					if (decomposerResult[i].flags & FLAG_RIP_RELATIVE)
 					{
 #ifdef DEBUG_COMMENTS
 						distorm_format(&decomposerCi, &decomposerResult[i], &inst);
 						Scylla::debugLog.log(L"%S %S %d %d - target address: " PRINTF_DWORD_PTR_FULL, inst.mnemonic.p, inst.operands.p, decomposerResult[i].ops[0].type, decomposerResult[i].size, INSTRUCTION_GET_RIP_TARGET(&decomposerResult[i]));
 #endif
 						iatPointers.insert(INSTRUCTION_GET_RIP_TARGET(&decomposerResult[i]));
 					}
 #else
 					if (decomposerResult[i].ops[0].type == O_DISP)
 					{
 						//jmp dword ptr || call dword ptr
 #ifdef DEBUG_COMMENTS
 						distorm_format(&decomposerCi, &decomposerResult[i], &inst);
 						Scylla::debugLog.log(L"%S %S %d %d - target address: " PRINTF_DWORD_PTR_FULL, inst.mnemonic.p, inst.operands.p, decomposerResult[i].ops[0].type, decomposerResult[i].size, decomposerResult[i].disp);
 #endif
 						iatPointers.insert((DWORD_PTR)decomposerResult[i].disp);
 					}
 #endif
 				}
 			}
 		}
 	}
 
 
 }
 
 void IATSearch::findExecutableMemoryPagesByStartAddress( DWORD_PTR startAddress, DWORD_PTR* baseAddress, SIZE_T* memorySize )
 {
 	MEMORY_BASIC_INFORMATION memBasic = {0};
 	DWORD_PTR tempAddress;
 
 	*memorySize = 0;
 	*baseAddress = 0;
 
 	if (VirtualQueryEx(hProcess,(LPCVOID)startAddress, &memBasic, sizeof(MEMORY_BASIC_INFORMATION)) != sizeof(MEMORY_BASIC_INFORMATION))
 	{
 #ifdef DEBUG_COMMENTS
 		Scylla::debugLog.log(L"findIATStartAddress :: VirtualQueryEx error %u", GetLastError());
 #endif
 		return;
 	}
 
 	//search down
 	do
 	{
 		*memorySize = memBasic.RegionSize;
 		*baseAddress = (DWORD_PTR)memBasic.BaseAddress;
 		tempAddress = (DWORD_PTR)memBasic.BaseAddress - 1;
 
 		if (VirtualQueryEx(hProcess, (LPCVOID)tempAddress, &memBasic, sizeof(MEMORY_BASIC_INFORMATION)) != sizeof(MEMORY_BASIC_INFORMATION))
 		{
 			break;
 		}
 	} while (isPageExecutable(memBasic.Protect));
 
 	tempAddress = *baseAddress;
 	memBasic.RegionSize = *memorySize;
 	*memorySize = 0;
 	//search up
 	do
 	{
 		tempAddress += memBasic.RegionSize;
 		*memorySize += memBasic.RegionSize;
 
 		if (VirtualQueryEx(hProcess, (LPCVOID)tempAddress, &memBasic, sizeof(MEMORY_BASIC_INFORMATION)) != sizeof(MEMORY_BASIC_INFORMATION))
 		{
 			break;
 		}
 	} while (isPageExecutable(memBasic.Protect));
 }
 
 void IATSearch::filterIATPointersList( std::set<DWORD_PTR> & iatPointers )
 {
 	std::set<DWORD_PTR>::iterator iter;
+
+	if (iatPointers.size() <= 2)
+	{
+		return;
+	}
+
 	iter = iatPointers.begin();
 	std::advance(iter, iatPointers.size() / 2); //start in the middle, important!
 
 	DWORD_PTR lastPointer = *iter;
 	iter++;
 
 	for (; iter != iatPointers.end(); iter++)
 	{
 		if ((*iter - lastPointer) > 0x100) //check difference
 		{
 			iatPointers.erase(iter, iatPointers.end());
 			break;
 		}
 		else
 		{
 			lastPointer = *iter;
 		}
 	}
 
 
 	bool erased = true;
 
 	while(erased)
 	{
 		iter = iatPointers.begin();
 		lastPointer = *iter;
 		iter++;
 
 		for (; iter != iatPointers.end(); iter++)
 		{
 			if ((*iter - lastPointer) > 0x100) //check difference
 			{
 				iter--;
 				iatPointers.erase(iter);
 				erased = true;
 				break;
 			}
 			else
 			{
 				erased = false;
 				lastPointer = *iter;
 			}
 		}
 	}
 
 }
diff --git a/Scylla/ImportRebuilder.cpp b/Scylla/ImportRebuilder.cpp
index 30f02fd..e174fdc 100644
--- a/Scylla/ImportRebuilder.cpp
+++ b/Scylla/ImportRebuilder.cpp
@@ -1,422 +1,486 @@
 
 #include "ImportRebuilder.h"
 #include "Scylla.h"
 #include "StringConversion.h"
 
 //#define DEBUG_COMMENTS
 
+/*
+New Scylla section contains:
+
+1. (optional) direct imports jump table
+2. (optional) new iat
+3. (optional) OFT
+4. Normal IAT entries
+
+*/
 
 bool ImportRebuilder::rebuildImportTable(const WCHAR * newFilePath, std::map<DWORD_PTR, ImportModuleThunk> & moduleList)
 {
 	bool retValue = false;
 
+	std::map<DWORD_PTR, ImportModuleThunk> copyModule;
+	copyModule.insert(moduleList.begin(), moduleList.end());
+
 	if (isValidPeFile())
 	{
 		if (readPeSectionsFromFile())
 		{
 			setDefaultFileAlignment();
 
-			retValue = buildNewImportTable(moduleList);
+			retValue = buildNewImportTable(copyModule);
 
 			if (retValue)
 			{
 				alignAllSectionHeaders();
 				fixPeHeader();
 
 				if (newIatInSection)
 				{
 					patchFileForNewIatLocation();
 				}
 
+				if (BuildDirectImportsJumpTable)
+				{
+					patchFileForDirectImportJumpTable();
+				}
+
 				retValue = savePeFileToDisk(newFilePath);
 			}
 		}
 	}
 
 	return retValue;
 }
 
 bool ImportRebuilder::buildNewImportTable(std::map<DWORD_PTR, ImportModuleThunk> & moduleList)
 {
 	createNewImportSection(moduleList);
 
 	importSectionIndex = listPeSection.size() - 1;
 
+	if (BuildDirectImportsJumpTable)
+	{
+		directImportsJumpTableRVA = listPeSection[importSectionIndex].sectionHeader.VirtualAddress;
+		JMPTableMemory = listPeSection[importSectionIndex].data;
+	}
+
 	if (newIatInSection)
 	{
+		newIatBaseAddressRVA = listPeSection[importSectionIndex].sectionHeader.VirtualAddress;
+
+		if (BuildDirectImportsJumpTable)
+		{
+			newIatBaseAddressRVA += iatReferenceScan->getSizeInBytesOfJumpTableInSection();
+		}
+
 		changeIatBaseAddress(moduleList);
 	}
 
 	DWORD dwSize = fillImportSection(moduleList);
 
 	if (!dwSize)
 	{
 		return false;
 	}
 
 	setFlagToIATSection((*moduleList.begin()).second.firstThunk);
 
 	DWORD vaImportAddress = listPeSection[importSectionIndex].sectionHeader.VirtualAddress;
 
 	if (useOFT)
 	{
 		//OFT array is at the beginning of the import section
 		vaImportAddress += (DWORD)sizeOfOFTArray;
 	}
 	if (newIatInSection)
 	{
 		vaImportAddress += (DWORD)IatSize;
 	}
 
+	if (BuildDirectImportsJumpTable)
+	{
+		vaImportAddress += (DWORD)iatReferenceScan->getSizeInBytesOfJumpTableInSection();
+	}
+
 	if (isPE32())
 	{
 		pNTHeader32->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress = vaImportAddress;
 		pNTHeader32->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].Size = (DWORD)(numberOfImportDescriptors * sizeof(IMAGE_IMPORT_DESCRIPTOR));
 	}
 	else
 	{
 		pNTHeader64->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress = vaImportAddress;
 		pNTHeader64->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].Size = (DWORD)(numberOfImportDescriptors * sizeof(IMAGE_IMPORT_DESCRIPTOR));
 	}
 
 
 	return true;
 }
 
 bool ImportRebuilder::createNewImportSection(std::map<DWORD_PTR, ImportModuleThunk> & moduleList)
 {
 	char sectionName[IMAGE_SIZEOF_SHORT_NAME + 1] = {0};
 
 	const WCHAR * sectionNameW = Scylla::config[IAT_SECTION_NAME].getString();
 
 	calculateImportSizes(moduleList);
 
 	if (wcslen(sectionNameW) > IMAGE_SIZEOF_SHORT_NAME)
 	{
 		strcpy_s(sectionName, ".SCY");
 	}
 	else
 	{
 		StringConversion::ToASCII(sectionNameW, sectionName, _countof(sectionName));
 	}
 
 	if (newIatInSection)
 	{
 		sizeOfImportSection += IatSize;
 	}
+	if (BuildDirectImportsJumpTable)
+	{
+		sizeOfImportSection += iatReferenceScan->getSizeInBytesOfJumpTableInSection();
+	}
 	
 	return addNewLastSection(sectionName, (DWORD)sizeOfImportSection, 0);
 }
 
 void ImportRebuilder::setFlagToIATSection(DWORD_PTR iatAddress)
 {
 	for (size_t i = 0; i < listPeSection.size(); i++)
 	{
 		if ((listPeSection[i].sectionHeader.VirtualAddress <= iatAddress) && ((listPeSection[i].sectionHeader.VirtualAddress + listPeSection[i].sectionHeader.Misc.VirtualSize) > iatAddress))
 		{
 			//section must be read and writeable
 			listPeSection[i].sectionHeader.Characteristics |= IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE;
 		}
 	}
 }
 
 DWORD ImportRebuilder::fillImportSection(std::map<DWORD_PTR, ImportModuleThunk> & moduleList)
 {
 	std::map<DWORD_PTR, ImportModuleThunk>::iterator mapIt;
 	std::map<DWORD_PTR, ImportThunk>::iterator mapIt2;
 	PIMAGE_IMPORT_DESCRIPTOR pImportDesc = 0;
 	PIMAGE_IMPORT_BY_NAME pImportByName = 0;
 	PIMAGE_THUNK_DATA pThunk = 0;
 	ImportModuleThunk * importModuleThunk = 0;
 	ImportThunk * importThunk = 0;
 
 	size_t stringLength = 0;
 	DWORD_PTR lastRVA = 0;
 
 	BYTE * sectionData = listPeSection[importSectionIndex].data;
 	DWORD offset = 0;
 	DWORD offsetOFTArray = 0;
 
-	if (useOFT)
+	/*
+	New Scylla section contains:
+
+	1. (optional) direct imports jump table
+	2. (optional) new iat
+	3. (optional) OFT
+	4. Normal IAT entries
+
+	*/
+	if (BuildDirectImportsJumpTable)
 	{
-		//OFT Array is always at the beginning of the import section
-		offset = (DWORD)sizeOfOFTArray; //size includes null termination
+		offset += iatReferenceScan->getSizeInBytesOfJumpTableInSection();
+		offsetOFTArray += iatReferenceScan->getSizeInBytesOfJumpTableInSection();
 	}
-
 	if (newIatInSection)
 	{
 		offset += IatSize; //new iat at the beginning
+		offsetOFTArray += IatSize;
+		memset(sectionData, 0xFF, offset);
+	}
+	if (useOFT)
+	{
+		offset += (DWORD)sizeOfOFTArray; //size includes null termination
 	}
 
 	pImportDescriptor = (PIMAGE_IMPORT_DESCRIPTOR)((DWORD_PTR)sectionData + offset);
 
 	//skip the IMAGE_IMPORT_DESCRIPTOR
 	offset += (DWORD)(numberOfImportDescriptors * sizeof(IMAGE_IMPORT_DESCRIPTOR));
 
 	for ( mapIt = moduleList.begin() ; mapIt != moduleList.end(); mapIt++ )
 	{
 		importModuleThunk = &((*mapIt).second);
 
 		stringLength = addImportDescriptor(importModuleThunk, offset, offsetOFTArray);
 
 #ifdef DEBUG_COMMENTS
 		Scylla::debugLog.log(L"fillImportSection :: importDesc.Name %X", pImportDescriptor->Name);
 #endif
 
 		offset += (DWORD)stringLength; //stringLength has null termination char
 
 		pImportByName = (PIMAGE_IMPORT_BY_NAME)((DWORD_PTR)sectionData + offset);
 
 		//pThunk = (PIMAGE_THUNK_DATA)(getMemoryPointerFromRVA(importModuleThunk->firstThunk));
 
 		lastRVA = importModuleThunk->firstThunk - sizeof(DWORD_PTR);
 
 		for ( mapIt2 = (*mapIt).second.thunkList.begin() ; mapIt2 != (*mapIt).second.thunkList.end(); mapIt2++ )
 		{
 			importThunk = &((*mapIt2).second);
 
 			if (useOFT)
 			{
-				//OFT Array is always at the beginning of the import section
 				pThunk = (PIMAGE_THUNK_DATA)((DWORD_PTR)sectionData + offsetOFTArray);
 				offsetOFTArray += sizeof(DWORD_PTR); //increase OFT array index
 			}
 			else
 			{
 				pThunk = (PIMAGE_THUNK_DATA)(getMemoryPointerFromRVA(importThunk->rva));
 			}
 
 			//check wrong iat pointer
 			if (!pThunk)
 			{
 #ifdef DEBUG_COMMENTS
 				Scylla::debugLog.log(L"fillImportSection :: Failed to get pThunk RVA: %X", importThunk->rva);
 #endif
 				return 0;
 			}
 
 			if ((lastRVA + sizeof(DWORD_PTR)) != importThunk->rva)
 			{
 				//add additional import desc
 				addSpecialImportDescriptor(importThunk->rva, offsetOFTArray);
 				if (useOFT)
 				{
 					pThunk = (PIMAGE_THUNK_DATA)((DWORD_PTR)sectionData + offsetOFTArray);
 					offsetOFTArray += sizeof(DWORD_PTR); //increase OFT array index, next module
 				}				
 			}
 			lastRVA = importThunk->rva;
 
 #ifdef DEBUG_COMMENTS
 			Scylla::debugLog.log(L"fillImportSection :: importThunk %X pThunk %X pImportByName %X offset %X", importThunk,pThunk,pImportByName,offset);
 #endif
 			stringLength = addImportToImportTable(importThunk, pThunk, pImportByName, offset);
 
 			offset += (DWORD)stringLength; //is 0 bei import by ordinal
 			pImportByName = (PIMAGE_IMPORT_BY_NAME)((DWORD_PTR)pImportByName + stringLength);
 		}
 
 		offsetOFTArray += sizeof(DWORD_PTR); //increase OFT array index, next module
 		pImportDescriptor++;
 	}
 
 	return offset;
 }
 
 size_t ImportRebuilder::addImportDescriptor(ImportModuleThunk * pImportModule, DWORD sectionOffset, DWORD sectionOffsetOFTArray)
 {
 	char dllName[MAX_PATH];
 
 	StringConversion::ToASCII(pImportModule->moduleName, dllName, _countof(dllName));
 	size_t stringLength = strlen(dllName) + 1;
 
 	/*
 		Warning: stringLength MUST include null termination char
 	*/
 
 	memcpy((listPeSection[importSectionIndex].data + sectionOffset), dllName, stringLength); //copy module name to section
 
 	pImportDescriptor->FirstThunk = (DWORD)pImportModule->firstThunk;
 	pImportDescriptor->Name = (DWORD)convertOffsetToRVAVector(listPeSection[importSectionIndex].sectionHeader.PointerToRawData + sectionOffset);
 	
 	if (useOFT)
 	{
 		pImportDescriptor->OriginalFirstThunk = (DWORD)convertOffsetToRVAVector(listPeSection[importSectionIndex].sectionHeader.PointerToRawData + sectionOffsetOFTArray);
 	}
 
 	return stringLength;
 }
 
 void ImportRebuilder::addSpecialImportDescriptor(DWORD_PTR rvaFirstThunk, DWORD sectionOffsetOFTArray)
 {
 	PIMAGE_IMPORT_DESCRIPTOR oldID = pImportDescriptor;
 	pImportDescriptor++;
 
 	pImportDescriptor->FirstThunk = (DWORD)rvaFirstThunk;
 	pImportDescriptor->Name = oldID->Name;
 
 	if (useOFT)
 	{
 		pImportDescriptor->OriginalFirstThunk = (DWORD)convertOffsetToRVAVector(listPeSection[importSectionIndex].sectionHeader.PointerToRawData + sectionOffsetOFTArray);
 	}
 }
 
 void ImportRebuilder::calculateImportSizes(std::map<DWORD_PTR, ImportModuleThunk> & moduleList)
 {
 	std::map<DWORD_PTR, ImportModuleThunk>::iterator mapIt;
 	std::map<DWORD_PTR, ImportThunk>::iterator mapIt2;
 	DWORD_PTR lastRVA = 0;
 
 
 	sizeOfImportSection = 0;
 	sizeOfApiAndModuleNames = 0;
 	sizeOfOFTArray = 0;
 
 	numberOfImportDescriptors = moduleList.size() + 1; //last is zero'd
 
 	for ( mapIt = moduleList.begin() ; mapIt != moduleList.end(); mapIt++ )
 	{
 		lastRVA = (*mapIt).second.firstThunk - sizeof(DWORD_PTR);
 
 		sizeOfApiAndModuleNames += (DWORD)(wcslen((*mapIt).second.moduleName) + 1);
 
 		for ( mapIt2 = (*mapIt).second.thunkList.begin() ; mapIt2 != (*mapIt).second.thunkList.end(); mapIt2++ )
 		{
 			if ((lastRVA + sizeof(DWORD_PTR)) != (*mapIt2).second.rva)
 			{
 				numberOfImportDescriptors++; //add additional import desc
 				sizeOfOFTArray += sizeof(DWORD_PTR) + sizeof(DWORD_PTR);
 			}
 
 			if((*mapIt2).second.name[0] != '\0')
 			{
 				sizeOfApiAndModuleNames += sizeof(WORD); //Hint from IMAGE_IMPORT_BY_NAME
 				sizeOfApiAndModuleNames += (DWORD)(strlen((*mapIt2).second.name) + 1);
 			}
 
 			//OriginalFirstThunk Array in Import Section: value
 			sizeOfOFTArray += sizeof(DWORD_PTR);
 
 			lastRVA = (*mapIt2).second.rva;
 		}
 
 		//OriginalFirstThunk Array in Import Section: NULL termination
 		sizeOfOFTArray += sizeof(DWORD_PTR);
 	}
 
 	sizeOfImportSection = sizeOfOFTArray + sizeOfApiAndModuleNames + (numberOfImportDescriptors * sizeof(IMAGE_IMPORT_DESCRIPTOR));
 }
 
 size_t ImportRebuilder::addImportToImportTable( ImportThunk * pImport, PIMAGE_THUNK_DATA pThunk, PIMAGE_IMPORT_BY_NAME pImportByName, DWORD sectionOffset)
 {
 	size_t stringLength = 0;
 
 	if(pImport->name[0] == '\0')
 	{
 		pThunk->u1.AddressOfData = (IMAGE_ORDINAL(pImport->ordinal) | IMAGE_ORDINAL_FLAG);
 	}
 	else
 	{
 		pImportByName->Hint = pImport->hint;
 
 		stringLength = strlen(pImport->name) + 1;
 		memcpy(pImportByName->Name, pImport->name, stringLength);
 
 		pThunk->u1.AddressOfData = convertOffsetToRVAVector(listPeSection[importSectionIndex].sectionHeader.PointerToRawData + sectionOffset);
 
 		if (!pThunk->u1.AddressOfData)
 		{
 #ifdef DEBUG_COMMENTS
 			Scylla::debugLog.log(L"addImportToImportTable :: failed to get AddressOfData %X %X", listPeSection[importSectionIndex].sectionHeader.PointerToRawData, sectionOffset);
 #endif
 		}
 
 		//next import should be nulled
 		pThunk++;
 		pThunk->u1.AddressOfData = 0;
 
