Deathway, it's superb, but has a problem.
on two samples, OllyDbg was crashed for decoding second vm reference. I mean it only unvirtualize one region at each run of OllyDbg (OllyIce).
For WL, the main problem is finding the first instruction. What's your idea about code in attachment?
I tested several possible address, but there was no success!
__________________
In memory of UnREal RCE...
|