Fix using wrong dumper for YZPack

Masrepus · Masrepus · commit f3d2e9c05a1c · 2019-10-03T15:21:56.000+02:00
diff --git a/unipacker/imagedump.py b/unipacker/imagedump.py
@@ -510,6 +510,13 @@ def fix_imports(self, uc, hdr, virtualmemorysize, total_size, dllname_to_functio
         return super().fix_imports_by_rebuilding(uc, hdr, virtualmemorysize, total_size, dllname_to_functionlist)
 
 
+# YZPackDump can use fix_imports_by_rebuilding as well
+class YZPackDump(ImageDump):
+    def fix_imports(self, uc, hdr, virtualmemorysize, total_size, dllname_to_functionlist, original_imp):
+        return super().fix_imports_by_dllname(uc, hdr, total_size, dllname_to_functionlist)
+        # return super().fix_imports_by_rebuilding(uc, hdr, virtualmemorysize, total_size, dllname_to_functionlist)
+
+
 class PEtiteDump(ImportRebuilderDump):
     def fix_section_mem_protections(self, hdr, ntp):
         for s in ntp.keys():
diff --git a/unipacker/unpackers.py b/unipacker/unpackers.py
@@ -4,7 +4,7 @@
 import yara
 
 import unipacker
-from unipacker.imagedump import ImageDump, ImportRebuilderDump, PEtiteDump, MEWDump
+from unipacker.imagedump import ImageDump, ImportRebuilderDump, PEtiteDump, MEWDump, YZPackDump
 from unipacker.utils import InvalidPEFile
 
 
@@ -172,7 +172,7 @@ def __init__(self, sample):
         self.name = "YZPack"
         self.allowed_sections = ['.yzpack', '.yzpack2']
         self.allowed_addr_ranges = self.get_allowed_addr_ranges()
-        self.dumper = ImportRebuilderDump()
+        self.dumper = YZPackDump()
 
 
 class MEWUnpacker(AutomaticDefaultUnpacker):