 #ifdef DEBUG_COMMENTS
 		Scylla::debugLog.log(L"addImportToImportTable :: pThunk->u1.AddressOfData %X %X %X", pThunk->u1.AddressOfData, pThunk, listPeSection[importSectionIndex].sectionHeader.PointerToRawData + sectionOffset);
 #endif
 		stringLength += sizeof(WORD);
 	}
 
 	return stringLength;
 }
 
 BYTE * ImportRebuilder::getMemoryPointerFromRVA(DWORD_PTR dwRVA)
 {
 	int peSectionIndex = convertRVAToOffsetVectorIndex(dwRVA);
 
 	if (peSectionIndex == -1)
 	{
 		return 0;
 	}
 
 	DWORD rvaPointer = ((DWORD)dwRVA - listPeSection[peSectionIndex].sectionHeader.VirtualAddress);
 	DWORD minSectionSize = rvaPointer + (sizeof(DWORD_PTR) * 2); //add space for 1 IAT address
 
 	if (listPeSection[peSectionIndex].data == 0 || listPeSection[peSectionIndex].dataSize == 0)
 	{
 		listPeSection[peSectionIndex].dataSize = minSectionSize; 
 		listPeSection[peSectionIndex].normalSize = minSectionSize;
 		listPeSection[peSectionIndex].data = new BYTE[listPeSection[peSectionIndex].dataSize];
 
 		listPeSection[peSectionIndex].sectionHeader.SizeOfRawData = listPeSection[peSectionIndex].dataSize;
 	}
 	else if(listPeSection[peSectionIndex].dataSize < minSectionSize)
 	{
 		BYTE * temp = new BYTE[minSectionSize];
 		memcpy(temp, listPeSection[peSectionIndex].data, listPeSection[peSectionIndex].dataSize);
 		delete [] listPeSection[peSectionIndex].data;
 
 		listPeSection[peSectionIndex].data = temp;
 		listPeSection[peSectionIndex].dataSize = minSectionSize;
 		listPeSection[peSectionIndex].normalSize = minSectionSize;
 
 		listPeSection[peSectionIndex].sectionHeader.SizeOfRawData = listPeSection[peSectionIndex].dataSize;
 	}
 
     return (BYTE *)((DWORD_PTR)listPeSection[peSectionIndex].data + rvaPointer);
 }
 
 void ImportRebuilder::enableOFTSupport()
 {
 	useOFT = true;
 }
 
 void ImportRebuilder::enableNewIatInSection(DWORD_PTR iatAddress, DWORD iatSize)
 {
 	newIatInSection = true;
 	IatAddress = iatAddress;
 	IatSize = iatSize;
 
-	iatRefScan.ScanForDirectImports = false;
-	iatRefScan.ScanForNormalImports = true;
+	iatReferenceScan->ScanForDirectImports = false;
+	iatReferenceScan->ScanForNormalImports = true;
 
-	iatRefScan.startScan(ProcessAccessHelp::targetImageBase, (DWORD)ProcessAccessHelp::targetSizeOfImage, IatAddress, IatSize);
+	iatReferenceScan->startScan(ProcessAccessHelp::targetImageBase, (DWORD)ProcessAccessHelp::targetSizeOfImage, IatAddress, IatSize);
 }
 
 void ImportRebuilder::patchFileForNewIatLocation()
 {
-	iatRefScan.patchNewIat(getStandardImagebase(), listPeSection[importSectionIndex].sectionHeader.VirtualAddress, (PeParser *)this);
+	iatReferenceScan->patchNewIat(getStandardImagebase(), newIatBaseAddressRVA, (PeParser *)this);
 }
 
 void ImportRebuilder::changeIatBaseAddress( std::map<DWORD_PTR, ImportModuleThunk> & moduleList )
 {
 	std::map<DWORD_PTR, ImportModuleThunk>::iterator mapIt;
 	std::map<DWORD_PTR, ImportThunk>::iterator mapIt2;
 
 	DWORD_PTR oldIatRva = IatAddress - ProcessAccessHelp::targetImageBase;
 
 	for ( mapIt = moduleList.begin() ; mapIt != moduleList.end(); mapIt++ )
 	{
-		(*mapIt).second.firstThunk = (*mapIt).second.firstThunk - oldIatRva + listPeSection[importSectionIndex].sectionHeader.VirtualAddress;
+		(*mapIt).second.firstThunk = (*mapIt).second.firstThunk - oldIatRva + newIatBaseAddressRVA;
 
 		for ( mapIt2 = (*mapIt).second.thunkList.begin() ; mapIt2 != (*mapIt).second.thunkList.end(); mapIt2++ )
 		{
-			(*mapIt2).second.rva = (*mapIt2).second.rva - oldIatRva + listPeSection[importSectionIndex].sectionHeader.VirtualAddress;
+			(*mapIt2).second.rva = (*mapIt2).second.rva - oldIatRva + newIatBaseAddressRVA;
 		}
 	}
 }
 
+void ImportRebuilder::patchFileForDirectImportJumpTable()
+{
+	if (newIatInSection)
+	{
+		iatReferenceScan->patchDirectJumpTable(getStandardImagebase(), directImportsJumpTableRVA, (PeParser *)this, JMPTableMemory, newIatBaseAddressRVA);
+	}
+	else
+	{
+		iatReferenceScan->patchDirectJumpTable(getStandardImagebase(), directImportsJumpTableRVA, (PeParser *)this, JMPTableMemory, 0);
+	}
+}
+
diff --git a/Scylla/ImportRebuilder.h b/Scylla/ImportRebuilder.h
index d4bfa9d..feb3ba2 100644
--- a/Scylla/ImportRebuilder.h
+++ b/Scylla/ImportRebuilder.h
@@ -1,60 +1,74 @@
 #pragma once
 
 #include <map>
 #include "PeParser.h"
 #include "Thunks.h"
 #include "IATReferenceScan.h"
 
 
 class ImportRebuilder : public PeParser {
 public:
 	ImportRebuilder(const WCHAR * file) : PeParser(file, true)
 	{
 		pImportDescriptor = 0;
 		pThunkData = 0;
 		pImportByName = 0;
 
 		numberOfImportDescriptors = 0;
 		sizeOfImportSection = 0;
 		sizeOfApiAndModuleNames = 0;
 		importSectionIndex = 0;
 		useOFT = false;
 		sizeOfOFTArray = 0;
+		newIatInSection = false;
+		BuildDirectImportsJumpTable = false;
+		sizeOfJumpTable = 0;
 	}
 
 	bool rebuildImportTable(const WCHAR * newFilePath, std::map<DWORD_PTR, ImportModuleThunk> & moduleList);
 	void enableOFTSupport();
 	void enableNewIatInSection(DWORD_PTR iatAddress, DWORD iatSize);
+
+	IATReferenceScan * iatReferenceScan;
+	bool BuildDirectImportsJumpTable;
 private:
 	PIMAGE_IMPORT_DESCRIPTOR pImportDescriptor;
 	PIMAGE_THUNK_DATA pThunkData;
 	PIMAGE_IMPORT_BY_NAME pImportByName;
 
 	size_t numberOfImportDescriptors;
 	size_t sizeOfImportSection;
 	size_t sizeOfApiAndModuleNames;
 	size_t importSectionIndex;
 
 	//OriginalFirstThunk Array in Import Section
 	size_t sizeOfOFTArray;
 	bool useOFT;
 	bool newIatInSection;
 	DWORD_PTR IatAddress;
+	
 	DWORD IatSize;
-	IATReferenceScan iatRefScan;
+
+	DWORD sizeOfJumpTable;
+
+	DWORD directImportsJumpTableRVA;
+	BYTE * JMPTableMemory;
+	DWORD newIatBaseAddressRVA;
+	
 
 	DWORD fillImportSection(std::map<DWORD_PTR, ImportModuleThunk> & moduleList);
 	BYTE * getMemoryPointerFromRVA(DWORD_PTR dwRVA);
 
 	bool createNewImportSection(std::map<DWORD_PTR, ImportModuleThunk> & moduleList);
 	bool buildNewImportTable(std::map<DWORD_PTR, ImportModuleThunk> & moduleList);
 	void setFlagToIATSection(DWORD_PTR iatAddress);
 	size_t addImportToImportTable( ImportThunk * pImport, PIMAGE_THUNK_DATA pThunk, PIMAGE_IMPORT_BY_NAME pImportByName, DWORD sectionOffset);
 	size_t addImportDescriptor(ImportModuleThunk * pImportModule, DWORD sectionOffset, DWORD sectionOffsetOFTArray);
 
 	void calculateImportSizes(std::map<DWORD_PTR, ImportModuleThunk> & moduleList);
 
 	void addSpecialImportDescriptor(DWORD_PTR rvaFirstThunk, DWORD sectionOffsetOFTArray);
 	void patchFileForNewIatLocation();
 	void changeIatBaseAddress( std::map<DWORD_PTR, ImportModuleThunk> & moduleList );
+	void patchFileForDirectImportJumpTable();
 };
\ No newline at end of file
diff --git a/Scylla/MainGui.cpp b/Scylla/MainGui.cpp
index 11b927e..4868117 100644
--- a/Scylla/MainGui.cpp
+++ b/Scylla/MainGui.cpp
@@ -1,1634 +1,1651 @@
 #include "MainGui.h"
 
 #include "Architecture.h"
 //#include "PluginLoader.h"
 //#include "ConfigurationHolder.h"
 #include "PeParser.h"
 #include "DllInjectionPlugin.h"
 #include "DisassemblerGui.h"
 #include "PickApiGui.h"
 //#include "NativeWinApi.h"
 #include "ImportRebuilder.h"
 #include "SystemInformation.h"
 #include "Scylla.h"
 #include "AboutGui.h"
 #include "DonateGui.h"
 #include "OptionsGui.h"
 #include "TreeImportExport.h"
-#include "IATReferenceScan.h"
 
 extern CAppModule _Module; // o_O
 
 const WCHAR MainGui::filterExe[]    = L"Executable (*.exe)\0*.exe\0All files\0*.*\0";
 const WCHAR MainGui::filterDll[]    = L"Dynamic Link Library (*.dll)\0*.dll\0All files\0*.*\0";
 const WCHAR MainGui::filterExeDll[] = L"Executable (*.exe)\0*.exe\0Dynamic Link Library (*.dll)\0*.dll\0All files\0*.*\0";
 const WCHAR MainGui::filterTxt[]    = L"Text file (*.txt)\0*.txt\0All files\0*.*\0";
 const WCHAR MainGui::filterXml[]    = L"XML file (*.xml)\0*.xml\0All files\0*.*\0";
 const WCHAR MainGui::filterMem[]    = L"MEM file (*.mem)\0*.mem\0All files\0*.*\0";
 
 MainGui::MainGui() : selectedProcess(0), isProcessSuspended(false), importsHandling(TreeImports), TreeImportsSubclass(this, IDC_TREE_IMPORTS)
 {
 	/*
 	Logger::getDebugLogFilePath();
 	ConfigurationHolder::loadConfiguration();
 	PluginLoader::findAllPlugins();
 	NativeWinApi::initialize();
 	SystemInformation::getSystemInformation();
 
 	if(ConfigurationHolder::getConfigObject(DEBUG_PRIVILEGE)->isTrue())
 	{
 		processLister.setDebugPrivileges();
 	}
 	
 
 	ProcessAccessHelp::getProcessModules(GetCurrentProcessId(), ProcessAccessHelp::ownModuleList);
 	*/
 
 	hIcon.LoadIcon(IDI_ICON_SCYLLA);
 	hMenuImports.LoadMenu(IDR_MENU_IMPORTS);
 	hMenuLog.LoadMenu(IDR_MENU_LOG);
 	accelerators.LoadAccelerators(IDR_ACCELERATOR_MAIN);
 
 	hIconCheck.LoadIcon(IDI_ICON_CHECK, 16, 16);
 	hIconWarning.LoadIcon(IDI_ICON_WARNING, 16, 16);
 	hIconError.LoadIcon(IDI_ICON_ERROR, 16, 16);
 }
 
 BOOL MainGui::PreTranslateMessage(MSG* pMsg)
 {
 	if(accelerators.TranslateAccelerator(m_hWnd, pMsg))
 	{
 		return TRUE; // handled keyboard shortcuts
 	}
 	else if(IsDialogMessage(pMsg))
 	{
 		return TRUE; // handled dialog messages
 	}
 
 	return FALSE;
 }
 
 void MainGui::InitDllStartWithPreSelect( PGUI_DLL_PARAMETER guiParam )
 {
 	ComboProcessList.ResetContent();
 	std::vector<Process>& processList = Scylla::processLister.getProcessListSnapshot();
 	int newSel = -1;
 	for (size_t i = 0; i < processList.size(); i++)
 	{
 		if (processList[i].PID == guiParam->dwProcessId)
 			newSel = (int)i;
 		swprintf_s(stringBuffer, L"0x%04X - %s - %s", processList[i].PID, processList[i].filename, processList[i].fullPath);
 		ComboProcessList.AddString(stringBuffer);
 	}
 	if (newSel != -1)
 	{
 		ComboProcessList.SetCurSel(newSel);
 		processSelectedActionHandler(newSel);
 
 		if (guiParam->mod) //init mod
 		{
 			//select DLL
 			size_t len = ProcessAccessHelp::moduleList.size();
 			newSel = -1;
 			for (size_t i = 0; i < len; i++)
 			{
 				if (ProcessAccessHelp::moduleList.at(i).modBaseAddr == (DWORD_PTR)guiParam->mod)
 				{
 					newSel = (int)i;
 					break;
 				}
 			}
 			if (newSel != -1)
 			{
 				//get selected module
 				ProcessAccessHelp::selectedModule = &ProcessAccessHelp::moduleList.at(newSel);
 
 				ProcessAccessHelp::targetImageBase = ProcessAccessHelp::selectedModule->modBaseAddr;
 				ProcessAccessHelp::targetSizeOfImage = ProcessAccessHelp::getSizeOfImageProcess(ProcessAccessHelp::hProcess, ProcessAccessHelp::targetImageBase);
 
 				DWORD modEntryPoint = ProcessAccessHelp::getEntryPointFromFile(ProcessAccessHelp::selectedModule->fullPath);
 
 				EditOEPAddress.SetValue(modEntryPoint + ProcessAccessHelp::targetImageBase);
 
 				Scylla::windowLog.log(L"->>> Module %s selected.", ProcessAccessHelp::selectedModule->getFilename());
 				Scylla::windowLog.log(L"Imagebase: " PRINTF_DWORD_PTR_FULL L" Size: %08X EntryPoint: %08X", ProcessAccessHelp::selectedModule->modBaseAddr, ProcessAccessHelp::selectedModule->modBaseSize, modEntryPoint);
 			}
 		}
 	}
 }
 
 BOOL MainGui::OnInitDialog(CWindow wndFocus, LPARAM lInitParam)
 {
 	if (SystemInformation::currenOS == UNKNOWN_OS)
 	{
 		if(IDCANCEL == MessageBox(L"Operating System is not supported\r\nContinue anyway?", L"Scylla", MB_ICONWARNING | MB_OKCANCEL))
 		{
 			SendMessage(WM_CLOSE);
 			return FALSE;
 		}
 	}
 
 	// register ourselves to receive PreTranslateMessage
 	CMessageLoop* pLoop = _Module.GetMessageLoop();
 	pLoop->AddMessageFilter(this);
 
 	setupStatusBar();
 
 	DoDataExchange(); // attach controls
 	DlgResize_Init(true, true); // init CDialogResize
 
 	Scylla::windowLog.setWindow(ListLog);
 
 	appendPluginListToMenu(hMenuImports.GetSubMenu(0));
 	appendPluginListToMenu(CMenuHandle(GetMenu()).GetSubMenu(MenuImportsOffsetTrace));
 
 	enableDialogControls(FALSE);
 	setIconAndDialogCaption();
 
 	if (lInitParam)
 	{
 		InitDllStartWithPreSelect((PGUI_DLL_PARAMETER)lInitParam);
 	}
 	return TRUE;
 }
 
 
 void MainGui::OnDestroy()
 {
 	PostQuitMessage(0);
 }
 
 void MainGui::OnSize(UINT nType, CSize size)
 {
 	StatusBar.SendMessage(WM_SIZE);
 	SetMsgHandled(FALSE);
 }
 
 void MainGui::OnContextMenu(CWindow wnd, CPoint point)
 { 
 	switch(wnd.GetDlgCtrlID())
 	{
 	case IDC_TREE_IMPORTS:
 		DisplayContextMenuImports(wnd, point);
 		return;
 	case IDC_LIST_LOG:
 		DisplayContextMenuLog(wnd, point);
 		return;
 	}
 
 	SetMsgHandled(FALSE);
 }
 
 void MainGui::OnCommand(UINT uNotifyCode, int nID, CWindow wndCtl)
 {
 	// Handle plugin trace menu selection
 	if(uNotifyCode == 0 && !wndCtl.IsWindow()) // make sure it's a menu
 	{
 		if ((nID >= PLUGIN_MENU_BASE_ID) && (nID <= (int)(Scylla::plugins.getScyllaPluginList().size() + Scylla::plugins.getImprecPluginList().size() + PLUGIN_MENU_BASE_ID)))
 		{
 			pluginActionHandler(nID);
 			return;
 		}
 	}
 	SetMsgHandled(FALSE);
 }
 
 LRESULT MainGui::OnTreeImportsDoubleClick(const NMHDR* pnmh)
 {
 	if(TreeImports.GetCount() < 1)
 		return 0;
 
 	// Get item under cursor
 	CTreeItem over = findTreeItem(CPoint(GetMessagePos()), true);
 	if(over && importsHandling.isImport(over))
 	{
 		pickApiActionHandler(over);
 	}
 
 	return 0;
 }
 
 LRESULT MainGui::OnTreeImportsKeyDown(const NMHDR* pnmh)
 {
 	const NMTVKEYDOWN * tkd = (NMTVKEYDOWN *)pnmh;
 	switch(tkd->wVKey)
 	{
 	case VK_RETURN:
 		{
 			CTreeItem selected = TreeImports.GetFocusItem();
 			if(!selected.IsNull() && importsHandling.isImport(selected))
 			{
 				pickApiActionHandler(selected);
 			}
 		}
 		return 1;
 	case VK_DELETE:
 		deleteSelectedImportsActionHandler();
 		return 1;
 	}
 
 	SetMsgHandled(FALSE);
 	return 0;
 }
 
 UINT MainGui::OnTreeImportsSubclassGetDlgCode(const MSG * lpMsg)
 {
 	if(lpMsg)
 	{
 		switch(lpMsg->wParam)
 		{
 		case VK_RETURN:
 			return DLGC_WANTMESSAGE;
 		}
 	}
 
 	SetMsgHandled(FALSE);
 	return 0;
 }
 
 void MainGui::OnTreeImportsSubclassChar(UINT nChar, UINT nRepCnt, UINT nFlags)
 {
 	switch(nChar)
 	{
 		case VK_RETURN:
 			break;
 		default:
 			SetMsgHandled(FALSE);
 			break;
 	}
 }
 
 void MainGui::OnProcessListDrop(UINT uNotifyCode, int nID, CWindow wndCtl)
 {
 	fillProcessListComboBox(ComboProcessList);
 }
 
 void MainGui::OnProcessListSelected(UINT uNotifyCode, int nID, CWindow wndCtl)
 {
-	processSelectedActionHandler(ComboProcessList.GetCurSel());
+	int index = ComboProcessList.GetCurSel();
+	if (index != CB_ERR)
+	{
+		processSelectedActionHandler(index);
+	}
 }
 
 void MainGui::OnPickDLL(UINT uNotifyCode, int nID, CWindow wndCtl)
 {
 	pickDllActionHandler();
 }
 
 void MainGui::OnOptions(UINT uNotifyCode, int nID, CWindow wndCtl)
 {
 	optionsActionHandler();
 }
 
 void MainGui::OnDump(UINT uNotifyCode, int nID, CWindow wndCtl)
 {
 	dumpActionHandler();
 }
 
 void MainGui::OnDumpMemory(UINT uNotifyCode, int nID, CWindow wndCtl)
 {
 	dumpMemoryActionHandler();
 }
 
 void MainGui::OnDumpSection(UINT uNotifyCode, int nID, CWindow wndCtl)
 {
 	dumpSectionActionHandler();
 }
 
 void MainGui::OnFixDump(UINT uNotifyCode, int nID, CWindow wndCtl)
 {
 	dumpFixActionHandler();
 }
 
 void MainGui::OnPERebuild(UINT uNotifyCode, int nID, CWindow wndCtl)
 {
 	peRebuildActionHandler();
 }
 
 void MainGui::OnDLLInject(UINT uNotifyCode, int nID, CWindow wndCtl)
 {
 	dllInjectActionHandler();
 }
 void MainGui::OnDisassembler(UINT uNotifyCode, int nID, CWindow wndCtl)
 {
 	disassemblerActionHandler();
 }
 
 void MainGui::OnIATAutoSearch(UINT uNotifyCode, int nID, CWindow wndCtl)
 {
 	iatAutosearchActionHandler();
 }
 
 void MainGui::OnGetImports(UINT uNotifyCode, int nID, CWindow wndCtl)
 {
 	getImportsActionHandler();
 }
 
 void MainGui::OnInvalidImports(UINT uNotifyCode, int nID, CWindow wndCtl)
 {
 	showInvalidImportsActionHandler();
 }
 
 void MainGui::OnSuspectImports(UINT uNotifyCode, int nID, CWindow wndCtl)
 {
 	showSuspectImportsActionHandler();
 }
 
 void MainGui::OnClearImports(UINT uNotifyCode, int nID, CWindow wndCtl)
 {
 	clearImportsActionHandler();
 }
 
 void MainGui::OnInvalidateSelected(UINT uNotifyCode, int nID, CWindow wndCtl)
 {
 	invalidateSelectedImportsActionHandler();
 }
 
 void MainGui::OnCutSelected(UINT uNotifyCode, int nID, CWindow wndCtl)
 {
 	deleteSelectedImportsActionHandler();
 }
 
 void MainGui::OnSaveTree(UINT uNotifyCode, int nID, CWindow wndCtl)
 {
 	saveTreeActionHandler();
 }
 
 void MainGui::OnLoadTree(UINT uNotifyCode, int nID, CWindow wndCtl)
 {
 	loadTreeActionHandler();
 }
 
 void MainGui::OnAutotrace(UINT uNotifyCode, int nID, CWindow wndCtl)
 {
 	// TODO
 }
 
 void MainGui::OnExit(UINT uNotifyCode, int nID, CWindow wndCtl)
 {
 	if (isProcessSuspended)
 	{
 		int msgboxID = MessageBox(L"Process is suspended. Do you want to terminate the process?\r\n\r\nYES = Terminate Process\r\nNO = Try to resume the process\r\nCancel = Do nothing", L"Information", MB_YESNOCANCEL|MB_ICONINFORMATION);
 		
 		switch (msgboxID)
 		{
 		case IDYES:
 			ProcessAccessHelp::terminateProcess();
 			break;
 		case IDNO:
 			ProcessAccessHelp::resumeProcess();
 			break;
 		default:
 			break;
 		}
 	}
 
 	DestroyWindow();
 }
 
 void MainGui::OnAbout(UINT uNotifyCode, int nID, CWindow wndCtl)
 {
 	showAboutDialog();
 }
 
 void MainGui::OnDonate(UINT uNotifyCode, int nID, CWindow wndCtl)
 {
 	showDonateDialog();
 }
 
 void MainGui::setupStatusBar()
 {
 	StatusBar.Create(m_hWnd, NULL, L"", WS_CHILD | WS_VISIBLE | WS_CLIPCHILDREN | WS_CLIPSIBLINGS | SBARS_TOOLTIPS, NULL, IDC_STATUS_BAR);
 
 	CRect rcMain, rcStatus;
 	GetClientRect(&rcMain);
 	StatusBar.GetWindowRect(&rcStatus);
 
 	const int PARTS = 4;
 	int widths[PARTS];
 
 	widths[PART_COUNT]     = rcMain.Width() / 5;
 	widths[PART_INVALID]   = widths[PART_COUNT] + rcMain.Width() / 5;
 	widths[PART_IMAGEBASE] = widths[PART_INVALID] + rcMain.Width() / 3;
 	widths[PART_MODULE]    = -1;
 
 	StatusBar.SetParts(PARTS, widths);
 
 	ResizeClient(rcMain.Width(), rcMain.Height() + rcStatus.Height(), FALSE);
 }
 
 void MainGui::updateStatusBar()
 {
 	// Rewrite ImportsHandling so we get these easily
 	unsigned int totalImports = importsHandling.thunkCount();
 	unsigned int invalidImports = importsHandling.invalidThunkCount();
 
 	// \t = center, \t\t = right-align
 	swprintf_s(stringBuffer, L"\tImports: %u", totalImports);
 	StatusBar.SetText(PART_COUNT, stringBuffer);
 
 	if(invalidImports > 0)
 	{
 		StatusBar.SetIcon(PART_INVALID, hIconError);
 	}
 	else
 	{
 		StatusBar.SetIcon(PART_INVALID, hIconCheck);
 	}
 
 	swprintf_s(stringBuffer, L"\tInvalid: %u", invalidImports);
 	StatusBar.SetText(PART_INVALID, stringBuffer);
 
 	if(selectedProcess)
 	{
 		DWORD_PTR imageBase = 0;
 		const WCHAR * fileName = 0;
 
 		if(ProcessAccessHelp::selectedModule)
 		{
 			imageBase = ProcessAccessHelp::selectedModule->modBaseAddr;
 			fileName = ProcessAccessHelp::selectedModule->getFilename();
 		}
 		else
 		{
 			imageBase = selectedProcess->imageBase;
 			fileName = selectedProcess->filename;
 		}
 
 		swprintf_s(stringBuffer, L"\tImagebase: " PRINTF_DWORD_PTR_FULL, imageBase);
 		StatusBar.SetText(PART_IMAGEBASE, stringBuffer);
 		StatusBar.SetText(PART_MODULE, fileName);
 		StatusBar.SetTipText(PART_MODULE, fileName);
 	}
 	else
 	{
 		StatusBar.SetText(PART_IMAGEBASE, L"");
 		StatusBar.SetText(PART_MODULE, L"");
 	}
 }
 
 bool MainGui::showFileDialog(WCHAR * selectedFile, bool save, const WCHAR * defFileName, const WCHAR * filter, const WCHAR * defExtension, const WCHAR * directory)
 {
 OPENFILENAME ofn = {0};
 
 	// WTL doesn't support new explorer styles on Vista and up
 	// This is because it uses a custom hook, we could remove it or derive
 	// from CFileDialog but this solution is easier and allows more control anyway (e.g. initial dir)
 
 	if(defFileName)
 	{
 		wcscpy_s(selectedFile, MAX_PATH, defFileName);
 	}
 	else
 	{
 		selectedFile[0] = L'\0';
 	}
 
 	ofn.lStructSize     = sizeof(ofn);
 	ofn.hwndOwner       = m_hWnd;
 	ofn.lpstrFilter     = filter;
 	ofn.lpstrDefExt     = defExtension; // only first 3 chars are used, no dots!
 	ofn.lpstrFile       = selectedFile;
 	ofn.lpstrInitialDir = directory;
 	ofn.nMaxFile        = MAX_PATH;
 	ofn.Flags           = OFN_PATHMUSTEXIST | OFN_HIDEREADONLY;
 
 	/*
 	 *OFN_EXPLORER is automatically used, it only has to be specified
 	 *if using a custom hook
 	 *OFN_LONGNAMES is automatically used by explorer-style dialogs
 	 */
 
 	if(save)
 		ofn.Flags |= OFN_OVERWRITEPROMPT;
 	else
 		ofn.Flags |= OFN_FILEMUSTEXIST;
 
 	if(save)
 		return 0 != GetSaveFileName(&ofn);
 	else
 		return 0 != GetOpenFileName(&ofn);
 }
 
 void MainGui::setIconAndDialogCaption()
 {
 	SetIcon(hIcon, TRUE);
 	SetIcon(hIcon, FALSE);
 
 	SetWindowText(APPNAME L" " ARCHITECTURE L" " APPVERSION);
 }
 
 void MainGui::pickDllActionHandler()
 {
 	if(!selectedProcess)
 		return;
 
 	PickDllGui dlgPickDll(ProcessAccessHelp::moduleList);
 	if(dlgPickDll.DoModal())
 	{
 		//get selected module
 		ProcessAccessHelp::selectedModule = dlgPickDll.getSelectedModule();
 
 		ProcessAccessHelp::targetImageBase = ProcessAccessHelp::selectedModule->modBaseAddr;
 		ProcessAccessHelp::targetSizeOfImage = ProcessAccessHelp::getSizeOfImageProcess(ProcessAccessHelp::hProcess, ProcessAccessHelp::targetImageBase);
 
 		DWORD modEntryPoint = ProcessAccessHelp::getEntryPointFromFile(ProcessAccessHelp::selectedModule->fullPath);
 
 		EditOEPAddress.SetValue(modEntryPoint + ProcessAccessHelp::targetImageBase);
 
 		Scylla::windowLog.log(L"->>> Module %s selected.", ProcessAccessHelp::selectedModule->getFilename());
 		Scylla::windowLog.log(L"Imagebase: " PRINTF_DWORD_PTR_FULL L" Size: %08X EntryPoint: %08X", ProcessAccessHelp::selectedModule->modBaseAddr, ProcessAccessHelp::selectedModule->modBaseSize, modEntryPoint);
 	}
 	else
 	{
 		ProcessAccessHelp::selectedModule = 0;
 	}
 
 	updateStatusBar();
 }
 
 void MainGui::pickApiActionHandler(CTreeItem item)
 {
 	if(!importsHandling.isImport(item))
 		return;
 
 	// TODO: new node when user picked an API from another DLL?
 
 	PickApiGui dlgPickApi(ProcessAccessHelp::moduleList);
 	if(dlgPickApi.DoModal())
 	{
 		const ApiInfo* api = dlgPickApi.getSelectedApi();
 		if(api && api->module)
 		{
 			importsHandling.setImport(item, api->module->getFilename(), api->name, api->ordinal, api->hint, true, api->isForwarded);
 		}
 	}
 
 	updateStatusBar();
 }
 
 void MainGui::startDisassemblerGui(CTreeItem selectedTreeNode)
 {
 	if(!selectedProcess)
 		return;
 
 	DWORD_PTR address = importsHandling.getApiAddressByNode(selectedTreeNode);
 	if (address)
 	{
 		BYTE test;
 		if(!ProcessAccessHelp::readMemoryFromProcess(address, sizeof(test), &test))
 		{
 			swprintf_s(stringBuffer, L"Can't read memory at " PRINTF_DWORD_PTR_FULL, address);
 			MessageBox(stringBuffer, L"Failure", MB_ICONERROR);
 		}
 		else
 		{
 			DisassemblerGui dlgDisassembler(address, &apiReader);
 			dlgDisassembler.DoModal();
 		}
 	}
 }
 
 void MainGui::processSelectedActionHandler(int index)
 {
 	std::vector<Process>& processList = Scylla::processLister.getProcessList();
 	Process &process = processList.at(index);
 	selectedProcess = 0;
 
 	clearImportsActionHandler();
 
 	Scylla::windowLog.log(L"Analyzing %s", process.fullPath);
 
 	if (ProcessAccessHelp::hProcess != 0)
 	{
 		ProcessAccessHelp::closeProcessHandle();
 		apiReader.clearAll();
 	}
 
 	if (!ProcessAccessHelp::openProcessHandle(process.PID))
 	{
 		enableDialogControls(FALSE);
 		Scylla::windowLog.log(L"Error: Cannot open process handle.");
 		updateStatusBar();
 		return;
 	}
 
 	ProcessAccessHelp::getProcessModules(process.PID, ProcessAccessHelp::moduleList);
 
 	apiReader.readApisFromModuleList();
 
 	Scylla::windowLog.log(L"Loading modules done.");
 
 	//TODO improve
 	ProcessAccessHelp::selectedModule = 0;
 
 	ProcessAccessHelp::targetImageBase = process.imageBase;
 	ProcessAccessHelp::targetSizeOfImage = ProcessAccessHelp::getSizeOfImageProcess(ProcessAccessHelp::hProcess, ProcessAccessHelp::targetImageBase);
 
 	process.imageSize = (DWORD)ProcessAccessHelp::targetSizeOfImage;
 
 
 	Scylla::windowLog.log(L"Imagebase: " PRINTF_DWORD_PTR_FULL L" Size: %08X", process.imageBase, process.imageSize);
 
 	process.entryPoint = ProcessAccessHelp::getEntryPointFromFile(process.fullPath);
 
 	EditOEPAddress.SetValue(process.entryPoint + process.imageBase);
 
 	selectedProcess = &process;
 	enableDialogControls(TRUE);
 
 	updateStatusBar();
 }
 
 void MainGui::fillProcessListComboBox(CComboBox& hCombo)
 {
 	hCombo.ResetContent();
 
 	std::vector<Process>& processList = Scylla::processLister.getProcessListSnapshot();
 
 	for (size_t i = 0; i < processList.size(); i++)
 	{
 		swprintf_s(stringBuffer, L"0x%04X - %s - %s", processList[i].PID, processList[i].filename, processList[i].fullPath);
 		hCombo.AddString(stringBuffer);
 	}
 }
 
 /*
 void MainGui::addTextToOutputLog(const WCHAR * text)
 {
 	if (m_hWnd)
 	{
 		ListLog.SetCurSel(ListLog.AddString(text));
 	}
 }
 */
 
 void MainGui::clearOutputLog()
 {
 	if (m_hWnd)
 	{
 		ListLog.ResetContent();
 	}
 }
 
 bool MainGui::saveLogToFile(const WCHAR * file)
 {
 	const BYTE BOM[] = {0xFF, 0xFE}; // UTF-16 little-endian
 	const WCHAR newLine[] = L"\r\n";
 	bool success = true;
 
 	HANDLE hFile = CreateFile(file, GENERIC_WRITE, FILE_SHARE_READ, 0, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, 0);
 	if(hFile != INVALID_HANDLE_VALUE)
 	{
 		ProcessAccessHelp::writeMemoryToFileEnd(hFile, sizeof(BOM), BOM);
 
 		WCHAR * buffer = 0;
 		size_t bufsize = 0;
 		for(int i = 0; i < ListLog.GetCount(); i++)
 		{
 			size_t size = ListLog.GetTextLen(i);
 			size += _countof(newLine)-1;
 			if(size+1 > bufsize)
 			{
 				bufsize = size+1;
 				delete[] buffer;
 				try
 				{
 					buffer = new WCHAR[bufsize];
 				}
 				catch(std::bad_alloc&)
 				{
 					buffer = 0;
 					success = false;
 					break;
 				}
 			}
 
 			ListLog.GetText(i, buffer);
 			wcscat_s(buffer, bufsize, newLine);
 
 			ProcessAccessHelp::writeMemoryToFileEnd(hFile, (DWORD)(size * sizeof(WCHAR)), buffer);
 		}
 		delete[] buffer;
 		CloseHandle(hFile);
 	}
 	return success;
 }
 
 void MainGui::showInvalidImportsActionHandler()
 {
 	importsHandling.selectImports(true, false);
 	GotoDlgCtrl(TreeImports);
 }
 
 void MainGui::showSuspectImportsActionHandler()
 {
 	importsHandling.selectImports(false, true);
 	GotoDlgCtrl(TreeImports);
 }
 
 void MainGui::deleteSelectedImportsActionHandler()
 {
 	CTreeItem selected = TreeImports.GetFirstSelectedItem();
 	while(!selected.IsNull())
 	{
 		if(importsHandling.isModule(selected))
 		{
 			importsHandling.cutModule(selected);
 		}
 		else
 		{
 			importsHandling.cutImport(selected);
 		}
 		selected = TreeImports.GetNextSelectedItem(selected);
 	}
 	updateStatusBar();
 }
 
 void MainGui::invalidateSelectedImportsActionHandler()
 {
 	CTreeItem selected = TreeImports.GetFirstSelectedItem();
 	while(!selected.IsNull())
 	{
 		if(importsHandling.isImport(selected))
 		{
 			importsHandling.invalidateImport(selected);
 		}
 		selected = TreeImports.GetNextSelectedItem(selected);
 	}
 	updateStatusBar();
 }
 
 void MainGui::loadTreeActionHandler()
 {
 	if(!selectedProcess)
 		return;
 
 	WCHAR selectedFilePath[MAX_PATH];
 	getCurrentModulePath(stringBuffer, _countof(stringBuffer));
 	if(showFileDialog(selectedFilePath, false, NULL, filterXml, NULL, stringBuffer))
 	{
 		TreeImportExport treeIO(selectedFilePath);
 		DWORD_PTR addrOEP = 0;
 		DWORD_PTR addrIAT = 0;
 		DWORD sizeIAT = 0;
 
 		if(!treeIO.importTreeList(importsHandling.moduleList, &addrOEP, &addrIAT, &sizeIAT))
 		{
 			Scylla::windowLog.log(L"Loading tree file failed %s", selectedFilePath);
 			MessageBox(L"Loading tree file failed.", L"Failure", MB_ICONERROR);
 		}
 		else
 		{
 			EditOEPAddress.SetValue(addrOEP);
 			EditIATAddress.SetValue(addrIAT);
 			EditIATSize.SetValue(sizeIAT);
 
 			importsHandling.displayAllImports();
 			updateStatusBar();
 
 			Scylla::windowLog.log(L"Loaded tree file %s", selectedFilePath);
 			Scylla::windowLog.log(L"-> OEP: " PRINTF_DWORD_PTR_FULL, addrOEP);
 			Scylla::windowLog.log(L"-> IAT: " PRINTF_DWORD_PTR_FULL L" Size: " PRINTF_DWORD_PTR, addrIAT, sizeIAT);
 		}
 	}
 }
 
 void MainGui::saveTreeActionHandler()
 {
 	if(!selectedProcess)
 		return;
 
 	WCHAR selectedFilePath[MAX_PATH];
 	getCurrentModulePath(stringBuffer, _countof(stringBuffer));
 	if(showFileDialog(selectedFilePath, true, NULL, filterXml, L"xml", stringBuffer))
 	{
 		TreeImportExport treeIO(selectedFilePath);
 		DWORD_PTR addrOEP = EditOEPAddress.GetValue();
 		DWORD_PTR addrIAT = EditIATAddress.GetValue();
 		DWORD sizeIAT = EditIATSize.GetValue();
 
 		if(!treeIO.exportTreeList(importsHandling.moduleList, selectedProcess, addrOEP, addrIAT, sizeIAT))
 		{
 			Scylla::windowLog.log(L"Saving tree file failed %s", selectedFilePath);
 			MessageBox(L"Saving tree file failed.", L"Failure", MB_ICONERROR);
 		}
 		else
 		{
 			Scylla::windowLog.log(L"Saved tree file %s", selectedFilePath);
 		}
 	}
 }
 
 void MainGui::iatAutosearchActionHandler()
 {
 	DWORD_PTR searchAddress = 0;
 	DWORD_PTR addressIAT = 0, addressIATAdv = 0;
 	DWORD sizeIAT = 0, sizeIATAdv = 0;
 	IATSearch iatSearch;
 
 	if(!selectedProcess)
 		return;
 
 	if(EditOEPAddress.GetWindowTextLength() > 0)
 	{
 		searchAddress = EditOEPAddress.GetValue();
 		if (searchAddress)
 		{
 
 			if (Scylla::config[USE_ADVANCED_IAT_SEARCH].isTrue())
 			{
 				if (iatSearch.searchImportAddressTableInProcess(searchAddress, &addressIATAdv, &sizeIATAdv, true))
 				{
 					Scylla::windowLog.log(L"IAT Search Advanced: IAT VA " PRINTF_DWORD_PTR_FULL L" RVA " PRINTF_DWORD_PTR_FULL L" Size 0x%04X (%d)", addressIATAdv, addressIATAdv - ProcessAccessHelp::targetImageBase, sizeIATAdv, sizeIATAdv);
 				}
 				else
 				{
 					Scylla::windowLog.log(L"IAT Search Advanced: IAT not found at OEP " PRINTF_DWORD_PTR_FULL L"!", searchAddress);
 				}
 			}
 
 
 			if (iatSearch.searchImportAddressTableInProcess(searchAddress, &addressIAT, &sizeIAT, false))
 			{
 				Scylla::windowLog.log(L"IAT Search Normal: IAT VA " PRINTF_DWORD_PTR_FULL L" RVA " PRINTF_DWORD_PTR_FULL L" Size 0x%04X (%d)", addressIAT, addressIAT - ProcessAccessHelp::targetImageBase, sizeIAT, sizeIAT);
 			}
 			else
 			{
 				Scylla::windowLog.log(L"IAT Search Normal: IAT not found at OEP " PRINTF_DWORD_PTR_FULL L"!", searchAddress);
 			}
 
 			if (addressIAT != 0 && addressIATAdv == 0)
 			{
 				setDialogIATAddressAndSize(addressIAT, sizeIAT);
 			}
 			else if (addressIAT == 0 && addressIATAdv != 0)
 			{
 				setDialogIATAddressAndSize(addressIATAdv, sizeIATAdv);
 			}
 			else if (addressIAT != 0 && addressIATAdv != 0)
 			{
 				if (addressIATAdv != addressIAT || sizeIAT != sizeIATAdv)
 				{
 					int msgboxID = MessageBox(L"Result of advanced and normal search is different. Do you want to use the IAT Search Advanced result?", L"Information", MB_YESNO|MB_ICONINFORMATION);
 					if (msgboxID == IDYES)
 					{
 						setDialogIATAddressAndSize(addressIATAdv, sizeIATAdv);
 					}
 					else
 					{
 						setDialogIATAddressAndSize(addressIAT, sizeIAT);
 					}
 				}
 				else
 				{
 					setDialogIATAddressAndSize(addressIAT, sizeIAT);
 				}
 			}
 			
 		}
 	}
 }
 
 void MainGui::getImportsActionHandler()
 {
 	if(!selectedProcess)
 		return;
 
 	DWORD_PTR addressIAT = EditIATAddress.GetValue();
 	DWORD sizeIAT = EditIATSize.GetValue();
 
 	if (addressIAT && sizeIAT)
 	{
 		apiReader.readAndParseIAT(addressIAT, sizeIAT, importsHandling.moduleList);
 		importsHandling.displayAllImports();
 
 		updateStatusBar();
 
 		if (Scylla::config[SCAN_DIRECT_IMPORTS].isTrue())
 		{
-			IATReferenceScan sc;
-			sc.ScanForDirectImports = true;
-			sc.ScanForNormalImports = false;
-			sc.startScan(ProcessAccessHelp::targetImageBase, (DWORD)ProcessAccessHelp::targetSizeOfImage, addressIAT, sizeIAT);
+			iatReferenceScan.ScanForDirectImports = true;
+			iatReferenceScan.ScanForNormalImports = false;
+			iatReferenceScan.apiReader = &apiReader;
+			iatReferenceScan.startScan(ProcessAccessHelp::targetImageBase, (DWORD)ProcessAccessHelp::targetSizeOfImage, addressIAT, sizeIAT);
 
-			Scylla::windowLog.log(L"DIRECT IMPORTS - Found %d possible direct imports!", sc.numberOfFoundDirectImports());
+			Scylla::windowLog.log(L"DIRECT IMPORTS - Found %d possible direct imports!", iatReferenceScan.numberOfFoundDirectImports());
 
-			if (sc.numberOfFoundDirectImports() > 0)
+			if (iatReferenceScan.numberOfFoundDirectImports() > 0)
 			{
-				sc.printDirectImportLog();
+				iatReferenceScan.printDirectImportLog();
 
-				if (Scylla::config[FIX_DIRECT_IMPORTS].isTrue())
+				if (Scylla::config[FIX_DIRECT_IMPORTS_NORMAL].isTrue())
 				{
-					int msgboxID = MessageBox(L"Direct Imports found. Where is the junk byte?\r\n\r\nYES = After Instruction\r\nNO = Before the Instruction\r\nCancel = Do nothing", L"Information", MB_YESNOCANCEL|MB_ICONINFORMATION);
+					int msgboxID = MessageBox(L"Direct Imports found. I can patch only direct imports by JMP/CALL (use universal method if you don't like this) but where is the junk byte?\r\n\r\nYES = After Instruction\r\nNO = Before the Instruction\r\nCancel = Do nothing", L"Information", MB_YESNOCANCEL|MB_ICONINFORMATION);
 
-					switch (msgboxID)
+					if (msgboxID != IDCANCEL)
 					{
-					case IDYES:
-						sc.patchDirectImportsMemory(true);
-						Scylla::windowLog.log(L"DIRECT IMPORTS - Patched!");
-						break;
-					case IDNO:
-						sc.patchDirectImportsMemory(false);
-						Scylla::windowLog.log(L"DIRECT IMPORTS - Patched!");
-						break;
-					default:
-						break;
+						bool isAfter;
+						if (msgboxID == IDYES)
+						{
+							isAfter = true;
+						}
+						else
+						{
+							isAfter = false;
+						}
+
+						iatReferenceScan.patchDirectImportsMemory(isAfter);
+						Scylla::windowLog.log(L"DIRECT IMPORTS - Patched! Please dump target.");
 					}
+
 				}
 			}
 
 		}
 
 
 		if (isIATOutsidePeImage(addressIAT))
 		{
 			Scylla::windowLog.log(L"WARNING! IAT is not inside the PE image, requires rebasing!");
 		}
 	}
 }
 
 void MainGui::SetupImportsMenuItems(CTreeItem item)
 {
 	bool isItem, isImport = false;
 	isItem = !item.IsNull();
 	if(isItem)
 	{
 		isImport = importsHandling.isImport(item);
 	}
 
 	CMenuHandle hSub = hMenuImports.GetSubMenu(0);
 
 	UINT itemOnly = isItem ? MF_ENABLED : MF_GRAYED;
 	UINT importOnly = isImport ? MF_ENABLED : MF_GRAYED;
 
 	hSub.EnableMenuItem(ID__INVALIDATE, itemOnly);
 	hSub.EnableMenuItem(ID__DISASSEMBLE, importOnly);
 	hSub.EnableMenuItem(ID__CUTTHUNK, importOnly);
 
 	hSub.EnableMenuItem(ID__DELETETREENODE, itemOnly);
 }
 
 void MainGui::DisplayContextMenuImports(CWindow hwnd, CPoint pt)
 {
 	if(TreeImports.GetCount() < 1)
 		return;
 
 	CTreeItem over, parent;
 
 	if(pt.x == -1 && pt.y == -1) // invoked by keyboard
 	{
 		CRect pos;
 		over = TreeImports.GetFocusItem();
 		if(over)
 		{
 			over.EnsureVisible();
 			over.GetRect(&pos, TRUE);
 			TreeImports.ClientToScreen(&pos);
 		}
 		else
 		{
 			TreeImports.GetWindowRect(&pos);
 		}
 		pt = pos.TopLeft();
 	}
 	else
 	{
 		// Get item under cursor
 		over = findTreeItem(pt, true);
 	}
 
 	SetupImportsMenuItems(over);
 
 	CMenuHandle hSub = hMenuImports.GetSubMenu(0);
 	BOOL menuItem = hSub.TrackPopupMenu(TPM_LEFTALIGN | TPM_RIGHTBUTTON | TPM_RETURNCMD, pt.x, pt.y, hwnd);
 	if (menuItem)
 	{
 		if ((menuItem >= PLUGIN_MENU_BASE_ID) && (menuItem <= (int)(Scylla::plugins.getScyllaPluginList().size() + Scylla::plugins.getImprecPluginList().size() + PLUGIN_MENU_BASE_ID)))
 		{
 			//wsprintf(stringBuffer, L"%d %s\n",menuItem,pluginList[menuItem - PLUGIN_MENU_BASE_ID].pluginName);
 			//MessageBox(stringBuffer, L"plugin selection");
 
 			pluginActionHandler(menuItem);
 			return;
 		}
 		switch (menuItem)
 		{
 		case ID__INVALIDATE:
 			if(importsHandling.isModule(over))
 				importsHandling.invalidateModule(over);
 			else
 				importsHandling.invalidateImport(over);
 			break;
 		case ID__DISASSEMBLE:
 			startDisassemblerGui(over);
 			break;
 		case ID__EXPANDALLNODES:
 			importsHandling.expandAllTreeNodes();
 			break;
 		case ID__COLLAPSEALLNODES:
 			importsHandling.collapseAllTreeNodes();
 			break;
 		case ID__CUTTHUNK:
 			importsHandling.cutImport(over);
 			break;
 		case ID__DELETETREENODE:
 			importsHandling.cutModule(importsHandling.isImport(over) ? over.GetParent() : over);
 			break;
 		}
 	}
 
 	updateStatusBar();
 }
 
 void MainGui::DisplayContextMenuLog(CWindow hwnd, CPoint pt)
 {
 	if(pt.x == -1 && pt.y == -1) // invoked by keyboard
 	{
 		CRect pos;
 		ListLog.GetWindowRect(&pos);
 		pt = pos.TopLeft();
 	}
 
 	CMenuHandle hSub = hMenuLog.GetSubMenu(0);
 	BOOL menuItem = hSub.TrackPopupMenu(TPM_LEFTALIGN | TPM_RIGHTBUTTON | TPM_RETURNCMD, pt.x, pt.y, hwnd);
 	if (menuItem)
 	{
 		switch (menuItem)
 		{
 		case ID__SAVE:
 			WCHAR selectedFilePath[MAX_PATH];
 			getCurrentModulePath(stringBuffer, _countof(stringBuffer));
 			if(showFileDialog(selectedFilePath, true, NULL, filterTxt, L"txt", stringBuffer))
 			{
 				saveLogToFile(selectedFilePath);
 			}
 			break;
 		case ID__CLEAR:
 			clearOutputLog();
 			break;
 		}
 	}
 }
 
 void MainGui::appendPluginListToMenu(CMenuHandle hMenu)
 {
 	std::vector<Plugin> &scyllaPluginList = Scylla::plugins.getScyllaPluginList();
 	std::vector<Plugin> &imprecPluginList = Scylla::plugins.getImprecPluginList();
 
 	if (scyllaPluginList.size() > 0)
 	{
 		CMenuHandle newMenu;
 		newMenu.CreatePopupMenu();
 
 		for (size_t i = 0; i < scyllaPluginList.size(); i++)
 		{
 			newMenu.AppendMenu(MF_STRING, i + PLUGIN_MENU_BASE_ID, scyllaPluginList[i].pluginName);
 		}
 
 		hMenu.AppendMenu(MF_MENUBARBREAK);
 		hMenu.AppendMenu(MF_POPUP, newMenu, L"Scylla Plugins");
 	}
 
 	if (imprecPluginList.size() > 0)
 	{
 		CMenuHandle newMenu;
 		newMenu.CreatePopupMenu();
 
 		for (size_t i = 0; i < imprecPluginList.size(); i++)
 		{
 			newMenu.AppendMenu(MF_STRING, scyllaPluginList.size() + i + PLUGIN_MENU_BASE_ID, imprecPluginList[i].pluginName);
 		}
 
 		hMenu.AppendMenu(MF_MENUBARBREAK);
 		hMenu.AppendMenu(MF_POPUP, newMenu, L"ImpREC Plugins");
 	}
 }
 
 void MainGui::dumpMemoryActionHandler()
 {
 	WCHAR selectedFilePath[MAX_PATH];
 	DumpMemoryGui dlgDumpMemory;
 
 	if(dlgDumpMemory.DoModal())
 	{
 		getCurrentModulePath(stringBuffer, _countof(stringBuffer));
 		if(showFileDialog(selectedFilePath, true, dlgDumpMemory.dumpFilename, filterMem, L"mem", stringBuffer))
 		{
 			if (ProcessAccessHelp::writeMemoryToNewFile(selectedFilePath,dlgDumpMemory.dumpedMemorySize,dlgDumpMemory.dumpedMemory))
 			{
 				Scylla::windowLog.log(L"Memory dump saved %s", selectedFilePath);
 			}
 			else
 			{
 				Scylla::windowLog.log(L"Error! Cannot write memory dump to disk");
 			}
 		}
 	}
 }
 
 void MainGui::dumpSectionActionHandler()
 {
 	WCHAR selectedFilePath[MAX_PATH];
 	DumpSectionGui dlgDumpSection;
 	const WCHAR * fileFilter;
 	const WCHAR * defExtension;
 	PeParser * peFile = 0;
 
 	dlgDumpSection.entryPoint = EditOEPAddress.GetValue();
 
 	if (ProcessAccessHelp::selectedModule)
 	{
 		//dump DLL
 		fileFilter = filterDll;
 		defExtension = L"dll";
 
 		dlgDumpSection.imageBase = ProcessAccessHelp::selectedModule->modBaseAddr;
 		//get it from gui
 		wcscpy_s(dlgDumpSection.fullpath, ProcessAccessHelp::selectedModule->fullPath);
 	}
 	else
 	{
 		fileFilter = filterExe;
 		defExtension = L"exe";
 
 		dlgDumpSection.imageBase = ProcessAccessHelp::targetImageBase;
 		//get it from gui
 		wcscpy_s(dlgDumpSection.fullpath, selectedProcess->fullPath);
 	}
 
 	if(dlgDumpSection.DoModal())
 	{
 		getCurrentModulePath(stringBuffer, _countof(stringBuffer));
 		if(showFileDialog(selectedFilePath, true, NULL, fileFilter, defExtension, stringBuffer))
 		{
 			checkSuspendProcess();
 
 			if (Scylla::config[USE_PE_HEADER_FROM_DISK].isTrue())
 			{
 				peFile = new PeParser(dlgDumpSection.fullpath, true);
 			}
 			else
 			{
 				peFile = new PeParser(dlgDumpSection.imageBase, true);
 			}
 
 			std::vector<PeSection> & sectionList = dlgDumpSection.getSectionList();
 
 			if (peFile->dumpProcess(dlgDumpSection.imageBase, dlgDumpSection.entryPoint, selectedFilePath, sectionList))
 			{
 				Scylla::windowLog.log(L"Dump success %s", selectedFilePath);
 			}
 			else
 			{
 				Scylla::windowLog.log(L"Error: Cannot dump image.");
 				MessageBox(L"Cannot dump image.", L"Failure", MB_ICONERROR);
 			}
 
 			delete peFile;
 		}
 	}
 }
 
 void MainGui::dumpActionHandler()
 {
 	if(!selectedProcess)
 		return;
 
 	WCHAR selectedFilePath[MAX_PATH];
 	const WCHAR * fileFilter;
 	const WCHAR * defExtension;
 	DWORD_PTR modBase = 0;
 	DWORD_PTR entrypoint = 0;
 	WCHAR * filename = 0;
 	PeParser * peFile = 0;
 
 	if (ProcessAccessHelp::selectedModule)
 	{
 		fileFilter = filterDll;
 		defExtension = L"dll";
 	}
 	else
 	{
 		fileFilter = filterExe;
 		defExtension = L"exe";
 	}
 
 	getCurrentModulePath(stringBuffer, _countof(stringBuffer));
 	if(showFileDialog(selectedFilePath, true, NULL, fileFilter, defExtension, stringBuffer))
 	{
 		entrypoint = EditOEPAddress.GetValue();
 
 		checkSuspendProcess();
 
 		if (ProcessAccessHelp::selectedModule)
 		{
 			//dump DLL
 			modBase = ProcessAccessHelp::selectedModule->modBaseAddr;
 			filename = ProcessAccessHelp::selectedModule->fullPath;
 		}
 		else
 		{
 			//dump exe
 			modBase = ProcessAccessHelp::targetImageBase;
 			filename = selectedProcess->fullPath;
 		}
 
 		if (Scylla::config[USE_PE_HEADER_FROM_DISK].isTrue())
 		{
 			peFile = new PeParser(filename, true);
 		}
 		else
 		{
 			peFile = new PeParser(modBase, true);
 		}
 
 		if (peFile->dumpProcess(modBase, entrypoint, selectedFilePath))
 		{
 			Scylla::windowLog.log(L"Dump success %s", selectedFilePath);
 		}
 		else
 		{
 			Scylla::windowLog.log(L"Error: Cannot dump image.");
 			MessageBox(L"Cannot dump image.", L"Failure", MB_ICONERROR);
 		}
 
 		delete peFile;
 	}
 }
 
 void MainGui::peRebuildActionHandler()
 {
 	DWORD newSize = 0;
 	WCHAR selectedFilePath[MAX_PATH];
 
 	getCurrentModulePath(stringBuffer, _countof(stringBuffer));
 	if(showFileDialog(selectedFilePath, false, NULL, filterExeDll, NULL, stringBuffer))
 	{
 		if (Scylla::config[CREATE_BACKUP].isTrue())
 		{
 			if (!ProcessAccessHelp::createBackupFile(selectedFilePath))
 			{
 				Scylla::windowLog.log(L"Creating backup file failed %s", selectedFilePath);
 			}
 		}
 
 		DWORD fileSize = (DWORD)ProcessAccessHelp::getFileSize(selectedFilePath);
 
 		PeParser peFile(selectedFilePath, true);
 
 		if (!peFile.isValidPeFile())
 		{
 			Scylla::windowLog.log(L"This is not a valid PE file %s", selectedFilePath);
 			MessageBox(L"Not a valid PE file.", L"Failure", MB_ICONERROR);
 			return;
 		}
 
 		if (peFile.readPeSectionsFromFile())
 		{
 			peFile.setDefaultFileAlignment();
 
 			if (Scylla::config[REMOVE_DOS_HEADER_STUB].isTrue())
 			{
 				peFile.removeDosStub();
 			}
 			
 			peFile.alignAllSectionHeaders();
 			peFile.fixPeHeader();
 
 			if (peFile.savePeFileToDisk(selectedFilePath))
 			{
 				newSize = (DWORD)ProcessAccessHelp::getFileSize(selectedFilePath);
 
 				if (Scylla::config[UPDATE_HEADER_CHECKSUM].isTrue())
 				{
 					Scylla::windowLog.log(L"Generating PE header checksum");
 					if (!PeParser::updatePeHeaderChecksum(selectedFilePath, newSize))
 					{
 						Scylla::windowLog.log(L"Generating PE header checksum FAILED!");
 					}
 				}
 
 				Scylla::windowLog.log(L"Rebuild success %s", selectedFilePath);
 				Scylla::windowLog.log(L"-> Old file size 0x%08X new file size 0x%08X (%d %%)", fileSize, newSize, ((newSize * 100) / fileSize) );
 			}
 			else
 			{
 				Scylla::windowLog.log(L"Rebuild failed, cannot save file %s", selectedFilePath);
 				MessageBox(L"Rebuild failed. Cannot save file.", L"Failure", MB_ICONERROR);
 			}
 		}
 		else
 		{
 			Scylla::windowLog.log(L"Rebuild failed, cannot read file %s", selectedFilePath);
 			MessageBox(L"Rebuild failed. Cannot read file.", L"Failure", MB_ICONERROR);
 		}
 
 	}
 }
 
 void MainGui::dumpFixActionHandler()
 {
 	if(!selectedProcess)
 		return;
 
 	if (TreeImports.GetCount() < 2)
 	{
 		Scylla::windowLog.log(L"Nothing to rebuild");
 		return;
 	}
 
 	WCHAR newFilePath[MAX_PATH];
 	WCHAR selectedFilePath[MAX_PATH];
 	const WCHAR * fileFilter;
 	DWORD_PTR modBase = 0;
 	DWORD_PTR entrypoint = EditOEPAddress.GetValue();
 
 	if (ProcessAccessHelp::selectedModule)
 	{
 		modBase = ProcessAccessHelp::selectedModule->modBaseAddr;
 		fileFilter = filterDll;
 	}
 	else
 	{
 		modBase = ProcessAccessHelp::targetImageBase;
 		fileFilter = filterExe;
 	}
 
 	getCurrentModulePath(stringBuffer, _countof(stringBuffer));
 	if (showFileDialog(selectedFilePath, false, NULL, fileFilter, NULL, stringBuffer))
 	{
 		wcscpy_s(newFilePath, selectedFilePath);
 
 		const WCHAR * extension = 0;
 
 		WCHAR* dot = wcsrchr(newFilePath, L'.');
 		if (dot)
 		{
 			*dot = L'\0';
 			extension = selectedFilePath + (dot - newFilePath); //wcsrchr(selectedFilePath, L'.');
 		}
 
 		wcscat_s(newFilePath, L"_SCY");
 
 		if(extension)
 		{
 			wcscat_s(newFilePath, extension);
 		}
 
 		ImportRebuilder importRebuild(selectedFilePath);
 
 		if (Scylla::config[IAT_FIX_AND_OEP_FIX].isTrue())
 		{
 			importRebuild.setEntryPointRva((DWORD)(entrypoint - modBase));
 		}
 
 		if (Scylla::config[OriginalFirstThunk_SUPPORT].isTrue())
 		{
 			importRebuild.enableOFTSupport();
 		}
 
+		if (Scylla::config[SCAN_DIRECT_IMPORTS].isTrue() && Scylla::config[FIX_DIRECT_IMPORTS_UNIVERSAL].isTrue())
+		{
+			if (iatReferenceScan.numberOfFoundDirectImports() > 0)
+			{
+				importRebuild.iatReferenceScan = &iatReferenceScan;
+				importRebuild.BuildDirectImportsJumpTable = true;
+			}
+		}
+
 		if (Scylla::config[CREATE_NEW_IAT_IN_SECTION].isTrue())
 		{
+			importRebuild.iatReferenceScan = &iatReferenceScan;
+
 			DWORD_PTR addressIAT = EditIATAddress.GetValue();
 			DWORD sizeIAT = EditIATSize.GetValue();
-			importRebuild.enableNewIatInSection(addressIAT,sizeIAT);
+			importRebuild.enableNewIatInSection(addressIAT, sizeIAT);
 		}
 
 
 		if (importRebuild.rebuildImportTable(newFilePath, importsHandling.moduleList))
 		{
 			Scylla::windowLog.log(L"Import Rebuild success %s", newFilePath);
 		}
 		else
 		{
 			Scylla::windowLog.log(L"Import Rebuild failed %s", selectedFilePath);
 			MessageBox(L"Import Rebuild failed", L"Failure", MB_ICONERROR);
 		}
 	}
 }
 
 void MainGui::enableDialogControls(BOOL value)
 {
 	BOOL valButton = value ? TRUE : FALSE;
 
 	GetDlgItem(IDC_BTN_PICKDLL).EnableWindow(valButton);
 	GetDlgItem(IDC_BTN_DUMP).EnableWindow(valButton);
 	GetDlgItem(IDC_BTN_FIXDUMP).EnableWindow(valButton);
 	GetDlgItem(IDC_BTN_IATAUTOSEARCH).EnableWindow(valButton);
 	GetDlgItem(IDC_BTN_GETIMPORTS).EnableWindow(valButton);
 	GetDlgItem(IDC_BTN_SUSPECTIMPORTS).EnableWindow(valButton);
 	GetDlgItem(IDC_BTN_INVALIDIMPORTS).EnableWindow(valButton);
 	GetDlgItem(IDC_BTN_CLEARIMPORTS).EnableWindow(valButton);
 
 	CMenuHandle menu = GetMenu();
 
 	UINT valMenu = value ? MF_ENABLED : MF_GRAYED;
 
 	menu.EnableMenuItem(ID_FILE_DUMP, valMenu);
 	menu.EnableMenuItem(ID_FILE_DUMPMEMORY, valMenu);
 	menu.EnableMenuItem(ID_FILE_DUMPSECTION, valMenu);
 	menu.EnableMenuItem(ID_FILE_FIXDUMP, valMenu);
 	menu.EnableMenuItem(ID_IMPORTS_INVALIDATESELECTED, valMenu);
 	menu.EnableMenuItem(ID_IMPORTS_CUTSELECTED, valMenu);
 	menu.EnableMenuItem(ID_IMPORTS_SAVETREE, valMenu);
 	menu.EnableMenuItem(ID_IMPORTS_LOADTREE, valMenu);
 	menu.EnableMenuItem(ID_MISC_DLLINJECTION, valMenu);
 	menu.EnableMenuItem(ID_MISC_DISASSEMBLER, valMenu);
 	menu.GetSubMenu(MenuImportsOffsetTrace).EnableMenuItem(MenuImportsTraceOffsetScylla, MF_BYPOSITION | valMenu);
 	menu.GetSubMenu(MenuImportsOffsetTrace).EnableMenuItem(MenuImportsTraceOffsetImpRec, MF_BYPOSITION | valMenu);
 
 	//not yet implemented
 	GetDlgItem(IDC_BTN_AUTOTRACE).EnableWindow(FALSE);
 	menu.EnableMenuItem(ID_TRACE_AUTOTRACE, MF_GRAYED);
 }
 
 CTreeItem MainGui::findTreeItem(CPoint pt, bool screenCoordinates)
 {
 	if(screenCoordinates)
 	{
 		TreeImports.ScreenToClient(&pt);
 	}
 
 	UINT flags;
 	CTreeItem over = TreeImports.HitTest(pt, &flags);
 	if(over)
 	{
 		if(!(flags & TVHT_ONITEM))
 		{
 			over.m_hTreeItem = NULL;
 		}
 	}
 
 	return over;
 }
 
 void MainGui::showAboutDialog()
 {
 	AboutGui dlgAbout;
 	dlgAbout.DoModal();
 }
 
 void MainGui::showDonateDialog()
 {
 	DonateGui dlgDonate;
 	dlgDonate.DoModal();
 }
 
 void MainGui::dllInjectActionHandler()
 {
 	if(!selectedProcess)
 		return;
 
 	WCHAR selectedFilePath[MAX_PATH];
 	HMODULE hMod = 0;
 	DllInjection dllInjection;
 
 	getCurrentModulePath(stringBuffer, _countof(stringBuffer));
 	if (showFileDialog(selectedFilePath, false, NULL, filterDll, NULL, stringBuffer))
 	{
 		hMod = dllInjection.dllInjection(ProcessAccessHelp::hProcess, selectedFilePath);
 		if (hMod && Scylla::config[DLL_INJECTION_AUTO_UNLOAD].isTrue())
 		{
 			if (!dllInjection.unloadDllInProcess(ProcessAccessHelp::hProcess, hMod))
 			{
 				Scylla::windowLog.log(L"DLL unloading failed, target %s", selectedFilePath);
 			}
 		}
 
 		if (hMod)
 		{
 			Scylla::windowLog.log(L"DLL Injection was successful, target %s", selectedFilePath);
 		}
 		else
 		{
 			Scylla::windowLog.log(L"DLL Injection failed, target %s", selectedFilePath);
 		}
 	}
 }
 
 void MainGui::disassemblerActionHandler()
 {
 	DWORD_PTR oep = EditOEPAddress.GetValue();
 	DisassemblerGui disGuiDlg(oep, &apiReader);
 	disGuiDlg.DoModal();
 }
 
 void MainGui::optionsActionHandler()
 {
 	OptionsGui dlgOptions;
 	dlgOptions.DoModal();
 }
 
 void MainGui::clearImportsActionHandler()
 {
 	importsHandling.clearAllImports();
 	updateStatusBar();
 }
 
 void MainGui::pluginActionHandler( int menuItem )
 {
 	if(!selectedProcess)
 		return;
 
 	DllInjectionPlugin dllInjectionPlugin;
 
 	std::vector<Plugin> &scyllaPluginList = Scylla::plugins.getScyllaPluginList();
 	std::vector<Plugin> &imprecPluginList = Scylla::plugins.getImprecPluginList();
 
 	menuItem -= PLUGIN_MENU_BASE_ID;
 
 	dllInjectionPlugin.hProcess = ProcessAccessHelp::hProcess;
 	dllInjectionPlugin.apiReader = &apiReader;
 
 	if (menuItem < (int)scyllaPluginList.size())
 	{
 		//scylla plugin
 		dllInjectionPlugin.injectPlugin(scyllaPluginList[menuItem], importsHandling.moduleList,selectedProcess->imageBase, selectedProcess->imageSize);
 	}
 	else
 	{
 #ifndef _WIN64
 
 		menuItem -= (int)scyllaPluginList.size();
 		//imprec plugin
 		dllInjectionPlugin.injectImprecPlugin(imprecPluginList[menuItem], importsHandling.moduleList,selectedProcess->imageBase, selectedProcess->imageSize);
 
 #endif
 	}
 
 	importsHandling.scanAndFixModuleList();
 	importsHandling.displayAllImports();
 	updateStatusBar();
 }
 
 bool MainGui::getCurrentModulePath(WCHAR * buffer, size_t bufferSize)
 {
 	if(!selectedProcess)
 		return false;
 
 	if(ProcessAccessHelp::selectedModule)
 	{
 		wcscpy_s(buffer, bufferSize, ProcessAccessHelp::selectedModule->fullPath);
 	}
 	else
 	{
 		wcscpy_s(buffer, bufferSize, selectedProcess->fullPath);
 	}
 
 	WCHAR * slash = wcsrchr(buffer, L'\\');
 	if(slash)
 	{
 		*(slash+1) = L'\0';
 	}
 
 	return true;
 }
 
 void MainGui::checkSuspendProcess()
 {
 	if (Scylla::config[SUSPEND_PROCESS_FOR_DUMPING].isTrue())
 	{
 		if (!ProcessAccessHelp::suspendProcess())
 		{
 			Scylla::windowLog.log(L"Error: Cannot suspend process.");
 		}
 		else
 		{
 			isProcessSuspended = true;
 			Scylla::windowLog.log(L"Suspending process successful, please resume manually.");
 		}
 	}
 }
 
 void MainGui::setDialogIATAddressAndSize( DWORD_PTR addressIAT, DWORD sizeIAT )
 {
 	EditIATAddress.SetValue(addressIAT);
 	EditIATSize.SetValue(sizeIAT);
 
 	swprintf_s(stringBuffer, L"IAT found:\r\n\r\nStart: " PRINTF_DWORD_PTR_FULL L"\r\nSize: 0x%04X (%d) ", addressIAT, sizeIAT, sizeIAT);
 	MessageBox(stringBuffer, L"IAT found", MB_ICONINFORMATION);
 }
 
 bool MainGui::isIATOutsidePeImage( DWORD_PTR addressIAT )
 {
 	DWORD_PTR minAdd = 0, maxAdd = 0;
 
 	if(ProcessAccessHelp::selectedModule)
 	{
 		minAdd = ProcessAccessHelp::selectedModule->modBaseAddr;
 		maxAdd = minAdd + ProcessAccessHelp::selectedModule->modBaseSize;
 	}
 	else
 	{
 		minAdd = selectedProcess->imageBase;
 		maxAdd = minAdd + selectedProcess->imageSize;
 	}
 
 	if (addressIAT > minAdd && addressIAT < maxAdd)
 	{
 		return false; //inside pe image
 	}
 	else
 	{
 		return true; //outside pe image, requires rebasing iat
 	}
 }
diff --git a/Scylla/MainGui.h b/Scylla/MainGui.h
index 16d4e68..fcd7be7 100644
--- a/Scylla/MainGui.h
+++ b/Scylla/MainGui.h
@@ -1,314 +1,317 @@
 #pragma once
 
 #include <windows.h>
 #include "resource.h"
 
 // WTL
 #include <atlbase.h>       // base ATL classes
 #include <atlapp.h>        // base WTL classes
 #include <atlwin.h>        // ATL GUI classes
 #include <atlframe.h>      // WTL window frame helpers
 #include <atlmisc.h>       // WTL utility classes
 #include <atlcrack.h>      // WTL enhanced msg map macros
 #include <atlctrls.h>      // WTL controls
 #include <atlddx.h>        // WTL dialog data exchange
 #include "multitree.h"
 #include "hexedit.h"
 
 #include "Logger.h"
 #include "ProcessLister.h"
 #include "IATSearch.h"
 #include "PickDllGui.h"
 #include "DumpMemoryGui.h"
 #include "DumpSectionGui.h"
 #include "ImportsHandling.h"
 #include "FunctionExport.h"
+#include "IATReferenceScan.h"
 
 class MainGui : public CDialogImpl<MainGui>, public CWinDataExchange<MainGui>, public CDialogResize<MainGui>, public CMessageFilter
 {
 public:
 	enum { IDD = IDD_DLG_MAIN };
 
 	// Dialog Data eXchange, attaches/subclasses child controls to wrappers
 	// DDX_CONTROL : subclass
 	// DDX_CONTROL_HANDLE : attach
 	BEGIN_DDX_MAP(MainGui)
 		DDX_CONTROL(IDC_TREE_IMPORTS, TreeImportsSubclass) // needed for message reflection
 		DDX_CONTROL(IDC_TREE_IMPORTS, TreeImports)
 		DDX_CONTROL_HANDLE(IDC_CBO_PROCESSLIST, ComboProcessList)
 		DDX_CONTROL_HANDLE(IDC_LIST_LOG, ListLog)
 		DDX_CONTROL(IDC_EDIT_OEPADDRESS, EditOEPAddress)
 		DDX_CONTROL(IDC_EDIT_IATADDRESS, EditIATAddress)
 		DDX_CONTROL(IDC_EDIT_IATSIZE, EditIATSize)
 	END_DDX_MAP()
 
 	// Our message map
 	// Messages are passed from top to bottom
 	// The first handler that doesn't call SetMsgHandled(FALSE) aborts the chain
 	// If none signals the message as handled, it will be passed to mixins (CHAIN_MSG_MAP)
 	// or ultimately passed to DefWindowProc
 	BEGIN_MSG_MAP_EX(MainGui)
 
 		MSG_WM_INITDIALOG(OnInitDialog)
 		MSG_WM_DESTROY(OnDestroy)
 		MSG_WM_SIZE(OnSize)
 		MSG_WM_CONTEXTMENU(OnContextMenu)
 		MSG_WM_COMMAND(OnCommand)
 
 		NOTIFY_HANDLER_EX(IDC_TREE_IMPORTS, NM_DBLCLK, OnTreeImportsDoubleClick)
 		NOTIFY_HANDLER_EX(IDC_TREE_IMPORTS, TVN_KEYDOWN, OnTreeImportsKeyDown)
 
 		COMMAND_HANDLER_EX(IDC_CBO_PROCESSLIST, CBN_DROPDOWN, OnProcessListDrop)
 		COMMAND_HANDLER_EX(IDC_CBO_PROCESSLIST, CBN_SELENDOK, OnProcessListSelected)
 		COMMAND_ID_HANDLER_EX(IDC_BTN_PICKDLL, OnPickDLL)
 		COMMAND_ID_HANDLER_EX(IDC_BTN_OPTIONS, OnOptions)
 		COMMAND_ID_HANDLER_EX(IDC_BTN_DUMP, OnDump)
 		COMMAND_ID_HANDLER_EX(IDC_BTN_FIXDUMP, OnFixDump)
 		COMMAND_ID_HANDLER_EX(IDC_BTN_PEREBUILD, OnPERebuild)
 		COMMAND_ID_HANDLER_EX(IDC_BTN_IATAUTOSEARCH, OnIATAutoSearch)
 		COMMAND_ID_HANDLER_EX(IDC_BTN_GETIMPORTS, OnGetImports)
 		COMMAND_ID_HANDLER_EX(IDC_BTN_INVALIDIMPORTS, OnInvalidImports)
 		COMMAND_ID_HANDLER_EX(IDC_BTN_SUSPECTIMPORTS, OnSuspectImports)
 		COMMAND_ID_HANDLER_EX(IDC_BTN_CLEARIMPORTS, OnClearImports)
 		COMMAND_ID_HANDLER_EX(ID_FILE_DUMP, OnDump)
 		COMMAND_ID_HANDLER_EX(ID_FILE_DUMPMEMORY, OnDumpMemory)
 		COMMAND_ID_HANDLER_EX(ID_FILE_DUMPSECTION, OnDumpSection)
 		COMMAND_ID_HANDLER_EX(ID_FILE_PEREBUILD, OnPERebuild)
 		COMMAND_ID_HANDLER_EX(ID_FILE_FIXDUMP, OnFixDump)
 		COMMAND_ID_HANDLER_EX(ID_FILE_EXIT, OnExit)
 		COMMAND_ID_HANDLER_EX(ID_IMPORTS_SHOWINVALID, OnInvalidImports)
 		COMMAND_ID_HANDLER_EX(ID_IMPORTS_SHOWSUSPECT, OnSuspectImports)
 		COMMAND_ID_HANDLER_EX(ID_IMPORTS_INVALIDATESELECTED, OnInvalidateSelected)
 		COMMAND_ID_HANDLER_EX(ID_IMPORTS_CUTSELECTED, OnCutSelected)
 		COMMAND_ID_HANDLER_EX(ID_IMPORTS_CLEARIMPORTS, OnClearImports)
 		COMMAND_ID_HANDLER_EX(ID_IMPORTS_SAVETREE, OnSaveTree)
 		COMMAND_ID_HANDLER_EX(ID_IMPORTS_LOADTREE, OnLoadTree)
 		COMMAND_ID_HANDLER_EX(ID_TRACE_AUTOTRACE, OnAutotrace)
 		COMMAND_ID_HANDLER_EX(ID_MISC_DLLINJECTION, OnDLLInject)
 		COMMAND_ID_HANDLER_EX(ID_MISC_DISASSEMBLER, OnDisassembler)
 		COMMAND_ID_HANDLER_EX(ID_MISC_OPTIONS, OnOptions)
 		COMMAND_ID_HANDLER_EX(ID_HELP_ABOUT, OnAbout)
 		COMMAND_ID_HANDLER_EX(ID_HELP_DONATE, OnDonate)
 		COMMAND_ID_HANDLER_EX(IDCANCEL, OnExit)
 
 		REFLECT_NOTIFY_ID(IDC_TREE_IMPORTS) // pass WM_NOTIFY to child control
 		CHAIN_MSG_MAP(CDialogResize<MainGui>)
 
 		// Message map for subclassed treeview
 		// CContainedWindow forwards all messages to this map
 	ALT_MSG_MAP(IDC_TREE_IMPORTS)
 
 		MSG_WM_GETDLGCODE(OnTreeImportsSubclassGetDlgCode)
 		MSG_WM_CHAR(OnTreeImportsSubclassChar)
 
 	END_MSG_MAP()
 
 	// Dialog resize 'table'
 	// States if child controls move or resize or center in a specific direction
 	// when the parent dialog is resized
 	BEGIN_DLGRESIZE_MAP(MainGui)
 		DLGRESIZE_CONTROL(IDC_GROUP_ATTACH,    DLSZ_SIZE_X)
 		DLGRESIZE_CONTROL(IDC_CBO_PROCESSLIST, DLSZ_SIZE_X)
 		DLGRESIZE_CONTROL(IDC_BTN_PICKDLL,     DLSZ_MOVE_X)
 
 		DLGRESIZE_CONTROL(IDC_GROUP_IMPORTS, DLSZ_SIZE_X | DLSZ_SIZE_Y)
 		DLGRESIZE_CONTROL(IDC_TREE_IMPORTS,  DLSZ_SIZE_X | DLSZ_SIZE_Y)
 		DLGRESIZE_CONTROL(IDC_BTN_INVALIDIMPORTS, DLSZ_MOVE_Y)
 		DLGRESIZE_CONTROL(IDC_BTN_SUSPECTIMPORTS, DLSZ_MOVE_Y)
 		DLGRESIZE_CONTROL(IDC_BTN_CLEARIMPORTS,   DLSZ_MOVE_X | DLSZ_MOVE_Y)
 
 		DLGRESIZE_CONTROL(IDC_GROUP_IATINFO,     DLSZ_MOVE_Y)
 		DLGRESIZE_CONTROL(IDC_STATIC_OEPADDRESS, DLSZ_MOVE_Y)
 		DLGRESIZE_CONTROL(IDC_STATIC_IATADDRESS, DLSZ_MOVE_Y)
 		DLGRESIZE_CONTROL(IDC_STATIC_IATSIZE,    DLSZ_MOVE_Y)
 		DLGRESIZE_CONTROL(IDC_EDIT_OEPADDRESS,   DLSZ_MOVE_Y)
 		DLGRESIZE_CONTROL(IDC_EDIT_IATADDRESS,   DLSZ_MOVE_Y)
 		DLGRESIZE_CONTROL(IDC_EDIT_IATSIZE,      DLSZ_MOVE_Y)
 		DLGRESIZE_CONTROL(IDC_BTN_IATAUTOSEARCH, DLSZ_MOVE_Y)
 		DLGRESIZE_CONTROL(IDC_BTN_GETIMPORTS,    DLSZ_MOVE_Y)
 
 		DLGRESIZE_CONTROL(IDC_GROUP_ACTIONS, DLSZ_MOVE_Y)
 		DLGRESIZE_CONTROL(IDC_BTN_AUTOTRACE, DLSZ_MOVE_Y)
 
 		DLGRESIZE_CONTROL(IDC_GROUP_DUMP,    DLSZ_MOVE_Y)
 		DLGRESIZE_CONTROL(IDC_BTN_DUMP,      DLSZ_MOVE_Y)
 		DLGRESIZE_CONTROL(IDC_BTN_PEREBUILD, DLSZ_MOVE_Y)
 		DLGRESIZE_CONTROL(IDC_BTN_FIXDUMP,   DLSZ_MOVE_Y)
 
 		DLGRESIZE_CONTROL(IDC_GROUP_LOG, DLSZ_MOVE_Y | DLSZ_SIZE_X)
 		DLGRESIZE_CONTROL(IDC_LIST_LOG,  DLSZ_MOVE_Y | DLSZ_SIZE_X)
 	END_DLGRESIZE_MAP()
 
 	MainGui();
 
 	//void addTextToOutputLog(const WCHAR * text);
 
 	//CWindow getLogListboxHandle() const { return ListLog; }
 
 protected:
 
 	// Variables
 
 	
 	WCHAR stringBuffer[600];
 
 	ImportsHandling importsHandling;
 	//ProcessAccessHelp processAccessHelp;
 	ApiReader apiReader;
+	IATReferenceScan iatReferenceScan;
 
 	Process * selectedProcess;
 	bool isProcessSuspended;
 
 	// File selection filters
 
 	static const WCHAR filterExe[];
 	static const WCHAR filterDll[];
 	static const WCHAR filterExeDll[];
 	static const WCHAR filterTxt[];
 	static const WCHAR filterXml[];
 	static const WCHAR filterMem[];
 
 	// Controls
 
 	CMultiSelectTreeViewCtrl TreeImports;
 	CComboBox ComboProcessList;
 	CHexEdit<DWORD_PTR> EditOEPAddress;
 	CHexEdit<DWORD_PTR> EditIATAddress;
 	CHexEdit<DWORD> EditIATSize;
 	CListBox ListLog;
 	CStatusBarCtrl StatusBar;
 
 	enum StatusParts {
 		PART_COUNT = 0,
 		PART_INVALID,
 		PART_IMAGEBASE,
 		PART_MODULE
 	};
 
 	CContainedWindow TreeImportsSubclass;
 
