Use this tool for fixing Import Elimination, Directly Imports and Hashed Imports.
so you can use this tool for changing IAT Base Address and Sorting IATs in
New (other) Address.
Tested on:
Armadillo
ASProtect
Enigma
ExeCryptor
eXPressor
PeSpin
RlPack
TheMida
HyperUnpackMe1
and any protector with Import Elimination, Directly Imports and Hashed Imports.
Notes:
=======
This tool is an Import Fixer (not Import Rebuilder ImpRec etc) and Just work
in memory of target process. dont tell me how to use this Tool...if you can
not use this Simple Tool plz DRAG IT TO THE RECYCLE BIN ok?
How to use :
=============
1.fill
with target Process ID
2.fill with start address of code that you want to fix it.
if you fill it with ZERO, UIF will fill it automatically.
3.fill with End address of code that you want to fix it.
if you fill it with ZERO, UIF will fill it automatically.
4.fill with address of Empty or unused area
(in Code section or Data section or any...) that IAT will repair to it.
if you fill it with ZERO, UIF will fill it automatically.
so you can fill , with a Dll address area, UIF will
detect it automatically.
for Fast Speed:
===============
-After Click on you can Minimize UIF to the taskbar.
-Just enter Code section start and end.
-Dont check "Fix Directly Imports" if you dont need to it.
News in Final version (2008.02.23):
====================================
+Algorithm improved for better fixing Directly imports.
+Show modules count and progress in StatusBar.
-GUI bug fixed on large fonts >=120 dpi.
News in Final version (2008.01.15):
====================================
-Some small bugs fixed.
+Algorithm improved for very big IAT size.
+Auto fill improved for detecting dlls correctly.
magic_h2001@yahoo.com
http://magic.shabgard.org
