OllyDBG v2.xx plugin - OllyExt

[ferrit.rce]

OK, first of all I'll make the last build stable by fixing all the issues and in the meantime let's start a new parser and I'll contribute.

[ahmadmansoor]

Originally Posted by mr.exodia

@ahmadmansoor: Somewhere these days I will start working on an open source asm parser for the XED library. I will add you to the repo when this project is started.

Greetings

big Thanks for ur offer mr.exodia .and I am waiting that .

[softgate]

By any chance you didn't notice the existence of my post at #43, I'm still wondering how to get Olly2 + Ollyext load the VMProtected executable undetected on Windows 7 x64.

Any information and/or suggestion would be very appreciated.

[ferrit.rce]

I've noticed it All in all seems like I've made some existing protections dead. Most probably that's reason why it gets detected. I'm working on the issues but it takes some time...

Originally Posted by softgate

By any chance you didn't notice the existence of my post at #43, I'm still wondering how to get Olly2 + Ollyext load the VMProtected executable undetected on Windows 7 x64.

Any information and/or suggestion would be very appreciated.

[sendersu]

Originally Posted by softgate

By any chance you didn't notice the existence of my post at #43, I'm still wondering how to get Olly2 + Ollyext load the VMProtected executable undetected on Windows 7 x64.

Any information and/or suggestion would be very appreciated.

I had similar issue
try from clean Olly ini file

[ferrit.rce]

New v1.72 is out. Changes:

12.02.2014
	- KiUserExceptionDispatcher fix
	- NtSetThreadContext fix
	- ZwContinue fix

[softgate]

Thank you for your comments.

I've tried with a clean Olly and OllyExt ini file, using v1.72, but so far no luck with it.
Since I'm not particularly in hurry, I would like to try it again with later versions.

Thanks again for your efforts you put into OllyExt.

[MistHill]

@ ferrit.rce
Nice work!

[ferrit.rce]

New v1.73 is out. Changes:

26.02.2014
	- NtClose has to return c0000008 fix

24.02.2014
	- Error message appears if breakpoint is in the function which one to hook ( hook will be skipped )
	- Protection will be updated if a new module loaded

I've tested VMP with this version and it works

[ferrit.rce]

New v1.74 is out. Changes:

13.04.2014
	- Custom caption possibility added

[ferrit.rce]

New v1.8 is out. Changes:

27.04.2014
	- Custom patch framework implemented
	- Custom patch signature ripping

24.04.2014
	- Icon change can be turned off

[sendersu]

Hi ferrit
how about processing this method of detecting?

ntdll.NtQueryInformationProcess()
I've a target that is using it.

[ferrit.rce]

This function is already hooked. Maybe it's a bug. Please send me the binary which detects it.

Originally Posted by sendersu

Hi ferrit
how about processing this method of detecting?

ntdll.NtQueryInformationProcess()
I've a target that is using it.

[tenketsu]

No problems so far, works like a charm, thanks.