 	// Handles
 
 	CIcon hIcon;
 	CMenu hMenuImports;
 	CMenu hMenuLog;
 	CAccelerator accelerators;
 	CIcon hIconCheck;
 	CIcon hIconWarning;
 	CIcon hIconError;
 
 	static const int MenuImportsOffsetTrace = 2;
 	static const int MenuImportsTraceOffsetScylla = 2;
 	static const int MenuImportsTraceOffsetImpRec = 4;
 
 	static const int PLUGIN_MENU_BASE_ID = 0x10;
 protected:
 
 	virtual BOOL PreTranslateMessage(MSG* pMsg);
 
 	// Message handlers
 
 	BOOL OnInitDialog(CWindow wndFocus, LPARAM lInitParam);
 	void OnDestroy();
 	void OnSize(UINT nType, CSize size);
 	void OnContextMenu(CWindow wnd, CPoint point);
 	void OnCommand(UINT uNotifyCode, int nID, CWindow wndCtl);
 
 	// WM_NOTIFY handlers
 
 	LRESULT OnTreeImportsDoubleClick(const NMHDR* pnmh);
 	LRESULT OnTreeImportsKeyDown(const NMHDR* pnmh);
 
 	// Forwarded messages from subclassed treeview
 	UINT OnTreeImportsSubclassGetDlgCode(const MSG * lpMsg);
 	void OnTreeImportsSubclassChar(UINT nChar, UINT nRepCnt, UINT nFlags);
 
 	// WM_COMMAND handlers
 
 	void OnProcessListDrop(UINT uNotifyCode, int nID, CWindow wndCtl);
 	void OnProcessListSelected(UINT uNotifyCode, int nID, CWindow wndCtl);
 
 	void OnPickDLL(UINT uNotifyCode, int nID, CWindow wndCtl);
 	void OnOptions(UINT uNotifyCode, int nID, CWindow wndCtl);
 	void OnDump(UINT uNotifyCode, int nID, CWindow wndCtl);
 	void OnDumpMemory(UINT uNotifyCode, int nID, CWindow wndCtl);
 	void OnDumpSection(UINT uNotifyCode, int nID, CWindow wndCtl);
 	void OnFixDump(UINT uNotifyCode, int nID, CWindow wndCtl);
 	void OnPERebuild(UINT uNotifyCode, int nID, CWindow wndCtl);
 	void OnDLLInject(UINT uNotifyCode, int nID, CWindow wndCtl);
 	void OnDisassembler(UINT uNotifyCode, int nID, CWindow wndCtl);
 
 	void OnIATAutoSearch(UINT uNotifyCode, int nID, CWindow wndCtl);
 	void OnGetImports(UINT uNotifyCode, int nID, CWindow wndCtl);
 	void OnInvalidImports(UINT uNotifyCode, int nID, CWindow wndCtl);
 	void OnSuspectImports(UINT uNotifyCode, int nID, CWindow wndCtl);
 	void OnClearImports(UINT uNotifyCode, int nID, CWindow wndCtl);
 
 	void OnInvalidateSelected(UINT uNotifyCode, int nID, CWindow wndCtl);
 	void OnCutSelected(UINT uNotifyCode, int nID, CWindow wndCtl);
 	void OnSaveTree(UINT uNotifyCode, int nID, CWindow wndCtl);
 	void OnLoadTree(UINT uNotifyCode, int nID, CWindow wndCtl);
 	void OnAutotrace(UINT uNotifyCode, int nID, CWindow wndCtl);
 
 	void OnExit(UINT uNotifyCode, int nID, CWindow wndCtl);
 	void OnAbout(UINT uNotifyCode, int nID, CWindow wndCtl);
 	void OnDonate(UINT uNotifyCode, int nID, CWindow wndCtl);
 
 	// GUI functions
 
 	bool showFileDialog(WCHAR * selectedFile, bool save, const WCHAR * defFileName, const WCHAR * filter = NULL, const WCHAR * defExtension = NULL, const WCHAR * directory = NULL);
 
 	void setupStatusBar();
 	void updateStatusBar();
 	void fillProcessListComboBox(CComboBox& hCombo);
 	void setIconAndDialogCaption();
 	void enableDialogControls(BOOL value);
 
 	CTreeItem findTreeItem(CPoint pt, bool screenCoordinates);
 
 	// Actions
 
 	void pickDllActionHandler();
 	void pickApiActionHandler(CTreeItem item);
 	void processSelectedActionHandler(int index);
 	void showInvalidImportsActionHandler();
 	void showSuspectImportsActionHandler();
 	void deleteSelectedImportsActionHandler();
 	void invalidateSelectedImportsActionHandler();
 	void loadTreeActionHandler();
 	void saveTreeActionHandler();
 	void iatAutosearchActionHandler();
 	void getImportsActionHandler();
 	void dumpActionHandler();
 	void dumpMemoryActionHandler();
 	void dumpSectionActionHandler();
 	void peRebuildActionHandler();
 	void startDisassemblerGui(CTreeItem selectedTreeNode);
 	void dumpFixActionHandler();
 	void showAboutDialog();
 	void showDonateDialog();
 	void dllInjectActionHandler();
 	void disassemblerActionHandler();
 	void optionsActionHandler();
 	void clearImportsActionHandler();
 	void pluginActionHandler(int menuItem);
 
 	// Popup menu functions
 
 	void SetupImportsMenuItems(CTreeItem item);
 	void appendPluginListToMenu(CMenuHandle hMenuTrackPopup);
 	void DisplayContextMenuImports(CWindow, CPoint);
 	void DisplayContextMenuLog(CWindow, CPoint);
 
 	// Log
 
 	void clearOutputLog();
 	bool saveLogToFile(const WCHAR * file);
 
 	// Misc
 
 	bool getCurrentModulePath(WCHAR * buffer, size_t bufferSize);
 	void checkSuspendProcess();
 	void setDialogIATAddressAndSize( DWORD_PTR addressIAT, DWORD sizeIAT );
 	void InitDllStartWithPreSelect( PGUI_DLL_PARAMETER guiParam );
+	bool isIATOutsidePeImage( DWORD_PTR addressIAT );
 };
diff --git a/Scylla/MainGui.rc b/Scylla/MainGui.rc
index 8acdc79..b219452 100644
Binary files a/Scylla/MainGui.rc and b/Scylla/MainGui.rc differ
diff --git a/Scylla/OptionsGui.cpp b/Scylla/OptionsGui.cpp
index a2a9769..51840ac 100644
--- a/Scylla/OptionsGui.cpp
+++ b/Scylla/OptionsGui.cpp
@@ -1,66 +1,68 @@
 #include "OptionsGui.h"
 #include "Scylla.h"
 
 BOOL OptionsGui::OnInitDialog(CWindow wndFocus, LPARAM lInitParam)
 {
 	loadOptions();
 	DoDataExchange(DDX_LOAD); // show settings
 
 	EditSectionName.LimitText(IMAGE_SIZEOF_SHORT_NAME);
 
 	CenterWindow();
 
 	return TRUE;
 }
 
 void OptionsGui::OnOK(UINT uNotifyCode, int nID, CWindow wndCtl)
 {
 	DoDataExchange(DDX_SAVE);
 	saveOptions();
 	Scylla::config.saveConfiguration();
 
 	EndDialog(0);
 }
 
 void OptionsGui::OnCancel(UINT uNotifyCode, int nID, CWindow wndCtl)
 {
 	EndDialog(0);
 }
 
 void OptionsGui::saveOptions() const
 {
 	Scylla::config[USE_PE_HEADER_FROM_DISK].setBool(usePEHeaderFromDisk);
 	Scylla::config[DEBUG_PRIVILEGE].setBool(debugPrivilege);
 	Scylla::config[CREATE_BACKUP].setBool(createBackup);
 	Scylla::config[DLL_INJECTION_AUTO_UNLOAD].setBool(dllInjectionAutoUnload);
 	Scylla::config[UPDATE_HEADER_CHECKSUM].setBool(updateHeaderChecksum);
 	Scylla::config[IAT_SECTION_NAME].setString(iatSectionName);
 	Scylla::config[REMOVE_DOS_HEADER_STUB].setBool(removeDosHeaderStub);
 	Scylla::config[IAT_FIX_AND_OEP_FIX].setBool(fixIatAndOep);
 	Scylla::config[SUSPEND_PROCESS_FOR_DUMPING].setBool(suspendProcessForDumping);
 	Scylla::config[OriginalFirstThunk_SUPPORT].setBool(oftSupport);
 	Scylla::config[USE_ADVANCED_IAT_SEARCH].setBool(useAdvancedIatSearch);
 	Scylla::config[SCAN_DIRECT_IMPORTS].setBool(scanDirectImports);
-	Scylla::config[FIX_DIRECT_IMPORTS].setBool(fixDirectImports);
+	Scylla::config[FIX_DIRECT_IMPORTS_NORMAL].setBool(fixDirectImportsNormal);
+	Scylla::config[FIX_DIRECT_IMPORTS_UNIVERSAL].setBool(fixDirectImportsUniversal);
 	Scylla::config[CREATE_NEW_IAT_IN_SECTION].setBool(createNewIatInSection);
 }
 
 void OptionsGui::loadOptions()
 {
 	usePEHeaderFromDisk    = Scylla::config[USE_PE_HEADER_FROM_DISK].getBool();
 	debugPrivilege         = Scylla::config[DEBUG_PRIVILEGE].getBool();
 	createBackup           = Scylla::config[CREATE_BACKUP].getBool();
 	dllInjectionAutoUnload = Scylla::config[DLL_INJECTION_AUTO_UNLOAD].getBool();
 	updateHeaderChecksum   = Scylla::config[UPDATE_HEADER_CHECKSUM].getBool();
 	wcsncpy_s(iatSectionName, Scylla::config[IAT_SECTION_NAME].getString(), _countof(iatSectionName)-1);
 	iatSectionName[_countof(iatSectionName) - 1] = L'\0';
 
 	removeDosHeaderStub = Scylla::config[REMOVE_DOS_HEADER_STUB].getBool();
 	fixIatAndOep = Scylla::config[IAT_FIX_AND_OEP_FIX].getBool();
 	suspendProcessForDumping = Scylla::config[SUSPEND_PROCESS_FOR_DUMPING].getBool();
 	oftSupport = Scylla::config[OriginalFirstThunk_SUPPORT].getBool();
 	useAdvancedIatSearch = Scylla::config[USE_ADVANCED_IAT_SEARCH].getBool();
 	scanDirectImports = Scylla::config[SCAN_DIRECT_IMPORTS].getBool();
-	fixDirectImports = Scylla::config[FIX_DIRECT_IMPORTS].getBool();
+	fixDirectImportsNormal = Scylla::config[FIX_DIRECT_IMPORTS_NORMAL].getBool();
+	fixDirectImportsUniversal = Scylla::config[FIX_DIRECT_IMPORTS_UNIVERSAL].getBool();
 	createNewIatInSection = Scylla::config[CREATE_NEW_IAT_IN_SECTION].getBool();
 }
diff --git a/Scylla/OptionsGui.h b/Scylla/OptionsGui.h
index a6a803c..ba469aa 100644
--- a/Scylla/OptionsGui.h
+++ b/Scylla/OptionsGui.h
@@ -1,78 +1,80 @@
 #pragma once
 
 #include <windows.h>
 #include "resource.h"
 
 // WTL
 #include <atlbase.h>       // base ATL classes
 #include <atlapp.h>        // base WTL classes
 #include <atlwin.h>        // ATL GUI classes
 #include <atlcrack.h>      // WTL enhanced msg map macros
 #include <atlctrls.h>      // WTL controls
 #include <atlddx.h>        // WTL dialog data exchange
 
 class OptionsGui : public CDialogImpl<OptionsGui>, public CWinDataExchange<OptionsGui>
 {
 public:
 	enum { IDD = IDD_DLG_OPTIONS };
 
 	BEGIN_DDX_MAP(OptionsGui)
 		DDX_CONTROL_HANDLE(IDC_OPTIONS_SECTIONNAME, EditSectionName)
 		DDX_TEXT(IDC_OPTIONS_SECTIONNAME, iatSectionName)
 		DDX_CHECK(IDC_CHECK_HEADER_CHECKSUM, updateHeaderChecksum)
 		DDX_CHECK(IDC_CHECK_CREATE_BACKUP, createBackup)
 		DDX_CHECK(IDC_CHECK_UNLOAD_DLL, dllInjectionAutoUnload)
 		DDX_CHECK(IDC_CHECK_PE_HEADER_FROM_DISK, usePEHeaderFromDisk)
 		DDX_CHECK(IDC_CHECK_DEBUG_PRIVILEGES, debugPrivilege)
 		DDX_CHECK(IDC_CHECK_REMOVE_DOS_STUB, removeDosHeaderStub)
 		DDX_CHECK(IDC_CHECK_FIX_IAT_AND_OEP, fixIatAndOep)
 		DDX_CHECK(IDC_CHECK_SUSPEND_PROCESS, suspendProcessForDumping)
 		DDX_CHECK(IDC_CHECKOFTSUPPORT, oftSupport)
 		DDX_CHECK(IDC_CHECK_USEADVANCEDIATSEARCH, useAdvancedIatSearch)
 		DDX_CHECK(IDC_SCANDIRECTIMPORT, scanDirectImports)
-		DDX_CHECK(IDC_FIXDIRECTIMPORTS, fixDirectImports)
+		DDX_CHECK(IDC_FIXDIRECTIMPORTSNORMAL, fixDirectImportsNormal)
+		DDX_CHECK(IDC_FIXDIRECTIMPORTSUNIVERSAL, fixDirectImportsUniversal)
 		DDX_CHECK(IDC_NEWIATINSECTION, createNewIatInSection)
 	END_DDX_MAP()
 
 	BEGIN_MSG_MAP(OptionsGui)
 		MSG_WM_INITDIALOG(OnInitDialog)
 
 		COMMAND_ID_HANDLER_EX(IDC_BTN_OPTIONS_OK, OnOK)
 		COMMAND_ID_HANDLER_EX(IDC_BTN_OPTIONS_CANCEL, OnCancel)
 		COMMAND_ID_HANDLER_EX(IDCANCEL, OnCancel)
 	END_MSG_MAP()
 
 protected:
 
 	// Settings (filled by DDX)
 
 	WCHAR iatSectionName[IMAGE_SIZEOF_SHORT_NAME+1];
 	bool updateHeaderChecksum;
 	bool createBackup;
 	bool dllInjectionAutoUnload;
 	bool usePEHeaderFromDisk;
 	bool debugPrivilege;
 	bool removeDosHeaderStub;
 	bool fixIatAndOep;
 	bool suspendProcessForDumping;
 	bool oftSupport;
 	bool useAdvancedIatSearch;
 	bool scanDirectImports;
-	bool fixDirectImports;
+	bool fixDirectImportsNormal;
+	bool fixDirectImportsUniversal;
 	bool createNewIatInSection;
 	// Controls
 
 	CEdit EditSectionName;
 
 	// Message handlers
 
 	BOOL OnInitDialog(CWindow wndFocus, LPARAM lInitParam);
 
 	void OnOK(UINT uNotifyCode, int nID, CWindow wndCtl);
 	void OnCancel(UINT uNotifyCode, int nID, CWindow wndCtl);
 
 	// Gui helpers
 
 	void saveOptions() const;
 	void loadOptions();
 };
diff --git a/Scylla/PeParser.cpp b/Scylla/PeParser.cpp
index bf95d51..453129c 100644
--- a/Scylla/PeParser.cpp
+++ b/Scylla/PeParser.cpp
@@ -1,1263 +1,1268 @@
 
 #include "PeParser.h"
 #include "ProcessAccessHelp.h"
 #include <algorithm>
 #include <imagehlp.h>
 
 #pragma comment(lib, "Imagehlp.lib")
 
 
 PeParser::PeParser()
 {
 	initClass();
 }
 
 PeParser::PeParser(const WCHAR * file, bool readSectionHeaders)
 {
 	initClass();
 
 	filename = file;
 
 	if (filename)
 	{
 		readPeHeaderFromFile(readSectionHeaders);
 
 		if (readSectionHeaders)
 		{
 			if (isValidPeFile())
 			{
 				getSectionHeaders();
 			}
 		}
 	}
 }
 
 PeParser::PeParser(const DWORD_PTR moduleBase, bool readSectionHeaders)
 {
 	initClass();
 
 	moduleBaseAddress = moduleBase;
 
 	if (moduleBaseAddress)
 	{
 		readPeHeaderFromProcess(readSectionHeaders);
 
 		if (readSectionHeaders)
 		{
 			if (isValidPeFile())
 			{
 				getSectionHeaders();
 			}
 		}
 	}
 
 }
 
 PeParser::~PeParser()
 {
 	if (headerMemory)
 	{
 		delete [] headerMemory;
 	}
 	if (fileMemory)
 	{
 		delete [] fileMemory;
 	}
 
 	for (size_t i = 0; i < listPeSection.size(); i++)
 	{
 		if (listPeSection[i].data)
 		{
 			delete [] listPeSection[i].data;
 		}
 	}
 
 	listPeSection.clear();
 }
 
 void PeParser::initClass()
 {
 	fileMemory = 0;
 	headerMemory = 0;
 
 	pDosHeader = 0;
 	pDosStub = 0;
 	dosStubSize = 0;
 	pNTHeader32 = 0;
 	pNTHeader64 = 0;
 	overlayData = 0;
 	overlaySize = 0;
 
 	filename = 0;
 	fileSize = 0;
 	moduleBaseAddress = 0;
 	hFile = INVALID_HANDLE_VALUE;
 }
 
 bool PeParser::isPE64()
 {
 	if (isValidPeFile())
 	{
 		return (pNTHeader32->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR64_MAGIC);
 	}
 	else
 	{
 		return false;
 	}
 }
 
 bool PeParser::isPE32()
 {
 	if (isValidPeFile())
 	{
 		return (pNTHeader32->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR32_MAGIC);
 	}
 	else
 	{
 		return false;
 	}
 }
 
 bool PeParser::isTargetFileSamePeFormat()
 {
 #ifdef _WIN64
 	return isPE64();
 #else
 	return isPE32();
 #endif
 }
 
 bool PeParser::isValidPeFile()
 {
 	bool retValue = false;
 
 	if (pDosHeader)
 	{
 		if (pDosHeader->e_magic == IMAGE_DOS_SIGNATURE)
 		{
 			if (pNTHeader32)
 			{
 				if (pNTHeader32->Signature == IMAGE_NT_SIGNATURE)
 				{
 					retValue = true;
 				}
 			}
 		}
 	}
 
 	return retValue;
 }
 
 bool PeParser::hasDirectory(const int directoryIndex)
 {
 	if (isPE32())
 	{
 		return (pNTHeader32->OptionalHeader.DataDirectory[directoryIndex].VirtualAddress != 0);
 	}
 	else if (isPE64())
 	{
 		return (pNTHeader64->OptionalHeader.DataDirectory[directoryIndex].VirtualAddress != 0);
 	}
 	else
 	{
 		return false;
 	}
 }
 
 bool PeParser::hasExportDirectory()
 {
 	return hasDirectory(IMAGE_DIRECTORY_ENTRY_EXPORT);
 }
 
 bool PeParser::hasTLSDirectory()
 {
 	return hasDirectory(IMAGE_DIRECTORY_ENTRY_TLS);
 }
 
 bool PeParser::hasRelocationDirectory()
 {
 	return hasDirectory(IMAGE_DIRECTORY_ENTRY_BASERELOC);
 }
 
 DWORD PeParser::getEntryPoint()
 {
 	if (isPE32())
 	{
 		return pNTHeader32->OptionalHeader.AddressOfEntryPoint;
 	}
 	else if (isPE64())
 	{
 		return pNTHeader64->OptionalHeader.AddressOfEntryPoint;
 	}
 	else
 	{
 		return 0;
 	}
 }
 
 bool PeParser::readPeHeaderFromProcess(bool readSectionHeaders)
 {
 	bool retValue = false;
 	DWORD correctSize = 0;
 
 	DWORD readSize = getInitialHeaderReadSize(readSectionHeaders);
 
 	headerMemory = new BYTE[readSize];
 
 	if (ProcessAccessHelp::readMemoryPartlyFromProcess(moduleBaseAddress, readSize, headerMemory))
 	{
 		retValue = true;
 
 		getDosAndNtHeader(headerMemory, (LONG)readSize);
 
 		if (isValidPeFile())
 		{
 			correctSize = calcCorrectPeHeaderSize(readSectionHeaders);
 
 			if (readSize < correctSize)
 			{
 				readSize = correctSize;
 				delete [] headerMemory;
 				headerMemory = new BYTE[readSize];
 
 				if (ProcessAccessHelp::readMemoryPartlyFromProcess(moduleBaseAddress, readSize, headerMemory))
 				{
 					getDosAndNtHeader(headerMemory, (LONG)readSize);
 				}
 			}
 		}
 	}
 
 	return retValue;
 }
 
 bool PeParser::readPeHeaderFromFile(bool readSectionHeaders)
 {
 	bool retValue = false;
 	DWORD correctSize = 0;
 	DWORD numberOfBytesRead = 0;
 
