View Single Post
  #98  
Old 05-17-2011, 19:03
V0ldemAr
 
Posts: n/a
beta 11

http://rghost.net/6720721

Added:
1) Handlers of FPU instructions fclex, fldcw, fstcw, fldz, fld1, fistp
2) Window with code segments input and VM has 3 buttons now:
- Analyze - Start analysis of VM entries and import restoration.
- Accept - Apply entered values of segments without analysis
- Cancel - Exit without saving any changes

3) Display API names in p-code maps, relocations and function callings
4) Devirtualization of add esp, xx instruction
5) Improved restoration of partially wiped IAT
6) Import recovery such as: push reg; call vm -> call [api].
7) push/pop reg; call vm -> mov reg,[api].
8) Improved recognition of VM entries
9) Improved detection of VM loop

Fixed:
1) Code conversion: pop xx; jmp xx into retn.
2) Restructure of intermediate code. Blocks intersections.
3) Installed several exceptions during code devirtualization.
4) Removal of anti-dump code.

Translated from Russian

§¥§à§Ò§Ñ§Ó§Ý§Ö§ß§à:
1. §°§Ò§â§Ñ§Ò§à§ä§é§Ú§Ü§Ú FPU §Ú§ß§ã§ä§â§å§Ü§è§Ú§Û: fclex, fldcw, fstcw, fldz, fld1, fistp.
2. §°§Ü§ß§à §Ó§Ó§à§Õ§Ñ §Ù§ß§Ñ§é§Ö§ß§Ú§Û §ã§Ö§Ô§Þ§Ö§ß§ä§à§Ó §Ü§à§Õ§Ñ §Ú §£§® §ä§Ö§á§Ö§â§î §Ú§Þ§Ö§Ö§ä §ä§â§Ú §Ü§ß§à§á§Ü§Ú:
- Analyze - §ß§Ñ§é§Ñ§ä§î §Ñ§ß§Ñ§Ý§Ú§Ù §ä§à§é§Ö§Ü §Ó§ç§à§Õ§Ñ §Ó §£§® §Ú §Ó§à§ã§ã§ä§Ñ§ß§à§Ó§Ý§Ö§ß§Ú§Ö §Ú§Þ§á§à§â§ä§Ñ.
- Accept - §á§â§Ú§ß§ñ§ä§î §Ó§Ó§Ö§Õ§Ö§ß§ß§í§Ö §Ù§ß§Ñ§é§Ö§ß§Ú§ñ §ã§Ö§Ô§Þ§Ö§ß§ä§à§Ó §Ò§Ö§Ù §Ó§í§á§à§Ý§ß§Ö§ß§Ú§ñ §Ñ§ß§Ñ§Ý§Ú§Ù§Ñ.
- Cancel - §Ó§í§Û§ä§Ú §ß§Ö §á§â§à§Ú§Ù§Ó§à§Õ§ñ §ß§Ú§Ü§Ñ§Ü§Ú§ç §Ú§Ù§Þ§Ö§ß§Ö§ß§Ú§Û.
3. §£§í§Ó§à§Õ §Ú§Þ§Ö§ß API §æ§å§ß§Ü§è§Ú§Û §Ó §Ü§Ñ§â§ä§Ñ§ç §á§Ú§Ü§à§Õ§Ñ, §â§Ö§Ý§à§Ü§à§Ó §Ú §Ó§í§Ù§à§Ó§à§Ó §æ§å§ß§Ü§è§Ú§Û.
4. §¥§Ö§Ó§Ú§â§ä§å§Ñ§Ý§Ú§Ù§Ñ§è§Ú§ñ §Ú§ß§ã§ä§â§å§Ü§è§Ú§Ú add esp, xx
5. §µ§Ý§å§é§ê§Ö§ß§à §Ó§à§ã§ã§ä§Ñ§ß§à§Ó§Ý§Ö§ß§Ú§Ö §é§Ñ§ã§ä§Ú§é§ß§à §Ù§Ñ§ä§Ö§â§ä§à§Û IAT.
6. §£§à§ã§ã§ä§Ñ§ß§à§Ó§Ý§Ö§ß§Ú§Ö §Ú§Þ§á§à§â§ä§Ñ §ä§Ú§á§Ñ: push reg; call vm -> call [api].
7. §£§à§ã§ã§ä§Ñ§ß§à§Ó§Ý§Ö§ß§Ú§Ö §Ú§Þ§á§à§â§ä§Ñ §ä§Ú§á§Ñ: push/pop reg; call vm -> mov reg,[api].
8. §µ§Ý§å§é§ê§Ö§ß§à §â§Ñ§ã§á§à§Ù§ß§Ñ§Ó§Ñ§ß§Ú§Ö §ä§à§é§Ö§Ü §Ó§ç§à§Õ§Ñ §Ó §£§®.
9. §µ§Ý§å§é§ê§Ö§ß§à §â§Ñ§ã§á§à§Ù§ß§Ñ§Ó§Ñ§ß§Ú§Ö §è§Ú§Ü§Ý§Ñ §£§®.
§ª§ã§á§â§Ñ§Ó§Ý§Ö§ß§à:
1. §±§â§Ö§à§Ò§â§Ñ§Ù§à§Ó§Ñ§ß§Ú§Ö §Ü§à§Õ§Ñ pop xx; jmp xx §Ó retn.
2. §²§Ö§ã§ä§â§å§Ü§ä§å§â§Ú§Ù§Ñ§è§Ú§ñ §á§â§à§Þ§Ü§à§Õ§Ñ. §±§Ö§â§Ö§ã§Ö§é§Ö§ß§Ú§ñ §Ò§Ý§à§Ü§à§Ó.
3. §µ§ã§ä§â§Ñ§ß§Ö§ß§à §ß§Ö§ã§Ü§à§Ý§î§Ü§à §Ú§ã§Ü§Ý§ð§é§Ö§ß§Ú§Û §á§â§Ú §Õ§Ö§Ó§Ú§â§ä§å§Ñ§Ý§Ú§Ù§Ñ§è§Ú§Ú §Ü§à§Õ§Ñ.
4. §µ§Õ§Ñ§Ý§Ö§ß§Ú§Ö §Ü§à§Õ§Ñ §Ñ§ß§ä§Ú§Õ§Ñ§Þ§á§Ñ.

PS: Vam correct me if I translated it incorrectly and you meant something else

Last edited by V0ldemAr; 05-17-2011 at 19:08.
Reply With Quote
The Following 2 Users Gave Reputation+1 to For This Useful Post:
greengo (05-18-2011), JeRRy (05-17-2011)