Exetools  

Go Back   Exetools > General > Community Tools

Notices

Reply
 
Thread Tools Display Modes
  #106  
Old 07-25-2011, 16:49
orchid88
 
Posts: n/a
Dear Vam,
I used the beta12,the iat of my application recovered successfully.But none of the Ponsponed can be decoded,such as 0x00411dfe.
When I tried to decode 0x0040DE5F where was labeled False code VM entry point,there came an error,
"Extra input after operand in push dword ptr ds:[0x0043905c]+0x7ddb8235+0x48899ea0".

PS:I can send you my application,which the oep is 0x0041E7EB at your wish.
Reply With Quote
  #107  
Old 08-03-2011, 17:51
JeRRy's Avatar
JeRRy JeRRy is offline
VIP
 
Join Date: Oct 2010
Posts: 119
Rept. Given: 89
Rept. Rcvd 204 Times in 72 Posts
Thanks Given: 13
Thanks Rcvd at 22 Times in 10 Posts
JeRRy Reputation: 200-299 JeRRy Reputation: 200-299 JeRRy Reputation: 200-299
VMSweeper v1.4 beta 13

Quote:
Fixed:
1. Overflow the text buffer in the formation of long expressions, which led to the exclusion of the stage of code analysis.
Attached Files
File Type: rar VMSweeper14beta13.rar (374.7 KB, 88 views)
Reply With Quote
The Following 3 Users Gave Reputation+1 to JeRRy For This Useful Post:
beBoss (08-04-2011), chessgod101 (08-03-2011), wer (08-30-2011)
  #108  
Old 10-28-2011, 06:02
arnix arnix is offline
Friend
 
Join Date: Feb 2005
Posts: 68
Rept. Given: 11
Rept. Rcvd 18 Times in 7 Posts
Thanks Given: 2
Thanks Rcvd at 6 Times in 4 Posts
arnix Reputation: 18
New version VMSweeper v1.4 beta 14

Quote:
Added:
1. CodeVirtualizer: Removing of initialized, but unused register RVM_TMP.
2. CodeVirtualizer: Correction of the top of the VM stack on its extension
3. CodeVirtualizer: Correction of the bottom of the VM stack on entering into the intermediate session of the VM.
4. CodeVirtualizer: Output into trc file the entry address of the next VM session.
5. Processing the neg operation in the constant expressions
6. Handling overflow exceptions when emulating div and idiv.
7. Improved the procedure of determinating the number of arguments in the called functions because OllyDbg sometimes makes errors doing that.
8. Simultaneous handling of constant expressions placed in the pair of registers xL - xH.
9. Minimization of the size of the generated code by removing the unnecessary ds: prefix.
10. VmProtect: Improved the p-code encoding algorithm (in the VM loop) analyzer.
11. VmProtect: Handler for FPU operation fsubr.
12. Removed the "Stop on EntryCall" window in manual mode.

Fixed:
1. Conditional jump from the VM primitive to the beginning of the VM loop is not the end of the primitive.
2. Analyze the OF flag on the extended byte-variables.
Attached Files
File Type: rar VMSweeper14beta14.rar (372.0 KB, 42 views)
Reply With Quote
The Following 5 Users Gave Reputation+1 to arnix For This Useful Post:
besoeso (10-29-2011), chessgod101 (11-02-2011), JeRRy (10-28-2011), LCF-AT (10-29-2011)
  #109  
Old 11-03-2011, 21:53
BoRoV's Avatar
BoRoV BoRoV is offline
Lo*eXeTools*rd
 
Join Date: Aug 2009
Posts: 56
Rept. Given: 3
Rept. Rcvd 91 Times in 24 Posts
Thanks Given: 0
Thanks Rcvd at 0 Times in 0 Posts
BoRoV Reputation: 91
03.11.2011 VMSweeper 1.4 beta 15
Posted:
1. CodeVirtualizer: Improved detection of primitive CMC.
2. CodeVirtualizer: Added handling setne.
3. CodeVirtualizer: Improved detection of upper byte registers (ah, ch, dh, bh).
4. VmProtect: Implemented processing bias VM code (relocation VM code).
5. VmProtect: Handlers FPU instructions fst, fisub.
Fixed:
1. CodeVirtualizer: Inserting a direct asm instruction in the source code.
2. VmProtect: Moving operator changes the flags to show their flag.
3. VmProtect: Restoration of imports, sometimes instead call [api] restored jmp [api].
Attached Files
File Type: rar VMSweeper14beta15.rar (372.6 KB, 364 views)
Reply With Quote
The Following 3 Users Gave Reputation+1 to BoRoV For This Useful Post:
chessgod101 (11-05-2011), kOuD3LkA (11-05-2011)
  #110  
Old 11-05-2011, 12:55
estelle estelle is offline
Friend
 
Join Date: Feb 2009
Posts: 42
Rept. Given: 4
Rept. Rcvd 19 Times in 3 Posts
Thanks Given: 2
Thanks Rcvd at 11 Times in 9 Posts
estelle Reputation: 19
very nice tools
Reply With Quote
  #111  
Old 11-06-2011, 23:45
 
Posts: n/a
Thank you for this tool, guys!
Reply With Quote
  #112  
Old 11-12-2011, 00:35
cnbragon cnbragon is offline
Friend
 
Join Date: Nov 2010
Posts: 26
Rept. Given: 1
Rept. Rcvd 1 Time in 1 Post
Thanks Given: 3
Thanks Rcvd at 1 Time in 1 Post
cnbragon Reputation: 1
For VMSweeper 1.4 beta 15, it still can't process some CodeVirtulizer VM.
Such as the vmcode in EmEditor.
Reply With Quote
  #113  
Old 11-12-2011, 02:33
sendersu sendersu is offline
VIP
 
Join Date: Oct 2010
Posts: 839
Rept. Given: 324
Rept. Rcvd 216 Times in 110 Posts
Thanks Given: 168
Thanks Rcvd at 349 Times in 196 Posts
sendersu Reputation: 200-299 sendersu Reputation: 200-299 sendersu Reputation: 200-299
cnbragon
from what time EmEditor (by Emurasoft?) uses vm?
Reply With Quote
  #114  
Old 11-12-2011, 18:11
cnbragon cnbragon is offline
Friend
 
Join Date: Nov 2010
Posts: 26
Rept. Given: 1
Rept. Rcvd 1 Time in 1 Post
Thanks Given: 3
Thanks Rcvd at 1 Time in 1 Post
cnbragon Reputation: 1
Quote:
Originally Posted by sendersu View Post
cnbragon
from what time EmEditor (by Emurasoft?) uses vm?
About one year ago, from v10
Reply With Quote
The Following User Gave Reputation+1 to cnbragon For This Useful Post:
sendersu (11-13-2011)
  #115  
Old 11-18-2011, 19:00
phongvucba
 
Posts: n/a
I can't donwload file Attached... Please upload from Mediafire for everybody..
Thank much
Reply With Quote
  #116  
Old 11-20-2011, 00:35
niculaita's Avatar
niculaita niculaita is offline
Family
 
Join Date: Jun 2011
Location: here
Posts: 1,141
Rept. Given: 861
Rept. Rcvd 85 Times in 57 Posts
Thanks Given: 2,713
Thanks Rcvd at 428 Times in 306 Posts
niculaita Reputation: 85
I try to aply to this http://forum.exetools.com/showthread.php?t=13884 could anybody do more?
Reply With Quote
  #117  
Old 01-02-2012, 03:44
niculaita's Avatar
niculaita niculaita is offline
Family
 
Join Date: Jun 2011
Location: here
Posts: 1,141
Rept. Given: 861
Rept. Rcvd 85 Times in 57 Posts
Thanks Given: 2,713
Thanks Rcvd at 428 Times in 306 Posts
niculaita Reputation: 85
please make a tutorial applying VMSweeper
Reply With Quote
  #118  
Old 01-05-2012, 03:18
Vam Vam is offline
Friend
 
Join Date: Feb 2011
Location: Russia
Posts: 15
Rept. Given: 0
Rept. Rcvd 6 Times in 4 Posts
Thanks Given: 0
Thanks Rcvd at 0 Times in 0 Posts
Vam Reputation: 6
Read a WMSwweeper.chm or look a video in the beginning of this topic
Reply With Quote
The Following User Gave Reputation+1 to Vam For This Useful Post:
niculaita (01-16-2012)
  #119  
Old 04-12-2012, 22:08
FoxB FoxB is online now
VIP
 
Join Date: Jan 2002
Location: Earth...
Posts: 719
Rept. Given: 13
Rept. Rcvd 104 Times in 70 Posts
Thanks Given: 8
Thanks Rcvd at 432 Times in 185 Posts
FoxB Reputation: 100-199 FoxB Reputation: 100-199
New: VMSweeper v1.5 beta 0
http://rghost.ru/37543927
Reply With Quote
The Following 2 Users Gave Reputation+1 to FoxB For This Useful Post:
chessgod101 (04-13-2012), JeRRy (04-13-2012)
  #120  
Old 04-13-2012, 02:13
JeRRy's Avatar
JeRRy JeRRy is offline
VIP
 
Join Date: Oct 2010
Posts: 119
Rept. Given: 89
Rept. Rcvd 204 Times in 72 Posts
Thanks Given: 13
Thanks Rcvd at 22 Times in 10 Posts
JeRRy Reputation: 200-299 JeRRy Reputation: 200-299 JeRRy Reputation: 200-299
VMSweeper 1.5 Beta 0 (12.04.2012)
Quote:
Added:
1. Process handler of the primitive simple function call without arguments and return values.
2. Recognition of primitive Push/Pop RvmLong p-code with indexation.
3. Handling of multiple VMs on a single function and a batch as well as separate call of the function ("Decompilate packet" option in the ini file).
It is recommended to disable it, but if there are difficulties finding entry points in the batch function, then you should enable it.
4. Decompiling the code in the areas of change registers ("Decompilate change register zones" option in the ini file). When enabled this option creates an additional "junk" in the log file. Its recommend to enable this option only if the generated code without this option has missing instructions.
5. Many small cosmetic changes.

Fixed:
1. Restructuring of a code.
2. Determining the size of the arguments of called functions.
Download:
http://www.mediafire.com/?6a6vrjya141cqyg
Attached Files
File Type: rar VMSweeper15beta0.rar (380.0 KB, 101 views)
__________________
SnD
Reply With Quote
The Following 2 Users Gave Reputation+1 to JeRRy For This Useful Post:
chessgod101 (04-13-2012), korosh (04-13-2012)
Reply

Tags
codevirualizer, decompiler, vmprotect, vmsweeper

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Is there linux vm tool like vmprotect? swlepus General Discussion 4 12-23-2011 10:07


All times are GMT +8. The time now is 15:01.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX
( 1998 - 2020 )