Exetools

Exetools (https://forum.exetools.com/index.php)
-   General Discussion (https://forum.exetools.com/forumdisplay.php?f=2)
-   -   vm protect dispatcher looks like this? (https://forum.exetools.com/showthread.php?t=19198)

0xall0c 04-17-2019 20:44

vm protect dispatcher looks like this?
 
i was trying to unpack a malware packed with vmprotect, by writing a script i was able to generate a cfg and found 2 lines instruction

Code:

push edi
ret

which is like jumping to a thousand locations

although i think it should be the dispatcher, but i was generating cfg for just first 500000 instructions, so does vm protect virtualizes its own code also? and it is the dispatcher? or it is just a cfg obfuscation implementation?

if any one wants i can post the image of the cfg, but its too large!!

0xall0c 04-18-2019 22:43

1 Attachment(s)
sorry to reply on my own thread! but i dont know how to edit th thread!

added a zoomed out picture if anyone wants to look at the cfg generated!

this is of the first 1 million instructions executed!

Sound 04-19-2019 00:38

picture is too big to see not clearly.

VMP 1.x 2.x virtual machine structure is a typical instruction fetch, decode opcode, process according to opcode dispatch, the entire virtual machine is a large loop structure, the handler table is up to 0xFF size, all x86 instructions are by this 0xFF ( Due to the repetition, there will actually be less) a handler simulation is completed.
The most executed jmp dword ptr ds: [eax*4+0x123456] and mov ecx, dword ptr ds: [eax*4+0x123456] are typical dispatch instructions.

The part of the vmp3.x loop is very small. Some procedures for fetching instructions and dispatch are independent. And the handler itself is not reused. This means that two identical instructions will generate different handler codes, even though they implement the same functionality.

0xall0c 04-19-2019 01:57

hmm its vmprotect 3, i can attach html version of the graph? wanna look if my cfg generated is correct? and although i am trying to deobfuscate the code now, is there any other approach i can use?


All times are GMT +8. The time now is 09:01.

Powered by vBulletin® Version 3.8.8
Copyright ©2000 - 2020, vBulletin Solutions, Inc.
Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX