vm protect dispatcher looks like this?
 

i was trying to unpack a malware packed with vmprotect, by writing a script i was able to generate a cfg and found 2 lines instruction

which is like jumping to a thousand locations

although i think it should be the dispatcher, but i was generating cfg for just first 500000 instructions, so does vm protect virtualizes its own code also? and it is the dispatcher? or it is just a cfg obfuscation implementation?

if any one wants i can post the image of the cfg, but its too large!!

sorry to reply on my own thread! but i dont know how to edit th thread!

added a zoomed out picture if anyone wants to look at the cfg generated!

this is of the first 1 million instructions executed!

picture is too big to see not clearly.

VMP 1.x 2.x virtual machine structure is a typical instruction fetch, decode opcode, process according to opcode dispatch, the entire virtual machine is a large loop structure, the handler table is up to 0xFF size, all x86 instructions are by this 0xFF ( Due to the repetition, there will actually be less) a handler simulation is completed.
The most executed jmp dword ptr ds: [eax*4+0x123456] and mov ecx, dword ptr ds: [eax*4+0x123456] are typical dispatch instructions.

The part of the vmp3.x loop is very small. Some procedures for fetching instructions and dispatch are independent. And the handler itself is not reused. This means that two identical instructions will generate different handler codes, even though they implement the same functionality.

hmm its vmprotect 3, i can attach html version of the graph? wanna look if my cfg generated is correct? and although i am trying to deobfuscate the code now, is there any other approach i can use?