|
Definitely, the RISC VM is awesome. Well coded and most awesome, you can see the work that has gone into it. And a lot harder than anything VMP has.
But mostly actually the good stuff in VMprotect is stolen from other protections. It's heap antidump comes from Winlicense and it's CPUID comes from securom. Also it's obfuscation is retarded. It's VM is pretty OK though, they do a good job confusing you at first. And the fact it's VM exits have the same signature as their main handler is nice.
It's not bad and with the info around perhaps harder than WL, but imho it's a lot worse.
|