 	DWORD readSize = getInitialHeaderReadSize(readSectionHeaders);
 
 	headerMemory = new BYTE[readSize];
 
 	if (openFileHandle())
 	{
 		fileSize = (DWORD)ProcessAccessHelp::getFileSize(hFile);
 
 		if (ReadFile(hFile, headerMemory, readSize, &numberOfBytesRead, 0))
 		{
 			retValue = true;
 
 			getDosAndNtHeader(headerMemory, (LONG)readSize);
 
 			if (isValidPeFile())
 			{
 				correctSize = calcCorrectPeHeaderSize(readSectionHeaders);
 
 				if (readSize < correctSize)
 				{
 					readSize = correctSize;
 
 					if (fileSize > 0)
 					{
 						if (fileSize < correctSize)
 						{
 							readSize = fileSize;
 						}
 					}
 
 					
 					delete [] headerMemory;
 					headerMemory = new BYTE[readSize];
 
 					SetFilePointer(hFile, 0, 0, FILE_BEGIN);
 
 					if (ReadFile(hFile, headerMemory, readSize, &numberOfBytesRead, 0))
 					{
 						getDosAndNtHeader(headerMemory, (LONG)readSize);
 					}
 				}
 			}
 		}
 
 		closeFileHandle();
 	}
 
 	return retValue;
 }
 
 bool PeParser::readPeSectionsFromProcess()
 {
 	bool retValue = true;
 	DWORD_PTR readOffset = 0;
 
 	listPeSection.reserve(getNumberOfSections());
 
 	for (WORD i = 0; i < getNumberOfSections(); i++)
 	{
 		readOffset = listPeSection[i].sectionHeader.VirtualAddress + moduleBaseAddress;
 
 		listPeSection[i].normalSize = listPeSection[i].sectionHeader.Misc.VirtualSize;
 
 		if (!readSectionFromProcess(readOffset, listPeSection[i]))
 		{
 			retValue = false;
 		}
 	}
 
 	return retValue;
 }
 
 bool PeParser::readPeSectionsFromFile()
 {
 	bool retValue = true;
 	DWORD readOffset = 0;
 
 	listPeSection.reserve(getNumberOfSections());
 
 
 	if (openFileHandle())
 	{
 		for (WORD i = 0; i < getNumberOfSections(); i++)
 		{
 			readOffset = listPeSection[i].sectionHeader.PointerToRawData;
 
 			listPeSection[i].normalSize = listPeSection[i].sectionHeader.SizeOfRawData;
 
 			if (!readSectionFromFile(readOffset, listPeSection[i]))
 			{
 				retValue = false;
 			}
 			
 		}
 
 		closeFileHandle();
 	}
 	else
 	{
 		retValue = false;
 	}
 
 	return retValue;
 }
 
 bool PeParser::getSectionHeaders()
 {
 	PIMAGE_SECTION_HEADER pSection = IMAGE_FIRST_SECTION(pNTHeader32);
 
 	PeFileSection peFileSection;
 
 	listPeSection.clear();
 	listPeSection.reserve(getNumberOfSections());
 
 	for (WORD i = 0; i < getNumberOfSections(); i++)
 	{
 		memcpy_s(&peFileSection.sectionHeader, sizeof(IMAGE_SECTION_HEADER), pSection, sizeof(IMAGE_SECTION_HEADER));
 
 		listPeSection.push_back(peFileSection);
 		pSection++;
 	}
 
 	return true;
 }
 
 bool PeParser::getSectionNameUnicode(const int sectionIndex, WCHAR * output, const int outputLen)
 {
 	CHAR sectionNameA[IMAGE_SIZEOF_SHORT_NAME + 1] = {0};
 	
 	output[0] = 0;
 
 	memcpy(sectionNameA, listPeSection[sectionIndex].sectionHeader.Name, IMAGE_SIZEOF_SHORT_NAME); //not null terminated
 
 	return (swprintf_s(output, outputLen, L"%S", sectionNameA) != -1);
 }
 
 WORD PeParser::getNumberOfSections()
 {
 	return pNTHeader32->FileHeader.NumberOfSections;
 }
 
 void PeParser::setNumberOfSections(WORD numberOfSections)
 {
 	pNTHeader32->FileHeader.NumberOfSections = numberOfSections;
 }
 
 std::vector<PeFileSection> & PeParser::getSectionHeaderList()
 {
 	return listPeSection;
 }
 
 void PeParser::getDosAndNtHeader(BYTE * memory, LONG size)
 {
 	pDosHeader = (PIMAGE_DOS_HEADER)memory;
 
 	pNTHeader32 = 0;
 	pNTHeader64 = 0;
 	dosStubSize = 0;
 	pDosStub = 0;
 
 	if (pDosHeader->e_lfanew > 0 && pDosHeader->e_lfanew < size) //malformed PE
 	{
 		pNTHeader32 = (PIMAGE_NT_HEADERS32)((DWORD_PTR)pDosHeader + pDosHeader->e_lfanew);
 		pNTHeader64 = (PIMAGE_NT_HEADERS64)((DWORD_PTR)pDosHeader + pDosHeader->e_lfanew);
 
 		if (pDosHeader->e_lfanew > sizeof(IMAGE_DOS_HEADER))
 		{
 			dosStubSize = pDosHeader->e_lfanew - sizeof(IMAGE_DOS_HEADER);
 			pDosStub = (BYTE *)((DWORD_PTR)pDosHeader + sizeof(IMAGE_DOS_HEADER));
 		}
 		else if (pDosHeader->e_lfanew < sizeof(IMAGE_DOS_HEADER))
 		{
 			//Overlapped Headers, e.g. Spack (by Bagie)
 			pDosHeader->e_lfanew = sizeof(IMAGE_DOS_HEADER);
 		}
 	}
 }
 
 DWORD PeParser::calcCorrectPeHeaderSize(bool readSectionHeaders)
 {
 	DWORD correctSize = pDosHeader->e_lfanew + 50; //extra buffer
 
 	if (readSectionHeaders)
 	{
 		correctSize += getNumberOfSections() * sizeof(IMAGE_SECTION_HEADER);
 	}
 
 	if (isPE32())
 	{
 		correctSize += sizeof(IMAGE_NT_HEADERS32);
 	}
 	else if(isPE64())
 	{
 		correctSize += sizeof(IMAGE_NT_HEADERS64);
 	}
 	else
 	{
 		correctSize = 0; //not a valid PE
 	}
 
 	return correctSize;
 }
 
 DWORD PeParser::getInitialHeaderReadSize(bool readSectionHeaders)
 {
 	DWORD readSize = sizeof(IMAGE_DOS_HEADER) + 0x300 + sizeof(IMAGE_NT_HEADERS64);
 
 	//if (readSectionHeaders)
 	//{
 	//	readSize += (10 * sizeof(IMAGE_SECTION_HEADER));
 	//}
 
 	return readSize;
 }
 
 DWORD PeParser::getSectionHeaderBasedFileSize()
 {
 	DWORD lastRawOffset = 0, lastRawSize = 0;
 
 	//this is needed if the sections aren't sorted by their RawOffset (e.g. Petite)
 	for (WORD i = 0; i < getNumberOfSections(); i++)
 	{
 		if (listPeSection[i].sectionHeader.PointerToRawData > lastRawOffset)
 		{
 			lastRawOffset = listPeSection[i].sectionHeader.PointerToRawData;
 			lastRawSize = listPeSection[i].sectionHeader.SizeOfRawData;
 		}
 	}
 
 	return (lastRawSize + lastRawOffset);
 }
 
 DWORD PeParser::getSectionHeaderBasedSizeOfImage()
 {
 	DWORD lastVirtualOffset = 0, lastVirtualSize = 0;
 
 	//this is needed if the sections aren't sorted by their RawOffset (e.g. Petite)
 	for (WORD i = 0; i < getNumberOfSections(); i++)
 	{
 		if (listPeSection[i].sectionHeader.VirtualAddress > lastVirtualOffset)
 		{
 			lastVirtualOffset = listPeSection[i].sectionHeader.VirtualAddress;
 			lastVirtualSize = listPeSection[i].sectionHeader.Misc.VirtualSize;
 		}
 	}
 
 	return (lastVirtualSize + lastVirtualOffset);
 }
 
 bool PeParser::openFileHandle()
 {
 	if (hFile == INVALID_HANDLE_VALUE)
 	{
 		if (filename)
 		{
 			hFile = CreateFile(filename, GENERIC_READ, FILE_SHARE_READ, 0, OPEN_EXISTING, 0, 0);
 		}
 		else
 		{
 			hFile = INVALID_HANDLE_VALUE;
 		}
 	}
 
 	return (hFile != INVALID_HANDLE_VALUE);
 }
 
 bool PeParser::openWriteFileHandle( const WCHAR * newFile )
 {
 	if (newFile)
 	{
 		hFile = CreateFile(newFile, GENERIC_WRITE, FILE_SHARE_WRITE, 0, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, 0);
 	}
 	else
 	{
 		hFile = INVALID_HANDLE_VALUE;
 	}
 
 	return (hFile != INVALID_HANDLE_VALUE);
 }
 
 
 void PeParser::closeFileHandle()
 {
 	if (hFile != INVALID_HANDLE_VALUE)
 	{
 		CloseHandle(hFile);
 		hFile = INVALID_HANDLE_VALUE;
 	}
 }
 
 bool PeParser::readSectionFromProcess(const DWORD_PTR readOffset, PeFileSection & peFileSection)
 {
 	return readSectionFrom(readOffset, peFileSection, true); //process
 }
 
 bool PeParser::readSectionFromFile(const DWORD readOffset, PeFileSection & peFileSection)
 {
 	return readSectionFrom(readOffset, peFileSection, false); //file
 }
 
 bool PeParser::readSectionFrom(const DWORD_PTR readOffset, PeFileSection & peFileSection, const bool isProcess)
 {
 	const DWORD maxReadSize = 100;
 	DWORD currentReadSize;
 	BYTE data[maxReadSize];
 	bool retValue = true;
 	DWORD valuesFound = 0;
 	DWORD readSize = 0;
 	DWORD_PTR currentOffset = 0;
 
 	peFileSection.data = 0;
 	peFileSection.dataSize = 0;
 	readSize = peFileSection.normalSize;
 
 	if (!readOffset || !readSize)
 	{
 		return true; //section without data is valid
 	}
 
 	if (readSize <= maxReadSize)
 	{
 		peFileSection.dataSize = readSize;
 		peFileSection.normalSize = readSize;
 
 		if (isProcess)
 		{
 			return readPeSectionFromProcess(readOffset, peFileSection);
 		}
 		else
 		{
 			return readPeSectionFromFile((DWORD)readOffset, peFileSection);
 		}
 	}
 
 	currentReadSize = readSize % maxReadSize; //alignment %
 
 	if (!currentReadSize)
 	{
 		currentReadSize = maxReadSize;
 	}
 	currentOffset = readOffset + readSize - currentReadSize;
 
 
 	while(currentOffset >= readOffset) //start from the end
 	{
 		ZeroMemory(data, currentReadSize);
 
 		if (isProcess)
 		{
 			retValue = ProcessAccessHelp::readMemoryPartlyFromProcess(currentOffset, currentReadSize, data);
 		}
 		else
 		{
 			retValue = ProcessAccessHelp::readMemoryFromFile(hFile, (LONG)currentOffset, currentReadSize, data);
 		}
 
 		if (!retValue)
 		{
 			break;
 		}
 
 		valuesFound = isMemoryNotNull(data, currentReadSize);
 		if (valuesFound)
 		{
 			//found some real code
 
 			currentOffset += valuesFound;
 
 			if (readOffset < currentOffset)
 			{
 				//real size
 				peFileSection.dataSize = (DWORD)(currentOffset - readOffset);
 
 				//some safety space because of something like this at the end of a section:
 				//FF25 C0604000 JMP DWORD PTR DS:[<&KERNEL32.RtlUnwind>]
 				peFileSection.dataSize += sizeof(DWORD);;
 			}
 
 			break;
 		}
 
 		currentReadSize = maxReadSize;
 		currentOffset -= currentReadSize;
 	}
 
 
 	if (peFileSection.dataSize)
 	{
 		if (isProcess)
 		{
 			retValue = readPeSectionFromProcess(readOffset, peFileSection);
 		}
 		else
 		{
 			retValue = readPeSectionFromFile((DWORD)readOffset, peFileSection);
 		}
 	}
 
 	return retValue;
 }
 
 
 DWORD PeParser::isMemoryNotNull( BYTE * data, int dataSize )
 {
 	for (int i = (dataSize - 1); i >= 0; i--)
 	{
 		if (data[i] != 0)
 		{
 			return i + 1;
 		}
 	}
 
 	return 0;
 }
 
 bool PeParser::savePeFileToDisk( const WCHAR * newFile )
 {
 	bool retValue = true;
 	DWORD dwFileOffset = 0, dwWriteSize = 0;
 
 	if (getNumberOfSections() != listPeSection.size())
 	{
 		return false;
 	}
 
 	if (openWriteFileHandle(newFile))
 	{
 		//Dos header
 		dwWriteSize = sizeof(IMAGE_DOS_HEADER);
 		if (!ProcessAccessHelp::writeMemoryToFile(hFile, dwFileOffset, dwWriteSize, pDosHeader))
 		{
 			retValue = false;
 		}
 		dwFileOffset += dwWriteSize;
 
 
 		if (dosStubSize && pDosStub)
 		{
 			//Dos Stub
 			dwWriteSize = dosStubSize;
 			if (!ProcessAccessHelp::writeMemoryToFile(hFile, dwFileOffset, dwWriteSize, pDosStub))
 			{
 				retValue = false;
 			}
 			dwFileOffset += dwWriteSize;
 		}
 
 
 		//Pe Header
 		if (isPE32())
 		{
 			dwWriteSize = sizeof(IMAGE_NT_HEADERS32);
 		}
 		else
 		{
 			dwWriteSize = sizeof(IMAGE_NT_HEADERS64);
 		}
 
 		if (!ProcessAccessHelp::writeMemoryToFile(hFile, dwFileOffset, dwWriteSize, pNTHeader32))
 		{
 			retValue = false;
 		}
 		dwFileOffset += dwWriteSize;
 
 		//section headers
 		dwWriteSize = sizeof(IMAGE_SECTION_HEADER);
 
 		for (WORD i = 0; i < getNumberOfSections(); i++)
 		{
 			if (!ProcessAccessHelp::writeMemoryToFile(hFile, dwFileOffset, dwWriteSize, &listPeSection[i].sectionHeader))
 			{
 				retValue = false;
 				break;
 			}
 			dwFileOffset += dwWriteSize;
 		}
 
 		for (WORD i = 0; i < getNumberOfSections(); i++)
 		{
 			if (!listPeSection[i].sectionHeader.PointerToRawData)
 				continue;
 
 
 			if (listPeSection[i].sectionHeader.PointerToRawData > dwFileOffset)
 			{
 				dwWriteSize = listPeSection[i].sectionHeader.PointerToRawData - dwFileOffset; //padding
 
 				if (!writeZeroMemoryToFile(hFile, dwFileOffset, dwWriteSize))
 				{
 					retValue = false;
 					break;
 				}
 				dwFileOffset += dwWriteSize;
 			}
 
 			dwWriteSize = listPeSection[i].dataSize;
 
 			if (dwWriteSize)
 			{
 				if (!ProcessAccessHelp::writeMemoryToFile(hFile, listPeSection[i].sectionHeader.PointerToRawData, dwWriteSize, listPeSection[i].data))
 				{
 					retValue = false;
 					break;
 				}
 				dwFileOffset += dwWriteSize;
 
 				if (listPeSection[i].dataSize < listPeSection[i].sectionHeader.SizeOfRawData) //padding
 				{
 					dwWriteSize = listPeSection[i].sectionHeader.SizeOfRawData - listPeSection[i].dataSize;
 
 					if (!writeZeroMemoryToFile(hFile, dwFileOffset, dwWriteSize))
 					{
 						retValue = false;
 						break;
 					}
 					dwFileOffset += dwWriteSize;
 				}
 			}
 
 		}
 
 		//add overlay?
 		if (overlaySize && overlayData)
 		{
 			dwWriteSize = overlaySize;
 			if (!ProcessAccessHelp::writeMemoryToFile(hFile, dwFileOffset, dwWriteSize, overlayData))
 			{
 				retValue = false;
 			}
 			dwFileOffset += dwWriteSize;
 		}
 
 		SetEndOfFile(hFile);
 
 		closeFileHandle();
 	}
 
 	return retValue;
 }
 
 bool PeParser::writeZeroMemoryToFile(HANDLE hFile, DWORD fileOffset, DWORD size)
 {
 	bool retValue = false;
 	PVOID zeromemory = calloc(size, 1);
 
 	if (zeromemory)
 	{
 		retValue = ProcessAccessHelp::writeMemoryToFile(hFile, fileOffset, size, zeromemory);
 		free(zeromemory);
 	}
 
 	return retValue;
 }
 
 void PeParser::removeDosStub()
 {
 	if (pDosHeader)
 	{
 		dosStubSize = 0;
 		pDosStub = 0; //must not delete []
 		pDosHeader->e_lfanew = sizeof(IMAGE_DOS_HEADER);
 	}
 }
 
 bool PeParser::readPeSectionFromFile(DWORD readOffset, PeFileSection & peFileSection)
 {
 	DWORD bytesRead = 0;
 
 	peFileSection.data = new BYTE[peFileSection.dataSize];
 
 	SetFilePointer(hFile, readOffset, 0, FILE_BEGIN);
 
 	return (ReadFile(hFile, peFileSection.data, peFileSection.dataSize, &bytesRead, 0) != FALSE);
 }
 
 bool PeParser::readPeSectionFromProcess(DWORD_PTR readOffset, PeFileSection & peFileSection)
 {
 	peFileSection.data = new BYTE[peFileSection.dataSize];
 
 	return ProcessAccessHelp::readMemoryPartlyFromProcess(readOffset, peFileSection.dataSize, peFileSection.data);
 }
 
 DWORD PeParser::alignValue(DWORD badValue, DWORD alignTo)
 {
 	return (((badValue + alignTo - 1) / alignTo) * alignTo);
 }
 
 bool PeParser::addNewLastSection(const CHAR * sectionName, DWORD sectionSize, BYTE * sectionData)
 {
 	size_t nameLength = strlen(sectionName);
 	DWORD fileAlignment = 0, sectionAlignment = 0;
 	PeFileSection peFileSection;
 
 	if (nameLength > IMAGE_SIZEOF_SHORT_NAME)
 	{
 		return false;
 	}
 
 	if (isPE32())
 	{
 		fileAlignment = pNTHeader32->OptionalHeader.FileAlignment;
 		sectionAlignment = pNTHeader32->OptionalHeader.SectionAlignment;
 	}
 	else
 	{
 		fileAlignment = pNTHeader64->OptionalHeader.FileAlignment;
 		sectionAlignment = pNTHeader64->OptionalHeader.SectionAlignment;
 	}
 
 	memcpy_s(peFileSection.sectionHeader.Name, IMAGE_SIZEOF_SHORT_NAME, sectionName, nameLength);
 
 	//last section doesn't need SizeOfRawData alignment
 	peFileSection.sectionHeader.SizeOfRawData = sectionSize; //alignValue(sectionSize, fileAlignment);
 	peFileSection.sectionHeader.Misc.VirtualSize = alignValue(sectionSize, sectionAlignment);
 
 	peFileSection.sectionHeader.PointerToRawData = alignValue(getSectionHeaderBasedFileSize(), fileAlignment);
 	peFileSection.sectionHeader.VirtualAddress = alignValue(getSectionHeaderBasedSizeOfImage(), sectionAlignment);
 
 	peFileSection.sectionHeader.Characteristics = IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA;
 
 	peFileSection.normalSize = peFileSection.sectionHeader.SizeOfRawData;
 	peFileSection.dataSize = peFileSection.sectionHeader.SizeOfRawData;
 
 	if (sectionData == 0)
 	{
 		peFileSection.data = new BYTE[peFileSection.sectionHeader.SizeOfRawData];
 		ZeroMemory(peFileSection.data , peFileSection.sectionHeader.SizeOfRawData);
 	}
 	else
 	{
 		peFileSection.data = sectionData;
 	}
 
 	listPeSection.push_back(peFileSection);
 
 	setNumberOfSections(getNumberOfSections() + 1);
 
 	return true;
 }
 
 DWORD_PTR PeParser::getStandardImagebase()
 {
 	if (isPE32())
 	{
 		return pNTHeader32->OptionalHeader.ImageBase;
 	}
 	else
 	{
 		return pNTHeader64->OptionalHeader.ImageBase;
 	}
 }
 
 int PeParser::convertRVAToOffsetVectorIndex(DWORD_PTR dwRVA)
 {
 	for (WORD i = 0; i < getNumberOfSections(); i++)
 	{
 		if ((listPeSection[i].sectionHeader.VirtualAddress <= dwRVA) && ((listPeSection[i].sectionHeader.VirtualAddress + listPeSection[i].sectionHeader.Misc.VirtualSize) > dwRVA))
 		{
 			return i;
 		}
 	}
 
 	return -1;
 }
 
 DWORD_PTR PeParser::convertRVAToOffsetVector(DWORD_PTR dwRVA)
 {
 	for (WORD i = 0; i < getNumberOfSections(); i++)
 	{
 		if ((listPeSection[i].sectionHeader.VirtualAddress <= dwRVA) && ((listPeSection[i].sectionHeader.VirtualAddress + listPeSection[i].sectionHeader.Misc.VirtualSize) > dwRVA))
 		{
 			return ((dwRVA - listPeSection[i].sectionHeader.VirtualAddress) + listPeSection[i].sectionHeader.PointerToRawData);
 		}
 	}
 
 	return 0;
 }
 
 DWORD_PTR PeParser::convertRVAToOffsetRelative(DWORD_PTR dwRVA)
 {
 	for (WORD i = 0; i < getNumberOfSections(); i++)
 	{
 		if ((listPeSection[i].sectionHeader.VirtualAddress <= dwRVA) && ((listPeSection[i].sectionHeader.VirtualAddress + listPeSection[i].sectionHeader.Misc.VirtualSize) > dwRVA))
 		{
 			return (dwRVA - listPeSection[i].sectionHeader.VirtualAddress);
 		}
 	}
 
 	return 0;
 }
 
 DWORD_PTR PeParser::convertOffsetToRVAVector(DWORD_PTR dwOffset)
 {
 	for (WORD i = 0; i < getNumberOfSections(); i++)
 	{
 		if ((listPeSection[i].sectionHeader.PointerToRawData <= dwOffset) && ((listPeSection[i].sectionHeader.PointerToRawData + listPeSection[i].sectionHeader.SizeOfRawData) > dwOffset))
 		{
 			return ((dwOffset - listPeSection[i].sectionHeader.PointerToRawData) + listPeSection[i].sectionHeader.VirtualAddress);
 		}
 	}
 
 	return 0;
 }
 
 void PeParser::fixPeHeader()
 {
 	DWORD dwSize = pDosHeader->e_lfanew + sizeof(DWORD) + sizeof(IMAGE_FILE_HEADER);
 
 	if (isPE32())
 	{
 		//delete bound import directories
 		pNTHeader32->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT].VirtualAddress = 0;
 		pNTHeader32->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT].Size = 0;
 
 		//max 16, zeroing possible garbage values
 		for (DWORD i = pNTHeader32->OptionalHeader.NumberOfRvaAndSizes; i < IMAGE_NUMBEROF_DIRECTORY_ENTRIES; i++)
 		{
 			pNTHeader32->OptionalHeader.DataDirectory[i].Size = 0;
 			pNTHeader32->OptionalHeader.DataDirectory[i].VirtualAddress = 0;
 		}
 
 		pNTHeader32->OptionalHeader.NumberOfRvaAndSizes = IMAGE_NUMBEROF_DIRECTORY_ENTRIES;
 		pNTHeader32->FileHeader.SizeOfOptionalHeader = sizeof(IMAGE_OPTIONAL_HEADER32);
 
 		pNTHeader32->OptionalHeader.SizeOfImage = getSectionHeaderBasedSizeOfImage();
 
 		if (moduleBaseAddress)
 		{
 			pNTHeader32->OptionalHeader.ImageBase = (DWORD)moduleBaseAddress;
 		}
 		
 		pNTHeader32->OptionalHeader.SizeOfHeaders = alignValue(dwSize + pNTHeader32->FileHeader.SizeOfOptionalHeader + (getNumberOfSections() * sizeof(IMAGE_SECTION_HEADER)), pNTHeader32->OptionalHeader.FileAlignment);
 	}
 	else
 	{
 		//delete bound import directories
 		pNTHeader64->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT].VirtualAddress = 0;
 		pNTHeader64->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT].Size = 0;
 
 		//max 16, zeroing possible garbage values
 		for (DWORD i = pNTHeader64->OptionalHeader.NumberOfRvaAndSizes; i < IMAGE_NUMBEROF_DIRECTORY_ENTRIES; i++)
 		{
 			pNTHeader64->OptionalHeader.DataDirectory[i].Size = 0;
 			pNTHeader64->OptionalHeader.DataDirectory[i].VirtualAddress = 0;
 		}
 
 		pNTHeader64->OptionalHeader.NumberOfRvaAndSizes = IMAGE_NUMBEROF_DIRECTORY_ENTRIES;
 		pNTHeader64->FileHeader.SizeOfOptionalHeader = sizeof(IMAGE_OPTIONAL_HEADER64);
 		
 		pNTHeader64->OptionalHeader.SizeOfImage = getSectionHeaderBasedSizeOfImage();
 
 		if (moduleBaseAddress)
 		{
 			pNTHeader64->OptionalHeader.ImageBase = moduleBaseAddress;
 		}
 
 		pNTHeader64->OptionalHeader.SizeOfHeaders = alignValue(dwSize + pNTHeader64->FileHeader.SizeOfOptionalHeader + (getNumberOfSections() * sizeof(IMAGE_SECTION_HEADER)), pNTHeader64->OptionalHeader.FileAlignment);
 	}
 
 	removeIatDirectory();
 }
 
 void PeParser::removeIatDirectory()
 {
 	DWORD searchAddress = 0;
 
 	if (isPE32())
 	{
 		searchAddress = pNTHeader32->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IAT].VirtualAddress;
 
 		pNTHeader32->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IAT].VirtualAddress = 0;
 		pNTHeader32->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IAT].Size = 0;
 	}
 	else
 	{
 		searchAddress = pNTHeader64->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IAT].VirtualAddress;
 
 		pNTHeader64->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IAT].VirtualAddress = 0;
 		pNTHeader64->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IAT].Size = 0;
 	}
 
 	if (searchAddress)
 	{
 		for (WORD i = 0; i < getNumberOfSections(); i++)
 		{
 			if ((listPeSection[i].sectionHeader.VirtualAddress <= searchAddress) && ((listPeSection[i].sectionHeader.VirtualAddress + listPeSection[i].sectionHeader.Misc.VirtualSize) > searchAddress))
 			{
 				//section must be read and writable
 				listPeSection[i].sectionHeader.Characteristics |= IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE;
 			}
 		}
 	}
 }
 
 void PeParser::setDefaultFileAlignment()
 {
 	if (isPE32())
 	{
 		pNTHeader32->OptionalHeader.FileAlignment = FileAlignmentConstant;
 	}
 	else
 	{
 		pNTHeader64->OptionalHeader.FileAlignment = FileAlignmentConstant;
 	}
 }
 
 bool PeFileSectionSortByPointerToRawData(const PeFileSection& d1, const PeFileSection& d2)
 {
 	return d1.sectionHeader.PointerToRawData < d2.sectionHeader.PointerToRawData;
 }
 
 bool PeFileSectionSortByVirtualAddress(const PeFileSection& d1, const PeFileSection& d2)
 {
 	return d1.sectionHeader.VirtualAddress < d2.sectionHeader.VirtualAddress;
 }
 
 void PeParser::alignAllSectionHeaders()
 {
 	DWORD sectionAlignment = 0;
 	DWORD fileAlignment = 0;
 	DWORD newFileSize = 0;
 
 	if (isPE32())
 	{
 		sectionAlignment = pNTHeader32->OptionalHeader.SectionAlignment;
 		fileAlignment = pNTHeader32->OptionalHeader.FileAlignment;
 	}
 	else
 	{
 		sectionAlignment = pNTHeader64->OptionalHeader.SectionAlignment;
 		fileAlignment = pNTHeader64->OptionalHeader.FileAlignment;
 	}
 
 	std::sort(listPeSection.begin(), listPeSection.end(), PeFileSectionSortByPointerToRawData); //sort by PointerToRawData ascending
 
 	newFileSize = pDosHeader->e_lfanew + sizeof(DWORD) + sizeof(IMAGE_FILE_HEADER) + pNTHeader32->FileHeader.SizeOfOptionalHeader + (getNumberOfSections() * sizeof(IMAGE_SECTION_HEADER));
 
 
 	for (WORD i = 0; i < getNumberOfSections(); i++)
 	{
 		listPeSection[i].sectionHeader.VirtualAddress = alignValue(listPeSection[i].sectionHeader.VirtualAddress, sectionAlignment);
 		listPeSection[i].sectionHeader.Misc.VirtualSize = alignValue(listPeSection[i].sectionHeader.Misc.VirtualSize, sectionAlignment);
 
 		listPeSection[i].sectionHeader.PointerToRawData = alignValue(newFileSize, fileAlignment);
 		listPeSection[i].sectionHeader.SizeOfRawData = alignValue(listPeSection[i].dataSize, fileAlignment);
 
 		newFileSize = listPeSection[i].sectionHeader.PointerToRawData + listPeSection[i].sectionHeader.SizeOfRawData;
 	}
 
 	std::sort(listPeSection.begin(), listPeSection.end(), PeFileSectionSortByVirtualAddress); //sort by VirtualAddress ascending
 }
 
 bool PeParser::dumpProcess(DWORD_PTR modBase, DWORD_PTR entryPoint, const WCHAR * dumpFilePath)
 {
 	moduleBaseAddress = modBase;
 
 	if (readPeSectionsFromProcess())
 	{
 		setDefaultFileAlignment();
 
 		setEntryPointVa(entryPoint);
 
 		alignAllSectionHeaders();
 		fixPeHeader();
 
 		getFileOverlay();
 
 		return savePeFileToDisk(dumpFilePath);
 	}
 	
 	return false;
 }
 
 bool PeParser::dumpProcess(DWORD_PTR modBase, DWORD_PTR entryPoint, const WCHAR * dumpFilePath, std::vector<PeSection> & sectionList)
 {
 	if (listPeSection.size() == sectionList.size())
 	{
 		for (int i = (getNumberOfSections() - 1); i >= 0; i--)
 		{
 			if (!sectionList[i].isDumped)
 			{
 				listPeSection.erase(listPeSection.begin() + i);
 				setNumberOfSections(getNumberOfSections() - 1);
 			}
 			else
 			{
 				listPeSection[i].sectionHeader.Misc.VirtualSize = sectionList[i].virtualSize;
 				listPeSection[i].sectionHeader.SizeOfRawData = sectionList[i].rawSize;
 				listPeSection[i].sectionHeader.Characteristics = sectionList[i].characteristics;
 			}
 		}
 	}
 
 	return dumpProcess(modBase, entryPoint, dumpFilePath);
 }
 
 void PeParser::setEntryPointVa(DWORD_PTR entryPoint)
 {
 	DWORD entryPointRva = (DWORD)(entryPoint - moduleBaseAddress);
 
 	setEntryPointRva(entryPointRva);
 }
 
 void PeParser::setEntryPointRva(DWORD entryPoint)
 {
 	if (isPE32())
 	{
 		pNTHeader32->OptionalHeader.AddressOfEntryPoint = entryPoint;
 	}
 	else if (isPE64())
 	{
 		pNTHeader64->OptionalHeader.AddressOfEntryPoint = entryPoint;
 	}
 }
 
 bool PeParser::getFileOverlay()
 {
 	DWORD numberOfBytesRead;
 	bool retValue = false;
 
 	if (!hasOverlayData())
 	{
 		return false;
 	}
 
 	if (openFileHandle())
 	{
 		DWORD overlayOffset = getSectionHeaderBasedFileSize();
 		DWORD fileSize = (DWORD)ProcessAccessHelp::getFileSize(hFile);
 		overlaySize = fileSize - overlayOffset;
 
 		overlayData = new BYTE[overlaySize];
 
 		SetFilePointer(hFile, overlayOffset, 0, FILE_BEGIN);
 
 		if (ReadFile(hFile, overlayData, overlaySize, &numberOfBytesRead, 0))
 		{
 			retValue = true;
 		}
 
 		closeFileHandle();
 	}
 
 	return retValue;
 }
 
 bool PeParser::hasOverlayData()
 {
 	if (!filename)
 		return false;
 
 	if (isValidPeFile())
 	{
 		DWORD fileSize = (DWORD)ProcessAccessHelp::getFileSize(filename);
 
 		return (fileSize > getSectionHeaderBasedFileSize());
 	}
 	else
 	{
 		return false;
 	}
 }
 
 bool PeParser::updatePeHeaderChecksum(const WCHAR * targetFile, DWORD fileSize)
 {
 	PIMAGE_NT_HEADERS32 pNTHeader32 = 0;
 	PIMAGE_NT_HEADERS64 pNTHeader64 = 0;
 	DWORD headerSum = 0;
 	DWORD checkSum = 0;
 	bool retValue = false;
 
 	if (!fileSize)
 		return retValue;
 
 	HANDLE hFileToMap = CreateFile(targetFile, GENERIC_READ|GENERIC_WRITE, FILE_SHARE_READ|FILE_SHARE_WRITE, 0, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0);
 
 	if(hFileToMap != INVALID_HANDLE_VALUE)
 	{
 		HANDLE hMappedFile = CreateFileMapping(hFileToMap, 0, PAGE_READWRITE, 0, 0, 0);
 		if(hMappedFile)
 		{
 			if (GetLastError() != ERROR_ALREADY_EXISTS)
 			{
 				LPVOID addrMappedDll = MapViewOfFile(hMappedFile, FILE_MAP_ALL_ACCESS, 0, 0, 0);
 
 				if (addrMappedDll)
 				{
 					pNTHeader32 = (PIMAGE_NT_HEADERS32)CheckSumMappedFile(addrMappedDll, fileSize, &headerSum, &checkSum);
 
 					if (pNTHeader32)
 					{
 						if (pNTHeader32->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR64_MAGIC)
 						{
 							pNTHeader64 = (PIMAGE_NT_HEADERS64)pNTHeader32;
 							pNTHeader64->OptionalHeader.CheckSum = checkSum;
 						}
 						else
 						{
 							pNTHeader32->OptionalHeader.CheckSum = checkSum;
 						}
 
 						retValue = true;
 					}
 
 					UnmapViewOfFile(addrMappedDll);
 				}
 			}
 			CloseHandle(hMappedFile);
 		}
 		CloseHandle(hFileToMap);
 	}
 
 	return retValue;
 }
 
 BYTE * PeParser::getSectionMemoryByIndex(int index)
 {
 	return listPeSection[index].data;
 }
 
 DWORD PeParser::getSectionMemorySizeByIndex(int index)
 {
 	return listPeSection[index].dataSize;
-}
\ No newline at end of file
+}
+
+DWORD PeParser::getSectionAddressRVAByIndex( int index )
+{
+	return listPeSection[index].sectionHeader.VirtualAddress;
+}
diff --git a/Scylla/PeParser.h b/Scylla/PeParser.h
index b20482d..19328a3 100644
--- a/Scylla/PeParser.h
+++ b/Scylla/PeParser.h
@@ -1,141 +1,142 @@
 #pragma once
 
 #include <windows.h>
 #include <vector>
 #include "DumpSectionGui.h"
 
 class PeFileSection {
 public:
 	IMAGE_SECTION_HEADER sectionHeader;
 	BYTE * data;
 	DWORD dataSize;
 	DWORD normalSize;
 
 	PeFileSection()
 	{
 		ZeroMemory(&sectionHeader, sizeof(IMAGE_SECTION_HEADER));
 		data = 0;
 		dataSize = 0;
 		normalSize = 0;
 	}
 };
 
 class PeParser
 {
 public:
 	PeParser(const WCHAR * file, bool readSectionHeaders = true);
 	PeParser(const DWORD_PTR moduleBase, bool readSectionHeaders = true);
 
 	~PeParser();
 
 	bool isValidPeFile();
 	bool isPE64();
 	bool isPE32();
 
 	bool isTargetFileSamePeFormat();
 
 	WORD getNumberOfSections();
 	std::vector<PeFileSection> & getSectionHeaderList();
 
 	bool hasExportDirectory();
 	bool hasTLSDirectory();
 	bool hasRelocationDirectory();
 	bool hasOverlayData();
 
 	DWORD getEntryPoint();
 
 	bool getSectionNameUnicode(const int sectionIndex, WCHAR * output, const int outputLen);
 
 	DWORD getSectionHeaderBasedFileSize();
 	DWORD getSectionHeaderBasedSizeOfImage();
 
 	bool readPeSectionsFromProcess();
 	bool readPeSectionsFromFile();
 	bool savePeFileToDisk(const WCHAR * newFile);
 	void removeDosStub();
 	void alignAllSectionHeaders();
 	void fixPeHeader();
 	void setDefaultFileAlignment();
 	bool dumpProcess(DWORD_PTR modBase, DWORD_PTR entryPoint, const WCHAR * dumpFilePath);
 	bool dumpProcess(DWORD_PTR modBase, DWORD_PTR entryPoint, const WCHAR * dumpFilePath, std::vector<PeSection> & sectionList);
 
 	void setEntryPointVa(DWORD_PTR entryPoint);
 	void setEntryPointRva(DWORD entryPoint);
 
 	static bool updatePeHeaderChecksum(const WCHAR * targetFile, DWORD fileSize);
 	BYTE * getSectionMemoryByIndex(int index);
 	DWORD getSectionMemorySizeByIndex(int index);
 	int convertRVAToOffsetVectorIndex(DWORD_PTR dwRVA);
 	DWORD_PTR convertOffsetToRVAVector(DWORD_PTR dwOffset);
 	DWORD_PTR convertRVAToOffsetVector(DWORD_PTR dwRVA);
 	DWORD_PTR convertRVAToOffsetRelative(DWORD_PTR dwRVA);
+	DWORD getSectionAddressRVAByIndex( int index );
 protected:
 	PeParser();
 
 
 	static const DWORD FileAlignmentConstant = 0x200;
 
 	const WCHAR * filename;
 	DWORD_PTR moduleBaseAddress;
 
 	/************************************************************************/
 	/* PE FILE                                                              */
 	/*                                                                      */
 	/*  IMAGE_DOS_HEADER      64   0x40                                     */
 	/*	IMAGE_NT_HEADERS32   248   0xF8                                     */
 	/*	IMAGE_NT_HEADERS64   264  0x108                                     */
 	/*	IMAGE_SECTION_HEADER  40   0x28                                     */
 	/************************************************************************/
 
 	PIMAGE_DOS_HEADER pDosHeader;
 	BYTE * pDosStub; //between dos header and section header
 	DWORD dosStubSize;
 	PIMAGE_NT_HEADERS32 pNTHeader32;
 	PIMAGE_NT_HEADERS64 pNTHeader64;
 	std::vector<PeFileSection> listPeSection;
 	BYTE * overlayData;
 	DWORD overlaySize;
 	/************************************************************************/
 
 	BYTE * fileMemory;
 	BYTE * headerMemory;
 
 	HANDLE hFile;
 	DWORD fileSize;
 
 	bool readPeHeaderFromFile(bool readSectionHeaders);
 	bool readPeHeaderFromProcess(bool readSectionHeaders);
 
 	bool hasDirectory(const int directoryIndex);
 	bool getSectionHeaders();
 	void getDosAndNtHeader(BYTE * memory, LONG size);
 	DWORD calcCorrectPeHeaderSize( bool readSectionHeaders );
 	DWORD getInitialHeaderReadSize( bool readSectionHeaders );
 	bool openFileHandle();
 	void closeFileHandle();
 	void initClass();
 	
 	DWORD isMemoryNotNull( BYTE * data, int dataSize );
 	bool openWriteFileHandle( const WCHAR * newFile );
 	bool writeZeroMemoryToFile(HANDLE hFile, DWORD fileOffset, DWORD size);
 
 	bool readPeSectionFromFile( DWORD readOffset, PeFileSection & peFileSection );
 	bool readPeSectionFromProcess( DWORD_PTR readOffset, PeFileSection & peFileSection );
 
 	bool readSectionFromProcess(const DWORD_PTR readOffset, PeFileSection & peFileSection );
 	bool readSectionFromFile(const DWORD readOffset, PeFileSection & peFileSection );
 	bool readSectionFrom(const DWORD_PTR readOffset, PeFileSection & peFileSection, const bool isProcess);
 
 	
 	DWORD_PTR getStandardImagebase();
 
 	bool addNewLastSection(const CHAR * sectionName, DWORD sectionSize, BYTE * sectionData);
 	DWORD alignValue(DWORD badValue, DWORD alignTo);
 
 	void setNumberOfSections(WORD numberOfSections);
 	
 	void removeIatDirectory();
 	bool getFileOverlay();
-
+	
 };
 
diff --git a/Scylla/resource.h b/Scylla/resource.h
index bad659a..1d0a826 100644
Binary files a/Scylla/resource.h and b/Scylla/resource.h differ