![]() |
1. Sweeper not yet able to fully restore multisection IAT with a partially erased sections where functions one API library are located in different sections.
2. Tell me a range of segments of code and the VM and address of the decoded function on which this error occurs. |
I will provide u with details when I go back to home .
and I will make a small flash movie . Thanks for support ... great work from the best Coder . |
@Vam :Check ur PM
I think when it need to rebuild the IAt it fail ... |
At OEP 42E441 perform decoding (F1) makes no sense, there is no VM. Decoding functions may only address the status of Postponed. In your program, three of these addresses and they are decompiled successfully (until the section a12 final).
For the beginning we decompile the test example, if before it did, and learn ways to manage Sweeper. Processing of import will be done in the next version Sweeper. |
it support themida vm?
|
For Themida look here (but only CISC VM):
http://forum.exetools.com/showpost.php?p=72196&postcount=5 |
wait for update ������
|
beta 11
http://rghost.net/6720721
Added: 1) Handlers of FPU instructions fclex, fldcw, fstcw, fldz, fld1, fistp 2) Window with code segments input and VM has 3 buttons now: - Analyze - Start analysis of VM entries and import restoration. - Accept - Apply entered values of segments without analysis - Cancel - Exit without saving any changes 3) Display API names in p-code maps, relocations and function callings 4) Devirtualization of add esp, xx instruction 5) Improved restoration of partially wiped IAT 6) Import recovery such as: push reg; call vm -> call [api]. 7) push/pop reg; call vm -> mov reg,[api]. 8) Improved recognition of VM entries 9) Improved detection of VM loop Fixed: 1) Code conversion: pop xx; jmp xx into retn. 2) Restructure of intermediate code. Blocks intersections. 3) Installed several exceptions during code devirtualization. 4) Removal of anti-dump code. Translated from Russian ����ҧѧӧݧ֧ߧ�: 1. ���ҧ�ѧҧ���ڧܧ� FPU �ڧߧ����ܧ�ڧ�: fclex, fldcw, fstcw, fldz, fld1, fistp. 2. ���ܧߧ� �ӧӧ�է� �٧ߧѧ�֧ߧڧ� ��֧ԧާ֧ߧ��� �ܧ�է� �� ���� ��֧�֧�� �ڧާ֧֧� ���� �ܧߧ��ܧ�: - Analyze - �ߧѧ�ѧ�� �ѧߧѧݧڧ� ����֧� �ӧ��է� �� ���� �� �ӧ����ѧߧ�ӧݧ֧ߧڧ� �ڧާ�����. - Accept - ���ڧߧ��� �ӧӧ֧է֧ߧߧ��� �٧ߧѧ�֧ߧڧ� ��֧ԧާ֧ߧ��� �ҧ֧� �ӧ����ݧߧ֧ߧڧ� �ѧߧѧݧڧ٧�. - Cancel - �ӧ��ۧ�� �ߧ� ����ڧ٧ӧ�է� �ߧڧܧѧܧڧ� �ڧ٧ާ֧ߧ֧ߧڧ�. 3. �����ӧ�� �ڧާ֧� API ���ߧܧ�ڧ� �� �ܧѧ��ѧ� ��ڧܧ�է�, ��֧ݧ�ܧ�� �� �ӧ��٧�ӧ�� ���ߧܧ�ڧ�. 4. ���֧ӧڧ���ѧݧڧ٧ѧ�ڧ� �ڧߧ����ܧ�ڧ� add esp, xx 5. ���ݧ���֧ߧ� �ӧ����ѧߧ�ӧݧ֧ߧڧ� ��ѧ��ڧ�ߧ� �٧ѧ�֧���� IAT. 6. �������ѧߧ�ӧݧ֧ߧڧ� �ڧާ����� ��ڧ��: push reg; call vm -> call [api]. 7. �������ѧߧ�ӧݧ֧ߧڧ� �ڧާ����� ��ڧ��: push/pop reg; call vm -> mov reg,[api]. 8. ���ݧ���֧ߧ� ��ѧ���٧ߧѧӧѧߧڧ� ����֧� �ӧ��է� �� ����. 9. ���ݧ���֧ߧ� ��ѧ���٧ߧѧӧѧߧڧ� ��ڧܧݧ� ����. ������ѧӧݧ֧ߧ�: 1. ����֧�ҧ�ѧ٧�ӧѧߧڧ� �ܧ�է� pop xx; jmp xx �� retn. 2. ���֧����ܧ���ڧ٧ѧ�ڧ� ����ާܧ�է�. ���֧�֧�֧�֧ߧڧ� �ҧݧ�ܧ��. 3. ������ѧߧ֧ߧ� �ߧ֧�ܧ�ݧ�ܧ� �ڧ�ܧݧ��֧ߧڧ� ���� �է֧ӧڧ���ѧݧڧ٧ѧ�ڧ� �ܧ�է�. 4. ���էѧݧ֧ߧڧ� �ܧ�է� �ѧߧ�ڧէѧާ��. PS: Vam correct me if I translated it incorrectly and you meant something else :) |
antidebuger function can only be used in windowsxp system
|
Quote:
|
There is update for this tool
Download link: Code:
http://rghost.ru/11532971Code:
http://www.exelab.ru/f/index.php?action=vthread&forum=13&topic=15906&page=10#14Code:
������ѧӧݧ֧ߧ�: |
Hope of a tut on vms plug to use and set
|
Quote:
Read a topic, decompile a test example, all is detail written, even from video... Do not forget to read also chm help file. |
thank vam:p:p:p
|
good,great tools.
|
| All times are GMT +8. The time now is 15:49. |
Powered by vBulletin® Version 3.8.8
Copyright ©2000 - 2026, vBulletin Solutions, Inc.
Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX