Exetools  

Go Back   Exetools > General > Community Tools

Notices

Reply
 
Thread Tools Display Modes
  #31  
Old 11-14-2013, 17:17
giv's Avatar
giv giv is offline
VIP
 
Join Date: Jan 2011
Location: Romania
Posts: 1,654
Rept. Given: 801
Rept. Rcvd 1,281 Times in 559 Posts
Thanks Given: 210
Thanks Rcvd at 542 Times in 226 Posts
giv Reputation: 1100-1299 giv Reputation: 1100-1299 giv Reputation: 1100-1299 giv Reputation: 1100-1299 giv Reputation: 1100-1299 giv Reputation: 1100-1299 giv Reputation: 1100-1299 giv Reputation: 1100-1299 giv Reputation: 1100-1299
Quote:
Originally Posted by ___da-brain___ View Post
Hello,

I was wondering if you have an updated version for TIGER and FISH new VM ?
Do you think is easy to reverse a newer VM?
Reply With Quote
The Following User Says Thank You to giv For This Useful Post:
Indigo (07-19-2019)
  #32  
Old 11-15-2013, 01:56
b30wulf's Avatar
b30wulf b30wulf is offline
Family
 
Join Date: Nov 2013
Posts: 149
Rept. Given: 198
Rept. Rcvd 112 Times in 35 Posts
Thanks Given: 143
Thanks Rcvd at 141 Times in 58 Posts
b30wulf Reputation: 100-199 b30wulf Reputation: 100-199
Talking

Quote:
Originally Posted by giv View Post
Do you think is easy to reverse a newer VM?
are you serious? he calls Chuck Norris and VM revers it self
Reply With Quote
The Following User Gave Reputation+1 to b30wulf For This Useful Post:
Conquest (11-15-2013)
The Following User Says Thank You to b30wulf For This Useful Post:
Indigo (07-19-2019)
  #33  
Old 11-16-2013, 00:16
giv's Avatar
giv giv is offline
VIP
 
Join Date: Jan 2011
Location: Romania
Posts: 1,654
Rept. Given: 801
Rept. Rcvd 1,281 Times in 559 Posts
Thanks Given: 210
Thanks Rcvd at 542 Times in 226 Posts
giv Reputation: 1100-1299 giv Reputation: 1100-1299 giv Reputation: 1100-1299 giv Reputation: 1100-1299 giv Reputation: 1100-1299 giv Reputation: 1100-1299 giv Reputation: 1100-1299 giv Reputation: 1100-1299 giv Reputation: 1100-1299
lol
Many of us don't have knowledge to reverse a simple crackme.
Reply With Quote
The Following User Gave Reputation+1 to giv For This Useful Post:
b30wulf (11-16-2013)
The Following User Says Thank You to giv For This Useful Post:
Indigo (07-19-2019)
  #34  
Old 01-31-2014, 10:11
Deathway's Avatar
Deathway Deathway is offline
Lo*eXeTools*rd
 
Join Date: Jan 2009
Posts: 41
Rept. Given: 8
Rept. Rcvd 155 Times in 24 Posts
Thanks Given: 1
Thanks Rcvd at 19 Times in 14 Posts
Deathway Reputation: 100-199 Deathway Reputation: 100-199
[v1.7]
- FISH machine avaible (WHITE and RED variants)
- Added Vm signatures

Hi all, the new version of this plug-in supports the FISH virtual machine, WHITE and RED variants.

Some words about this machine...

It mixes both CISC and RISC architecture, but the code isn't like template anymore, every virtual machine has a new different number of handlers, and every handler contains a different execution path, a little tricky, but nothing that can't be 'devirtualized' , maybe i'll write a paper about FISH and TIGER machines later.

Some specs that aren't coded yet:
- Support for Check macro;
- Sort algo is very unstable
- This plugin may crash when deofuscating very rare sequences, (most of them are 'expected' specially when crash was due to an ud2 instruction).
- Suppor for BLACK variants

... About TIGER, I have no plans for the moment, but it isn't very different from FISH analog.
Plug-in was tested with 2.2.6.0 version, other versions may have variants that this plug-in couldn't handle.


Deathway.
Attached Files
File Type: rar Oreans UnVirtualizer 1.7.rar (358.7 KB, 118 views)
Reply With Quote
The Following 20 Users Gave Reputation+1 to Deathway For This Useful Post:
ahmadmansoor (02-01-2014), alekine322 (02-01-2014), Av0id (02-04-2014), b30wulf (01-31-2014), besoeso (02-01-2014), canopus (02-01-2014), Conquest (01-31-2014), copyleft (02-01-2014), deepzero (01-31-2014), Ember (02-01-2014), giv (01-31-2014), Insid3Code (02-02-2014), kjms (02-01-2014), Kla$ (01-31-2014), nikkapedd (02-03-2014), pertican (02-01-2014), softgate (01-31-2014), tonyweb (02-01-2014), ZeNiX (02-01-2014), Zipdecode (01-31-2014)
The Following User Says Thank You to Deathway For This Useful Post:
Indigo (07-19-2019)
  #35  
Old 01-31-2014, 12:31
Conquest Conquest is offline
Friend
 
Join Date: Jan 2013
Location: 0x484F4D45
Posts: 105
Rept. Given: 46
Rept. Rcvd 29 Times in 17 Posts
Thanks Given: 24
Thanks Rcvd at 41 Times in 20 Posts
Conquest Reputation: 29
Quote:
Originally Posted by Deathway View Post
[v1.7]
- FISH machine avaible (WHITE and RED variants)
- Added Vm signatures

Hi all, the new version of this plug-in supports the FISH virtual machine, WHITE and RED variants.

Some words about this machine...

It mixes both CISC and RISC architecture, but the code isn't like template anymore, every virtual machine has a new different number of handlers, and every handler contains a different execution path, a little tricky, but nothing that can't be 'devirtualized' , maybe i'll write a paper about FISH and TIGER machines later.

Some specs that aren't coded yet:
- Support for Check macro;
- Sort algo is very unstable
- This plugin may crash when deofuscating very rare sequences, (most of them are 'expected' specially when crash was due to an ud2 instruction).
- Suppor for BLACK variants

... About TIGER, I have no plans for the moment, but it isn't very different from FISH analog.
Plug-in was tested with 2.2.6.0 version, other versions may have variants that this plug-in couldn't handle.


Deathway.
LF> the paper . thanks for the great update
Reply With Quote
The Following User Says Thank You to Conquest For This Useful Post:
Indigo (07-19-2019)
  #36  
Old 01-31-2014, 16:07
giv's Avatar
giv giv is offline
VIP
 
Join Date: Jan 2011
Location: Romania
Posts: 1,654
Rept. Given: 801
Rept. Rcvd 1,281 Times in 559 Posts
Thanks Given: 210
Thanks Rcvd at 542 Times in 226 Posts
giv Reputation: 1100-1299 giv Reputation: 1100-1299 giv Reputation: 1100-1299 giv Reputation: 1100-1299 giv Reputation: 1100-1299 giv Reputation: 1100-1299 giv Reputation: 1100-1299 giv Reputation: 1100-1299 giv Reputation: 1100-1299
Is amaizing how fast you do the update.
It seems that you have a very good knownledge of the VM's.
Bravo and thank you!
Reply With Quote
The Following User Says Thank You to giv For This Useful Post:
Indigo (07-19-2019)
  #37  
Old 01-31-2014, 21:43
benney benney is offline
Friend
 
Join Date: Nov 2009
Posts: 41
Rept. Given: 19
Rept. Rcvd 11 Times in 7 Posts
Thanks Given: 1
Thanks Rcvd at 4 Times in 4 Posts
benney Reputation: 11
thank you for the update, nice work Deathway!
Reply With Quote
The Following User Says Thank You to benney For This Useful Post:
Indigo (07-19-2019)
  #38  
Old 02-01-2014, 04:29
ahmadmansoor's Avatar
ahmadmansoor ahmadmansoor is offline
Exetools Team Manager
 
Join Date: Feb 2006
Location: Syria
Posts: 1,006
Rept. Given: 462
Rept. Rcvd 361 Times in 134 Posts
Thanks Given: 190
Thanks Rcvd at 277 Times in 98 Posts
ahmadmansoor Reputation: 300-399 ahmadmansoor Reputation: 300-399 ahmadmansoor Reputation: 300-399 ahmadmansoor Reputation: 300-399
Really nice work Deathway.
but any example files or update for movie tut .
many thanks .
__________________
Ur Best Friend Ahmadmansoor
Always My Best Friend: Aaron & JMI & ZeNiX
Reply With Quote
The Following User Says Thank You to ahmadmansoor For This Useful Post:
Indigo (07-19-2019)
  #39  
Old 02-05-2014, 11:03
Deathway's Avatar
Deathway Deathway is offline
Lo*eXeTools*rd
 
Join Date: Jan 2009
Posts: 41
Rept. Given: 8
Rept. Rcvd 155 Times in 24 Posts
Thanks Given: 1
Thanks Rcvd at 19 Times in 14 Posts
Deathway Reputation: 100-199 Deathway Reputation: 100-199
[v1.8]
- FISH BLACK variant avaible
- Fixed deofuscation order (GenV6)
- New deofucation scheme for FISH machine
- New smart code tracer for FISH machines
- Stack sort for FISH commands
- Improved management of memory (faster deofuscation)
- Added movzx reg32, [esp+eax+memoffset] on CISC machines
- Added a message prompt when the opcode buffer is not enough
- Added LEAVE instruction for FISH machines
- Added support for CALLs to VM section in FISH machines
- CHECK_PROTECTION macro disabled, now it must be restored by hand
- Fixed QWORD incorrect names for some opcodes
- Fixed a problem when deofuscating RISC machines

Thanks people for all your reports, the plug-in becomes more powerful every day.

Now it fully supports FISH machines.
CHECK_PROTECTION macro has been disbled, it must be restored by hand, there were many troubles when handling this kind of macro.
CodeVirtualizer machines aren't supported (FISH-TIGER).
Hope you like this new update, happy reversing


Deathway.
Attached Files
File Type: rar Oreans UnVirtualizer 1.8.rar (364.1 KB, 192 views)
Reply With Quote
The Following 11 Users Gave Reputation+1 to Deathway For This Useful Post:
besoeso (02-06-2014), Conquest (02-06-2014), copyleft (02-08-2014), giv (02-05-2014), JCB (02-11-2014), K3nny (02-14-2014), Kla$ (02-05-2014), MistHill (02-07-2014), niculaita (03-07-2014), nikkapedd (02-09-2014), softgate (02-05-2014)
The Following User Says Thank You to Deathway For This Useful Post:
Indigo (07-19-2019)
  #40  
Old 02-05-2014, 14:41
giv's Avatar
giv giv is offline
VIP
 
Join Date: Jan 2011
Location: Romania
Posts: 1,654
Rept. Given: 801
Rept. Rcvd 1,281 Times in 559 Posts
Thanks Given: 210
Thanks Rcvd at 542 Times in 226 Posts
giv Reputation: 1100-1299 giv Reputation: 1100-1299 giv Reputation: 1100-1299 giv Reputation: 1100-1299 giv Reputation: 1100-1299 giv Reputation: 1100-1299 giv Reputation: 1100-1299 giv Reputation: 1100-1299 giv Reputation: 1100-1299
So fast.
Congrats amigo.
Reply With Quote
The Following User Says Thank You to giv For This Useful Post:
Indigo (07-19-2019)
  #41  
Old 09-26-2014, 14:57
DMichael's Avatar
DMichael DMichael is offline
Family
 
Join Date: Apr 2012
Location: Israel
Posts: 199
Rept. Given: 139
Rept. Rcvd 281 Times in 72 Posts
Thanks Given: 13
Thanks Rcvd at 30 Times in 24 Posts
DMichael Reputation: 200-299 DMichael Reputation: 200-299 DMichael Reputation: 200-299
anyone still own the video tutorial deathway made?
Reply With Quote
The Following User Says Thank You to DMichael For This Useful Post:
Indigo (07-19-2019)
  #42  
Old 12-23-2014, 16:14
DA3MON_CRACK3R
 
Posts: n/a
hi
i try doing modify this program but i not found source of this program
i am sorry for my bad english
Reply With Quote
  #43  
Old 12-24-2014, 14:52
giv's Avatar
giv giv is offline
VIP
 
Join Date: Jan 2011
Location: Romania
Posts: 1,654
Rept. Given: 801
Rept. Rcvd 1,281 Times in 559 Posts
Thanks Given: 210
Thanks Rcvd at 542 Times in 226 Posts
giv Reputation: 1100-1299 giv Reputation: 1100-1299 giv Reputation: 1100-1299 giv Reputation: 1100-1299 giv Reputation: 1100-1299 giv Reputation: 1100-1299 giv Reputation: 1100-1299 giv Reputation: 1100-1299 giv Reputation: 1100-1299
Quote:
Originally Posted by DMichael View Post
anyone still own the video tutorial deathway made?
I will give you a hand.
Quote:
http://www11.zippyshare.com/v/35048094/file.html
Reply With Quote
The Following User Gave Reputation+1 to giv For This Useful Post:
DMichael (12-24-2014)
The Following User Says Thank You to giv For This Useful Post:
Indigo (07-19-2019)
  #44  
Old 12-24-2014, 17:00
Conquest Conquest is offline
Friend
 
Join Date: Jan 2013
Location: 0x484F4D45
Posts: 105
Rept. Given: 46
Rept. Rcvd 29 Times in 17 Posts
Thanks Given: 24
Thanks Rcvd at 41 Times in 20 Posts
Conquest Reputation: 29
Quote:
Originally Posted by DA3MON_CRACK3R View Post
hi
i try doing modify this program but i not found source of this program
i am sorry for my bad english
closed source. even if it gets open source , those who will be able to make future progress, are already good enough to make something similar like this.
Reply With Quote
The Following User Says Thank You to Conquest For This Useful Post:
Indigo (07-19-2019)
  #45  
Old 04-23-2015, 03:29
1ST 1ST is offline
Family
 
Join Date: Apr 2010
Location: Jordan
Posts: 91
Rept. Given: 46
Rept. Rcvd 225 Times in 24 Posts
Thanks Given: 2
Thanks Rcvd at 2 Times in 2 Posts
1ST Reputation: 200-299 1ST Reputation: 200-299 1ST Reputation: 200-299
why do i get machine signature not found?
Reply With Quote
The Following User Says Thank You to 1ST For This Useful Post:
Indigo (07-19-2019)
Reply

Tags
codevirualizer, decompiler

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
[VB. NET 2010] Oreans Unvirtualizer plugin file processor giv Source Code 0 07-21-2015 16:18


All times are GMT +8. The time now is 13:52.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX