Exetools  

Go Back   Exetools > General > Community Tools

Notices

Reply
 
Thread Tools Display Modes
  #121  
Old 04-30-2012, 16:29
Raham Raham is offline
Family
 
Join Date: Dec 2010
Posts: 24
Rept. Given: 7
Rept. Rcvd 45 Times in 15 Posts
Thanks Given: 0
Thanks Rcvd at 1 Time in 1 Post
Raham Reputation: 45
@Vam
Current Version is better than old... better detection of Handler.

But a 2big problem is still here.
1.VMProtect is stack based VM, so all stuff are pushed on stack for process.
even without add junk code,its obfuscated. why?
because:
push dword ptr [reg_C]
push 0041077C
pop eax
pop edx
mov dword ptr ds:[eax], edx ;00000005
is :
MOV DWORD PTR DS:[41077C],ECX

so its hard for to understand in Long analyse.
its better to use atleast pattern matching for deobfuscating this routine.
for example : handler : 0x50,0x60,0x40,0x70,0x80 if run together it will for example
equal to MOV R32,R32

if you do it, it will be very good.


Kind Regards.
Also im w8 for your new version

Last edited by Raham; 04-30-2012 at 16:38.
Reply With Quote
The Following 2 Users Gave Reputation+1 to Raham For This Useful Post:
demon_da (05-01-2012), pertican (05-02-2012)
  #122  
Old 05-05-2012, 14:43
Vam Vam is offline
Friend
 
Join Date: Feb 2011
Location: Russia
Posts: 15
Rept. Given: 0
Rept. Rcvd 6 Times in 4 Posts
Thanks Given: 0
Thanks Rcvd at 0 Times in 0 Posts
Vam Reputation: 6
Quote:
Originally Posted by Raham View Post
@Vam
its better to use atleast pattern matching for deobfuscating this routine.
for example : handler : 0x50,0x60,0x40,0x70,0x80 if run together it will for example
equal to MOV R32,R32
In principle, the intermediate code, about which you speak, explore the user does not need, it makes the intermediate code decompiler. Notice more attention to the analysis already decompiled code (log file) - with the right understanding of it is possible to manually restore source code of virtualization function nearly 100% of cases.
Reply With Quote
  #123  
Old 05-09-2012, 16:56
benney benney is offline
Friend
 
Join Date: Nov 2009
Posts: 41
Rept. Given: 19
Rept. Rcvd 11 Times in 7 Posts
Thanks Given: 1
Thanks Rcvd at 4 Times in 4 Posts
benney Reputation: 11
this really a great tool, it helps a lot.thanks
Reply With Quote
  #124  
Old 05-17-2012, 22:22
Raham Raham is offline
Family
 
Join Date: Dec 2010
Posts: 24
Rept. Given: 7
Rept. Rcvd 45 Times in 15 Posts
Thanks Given: 0
Thanks Rcvd at 1 Time in 1 Post
Raham Reputation: 45
Error Report

Hi Vam



let see this CrackMe.
i VMed it with minimum option.
your plugin will crash during analyze of it.




Kind Regards.
Attached Files
File Type: zip Bad1.zip (48.9 KB, 13 views)
Reply With Quote
  #125  
Old 07-13-2012, 03:20
Raham Raham is offline
Family
 
Join Date: Dec 2010
Posts: 24
Rept. Given: 7
Rept. Rcvd 45 Times in 15 Posts
Thanks Given: 0
Thanks Rcvd at 1 Time in 1 Post
Raham Reputation: 45
@Vam

with Stolen Resource feature, sometimes vmpr will find the call FindResource in the code section ,and instead of just protecting import, it will redirect it to internal FindResource.
so not FindResource api will called. in this situation your VMSweeper will crash.
Please Fix It


Thanks
Reply With Quote
The Following User Gave Reputation+1 to Raham For This Useful Post:
demon_da (07-13-2012)
  #126  
Old 07-22-2012, 06:39
DMichael's Avatar
DMichael DMichael is offline
Family
 
Join Date: Apr 2012
Location: Israel
Posts: 199
Rept. Given: 139
Rept. Rcvd 281 Times in 72 Posts
Thanks Given: 13
Thanks Rcvd at 30 Times in 24 Posts
DMichael Reputation: 200-299 DMichael Reputation: 200-299 DMichael Reputation: 200-299
i have queastion what the diffrence in the virutalizer that made deathway and that one?o_O
Reply With Quote
  #127  
Old 08-18-2012, 02:04
felixcatx
 
Posts: n/a
This tool can unpack Xenocode protection?
Reply With Quote
  #128  
Old 08-18-2012, 09:54
chessgod101's Avatar
chessgod101 chessgod101 is online now
Co-Administrator
 
Join Date: Jan 2011
Location: United States
Posts: 490
Rept. Given: 2,093
Rept. Rcvd 666 Times in 207 Posts
Thanks Given: 473
Thanks Rcvd at 656 Times in 136 Posts
chessgod101 Reputation: 500-699 chessgod101 Reputation: 500-699 chessgod101 Reputation: 500-699 chessgod101 Reputation: 500-699 chessgod101 Reputation: 500-699 chessgod101 Reputation: 500-699
Quote:
Originally Posted by felixcatx View Post
This tool can unpack Xenocode protection?
No, this tool is designed to aide in the unpacking of VMProtect and CodeVirtualizer, as the title indicates.
__________________
"Real knowledge is to know the extent of one's ignorance." Confucius
Reply With Quote
The Following User Gave Reputation+1 to chessgod101 For This Useful Post:
  #129  
Old 09-12-2012, 09:16
Beyond2000! Beyond2000! is offline
Friend
 
Join Date: Jan 2002
Posts: 47
Rept. Given: 8
Rept. Rcvd 3 Times in 2 Posts
Thanks Given: 2
Thanks Rcvd at 0 Times in 0 Posts
Beyond2000! Reputation: 3
Thank you. Very nice work. I´ll give it a try.
Reply With Quote
  #130  
Old 10-04-2012, 01:19
Jupiter's Avatar
Jupiter Jupiter is offline
Lo*eXeTools*rd
 
Join Date: Jan 2005
Location: Moscow, Russia
Posts: 178
Rept. Given: 24
Rept. Rcvd 54 Times in 31 Posts
Thanks Given: 5
Thanks Rcvd at 82 Times in 20 Posts
Jupiter Reputation: 54
Lightbulb

VMSweeper 1.5 beta 2

What's new:

2012-09-20

[i] VmProtect:
[+] "Empty" VM exit handler
[+] Switch-cases decompilation
[+] Handling of non-virtualized instruction "sbb"

(Attached)
Attached Files
File Type: rar VMSweeper15beta2.rar (379.8 KB, 284 views)
__________________
EnJoy!
Reply With Quote
The Following 7 Users Gave Reputation+1 to Jupiter For This Useful Post:
besoeso (10-05-2012), chessgod101 (10-04-2012), giv (10-05-2012), JeRRy (10-04-2012), Raham (10-04-2012), val2032 (10-16-2012), WildGoblin (10-21-2012)
  #131  
Old 10-04-2012, 16:53
mcp mcp is offline
Friend
 
Join Date: Dec 2011
Posts: 73
Rept. Given: 4
Rept. Rcvd 12 Times in 11 Posts
Thanks Given: 7
Thanks Rcvd at 47 Times in 35 Posts
mcp Reputation: 12
DeCV Decompiler

An open source code virtualizer decompiler is available here. Haven't tried it yet, though.
Reply With Quote
  #132  
Old 11-02-2012, 22:18
Vam Vam is offline
Friend
 
Join Date: Feb 2011
Location: Russia
Posts: 15
Rept. Given: 0
Rept. Rcvd 6 Times in 4 Posts
Thanks Given: 0
Thanks Rcvd at 0 Times in 0 Posts
Vam Reputation: 6
Article Protect&Sweeper contains basic material of protection algorithms VmProtekt and remove it WmSweeper with the addition of exclusive not been previously published material.
It will be useful to anyone dealing with the decompiler and protector.
Reply With Quote
The Following User Gave Reputation+1 to Vam For This Useful Post:
besoeso (11-02-2012)
  #133  
Old 06-03-2013, 19:58
xp200798
 
Posts: n/a
nice,i have never thought about that VMcode can be decompiled
Reply With Quote
  #134  
Old 11-17-2013, 14:25
BiMode BiMode is offline
VIP
 
Join Date: Apr 2003
Location: where...
Posts: 133
Rept. Given: 37
Rept. Rcvd 2 Times in 2 Posts
Thanks Given: 20
Thanks Rcvd at 14 Times in 10 Posts
BiMode Reputation: 2
Any chance for ollydbg v2?
Reply With Quote
  #135  
Old 12-05-2013, 19:57
progopis progopis is offline
CrackTool coder
 
Join Date: Jan 2009
Location: ru
Posts: 231
Rept. Given: 90
Rept. Rcvd 152 Times in 57 Posts
Thanks Given: 1
Thanks Rcvd at 17 Times in 13 Posts
progopis Reputation: 100-199 progopis Reputation: 100-199
BiMode
Why do you want OllyDbg v2? OllyDbg v2 has new PDK API. It's hard to rewrite such big project to new API.
Reply With Quote
The Following User Gave Reputation+1 to progopis For This Useful Post:
giv (12-05-2013)
Reply

Tags
codevirualizer, decompiler, vmprotect, vmsweeper

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Is there linux vm tool like vmprotect? swlepus General Discussion 4 12-23-2011 10:07


All times are GMT +8. The time now is 04:08.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX
( 1998 - 2020 )