View Single Post
  #34  
Old 01-31-2014, 10:11
Deathway's Avatar
Deathway Deathway is offline
Lo*eXeTools*rd
 
Join Date: Jan 2009
Posts: 41
Rept. Given: 8
Rept. Rcvd 155 Times in 24 Posts
Thanks Given: 1
Thanks Rcvd at 18 Times in 14 Posts
Deathway Reputation: 100-199 Deathway Reputation: 100-199
[v1.7]
- FISH machine avaible (WHITE and RED variants)
- Added Vm signatures

Hi all, the new version of this plug-in supports the FISH virtual machine, WHITE and RED variants.

Some words about this machine...

It mixes both CISC and RISC architecture, but the code isn't like template anymore, every virtual machine has a new different number of handlers, and every handler contains a different execution path, a little tricky, but nothing that can't be 'devirtualized' , maybe i'll write a paper about FISH and TIGER machines later.

Some specs that aren't coded yet:
- Support for Check macro;
- Sort algo is very unstable
- This plugin may crash when deofuscating very rare sequences, (most of them are 'expected' specially when crash was due to an ud2 instruction).
- Suppor for BLACK variants

... About TIGER, I have no plans for the moment, but it isn't very different from FISH analog.
Plug-in was tested with 2.2.6.0 version, other versions may have variants that this plug-in couldn't handle.


Deathway.
Attached Files
File Type: rar Oreans UnVirtualizer 1.7.rar (358.7 KB, 118 views)
Reply With Quote
The Following 20 Users Gave Reputation+1 to Deathway For This Useful Post:
ahmadmansoor (02-01-2014), alekine322 (02-01-2014), Av0id (02-04-2014), b30wulf (01-31-2014), besoeso (02-01-2014), canopus (02-01-2014), Conquest (01-31-2014), copyleft (02-01-2014), deepzero (01-31-2014), Ember (02-01-2014), giv (01-31-2014), Insid3Code (02-02-2014), kjms (02-01-2014), Kla$ (01-31-2014), nikkapedd (02-03-2014), pertican (02-01-2014), softgate (01-31-2014), tonyweb (02-01-2014), ZeNiX (02-01-2014), Zipdecode (01-31-2014)
The Following User Says Thank You to Deathway For This Useful Post:
Indigo (07-19-2019)