|
picture is too big to see not clearly.
VMP 1.x 2.x virtual machine structure is a typical instruction fetch, decode opcode, process according to opcode dispatch, the entire virtual machine is a large loop structure, the handler table is up to 0xFF size, all x86 instructions are by this 0xFF ( Due to the repetition, there will actually be less) a handler simulation is completed.
The most executed jmp dword ptr ds: [eax*4+0x123456] and mov ecx, dword ptr ds: [eax*4+0x123456] are typical dispatch instructions.
The part of the vmp3.x loop is very small. Some procedures for fetching instructions and dispatch are independent. And the handler itself is not reused. This means that two identical instructions will generate different handler codes, even though they implement the same functionality.
|