Exetools  

Go Back   Exetools > General > General Discussion

Notices

Reply
 
Thread Tools Display Modes
  #1  
Old 04-17-2019, 20:44
0xall0c 0xall0c is offline
Friend
 
Join Date: Mar 2018
Posts: 29
Rept. Given: 0
Rept. Rcvd 2 Times in 2 Posts
Thanks Given: 22
Thanks Rcvd at 35 Times in 23 Posts
0xall0c Reputation: 2
vm protect dispatcher looks like this?

i was trying to unpack a malware packed with vmprotect, by writing a script i was able to generate a cfg and found 2 lines instruction

Code:
push edi
ret
which is like jumping to a thousand locations

although i think it should be the dispatcher, but i was generating cfg for just first 500000 instructions, so does vm protect virtualizes its own code also? and it is the dispatcher? or it is just a cfg obfuscation implementation?

if any one wants i can post the image of the cfg, but its too large!!
Reply With Quote
The Following User Says Thank You to 0xall0c For This Useful Post:
Indigo (07-19-2019)
  #2  
Old 04-18-2019, 22:43
0xall0c 0xall0c is offline
Friend
 
Join Date: Mar 2018
Posts: 29
Rept. Given: 0
Rept. Rcvd 2 Times in 2 Posts
Thanks Given: 22
Thanks Rcvd at 35 Times in 23 Posts
0xall0c Reputation: 2
sorry to reply on my own thread! but i dont know how to edit th thread!

added a zoomed out picture if anyone wants to look at the cfg generated!

this is of the first 1 million instructions executed!
Attached Images
File Type: png million.png (418.1 KB, 14 views)
Reply With Quote
The Following User Says Thank You to 0xall0c For This Useful Post:
Indigo (07-19-2019)
  #3  
Old 04-19-2019, 00:38
Sound Sound is offline
Family
 
Join Date: Apr 2016
Location: TaiWan
Posts: 102
Rept. Given: 5
Rept. Rcvd 48 Times in 20 Posts
Thanks Given: 36
Thanks Rcvd at 371 Times in 91 Posts
Sound Reputation: 48
picture is too big to see not clearly.

VMP 1.x 2.x virtual machine structure is a typical instruction fetch, decode opcode, process according to opcode dispatch, the entire virtual machine is a large loop structure, the handler table is up to 0xFF size, all x86 instructions are by this 0xFF ( Due to the repetition, there will actually be less) a handler simulation is completed.
The most executed jmp dword ptr ds: [eax*4+0x123456] and mov ecx, dword ptr ds: [eax*4+0x123456] are typical dispatch instructions.

The part of the vmp3.x loop is very small. Some procedures for fetching instructions and dispatch are independent. And the handler itself is not reused. This means that two identical instructions will generate different handler codes, even though they implement the same functionality.
Reply With Quote
The Following 2 Users Gave Reputation+1 to Sound For This Useful Post:
niculaita (04-19-2019), sh3dow (06-07-2019)
The Following 3 Users Say Thank You to Sound For This Useful Post:
Indigo (07-19-2019), niculaita (04-19-2019), sh3dow (06-07-2019)
  #4  
Old 04-19-2019, 01:57
0xall0c 0xall0c is offline
Friend
 
Join Date: Mar 2018
Posts: 29
Rept. Given: 0
Rept. Rcvd 2 Times in 2 Posts
Thanks Given: 22
Thanks Rcvd at 35 Times in 23 Posts
0xall0c Reputation: 2
hmm its vmprotect 3, i can attach html version of the graph? wanna look if my cfg generated is correct? and although i am trying to deobfuscate the code now, is there any other approach i can use?
Reply With Quote
The Following User Says Thank You to 0xall0c For This Useful Post:
Indigo (07-19-2019)
Reply

Tags
debugging, vmprotect

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Visual Protect Spotted Horse General Discussion 10 09-17-2004 14:58


All times are GMT +8. The time now is 11:14.


��ICP��05004977��
Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX