Exetools

Exetools (https://forum.exetools.com/index.php)
-   Community Tools (https://forum.exetools.com/forumdisplay.php?f=47)
-   -   VM decompiler tool (VMProtect, CodeVirtualizer) (https://forum.exetools.com/showthread.php?t=13084)

Vam 03-02-2011 14:15

1. Sweeper not yet able to fully restore multisection IAT with a partially erased sections where functions one API library are located in different sections.
2. Tell me a range of segments of code and the VM and address of the decoded function on which this error occurs.

ahmadmansoor 03-02-2011 17:25

I will provide u with details when I go back to home .
and I will make a small flash movie .
Thanks for support ... great work from the best Coder .

ahmadmansoor 03-02-2011 17:25

@Vam :Check ur PM
I think when it need to rebuild the IAt it fail ...

Vam 03-03-2011 14:49

At OEP 42E441 perform decoding (F1) makes no sense, there is no VM. Decoding functions may only address the status of Postponed. In your program, three of these addresses and they are decompiled successfully (until the section a12 final).
For the beginning we decompile the test example, if before it did, and learn ways to manage Sweeper.
Processing of import will be done in the next version Sweeper.

peexe 03-28-2011 20:11

it support themida vm?

progopis 03-28-2011 20:48

For Themida look here (but only CISC VM):

http://forum.exetools.com/showpost.php?p=72196&postcount=5

estelle 04-19-2011 13:13

wait for update ������

V0ldemAr 05-17-2011 19:03

beta 11
 
http://rghost.net/6720721

Added:
1) Handlers of FPU instructions fclex, fldcw, fstcw, fldz, fld1, fistp
2) Window with code segments input and VM has 3 buttons now:
- Analyze - Start analysis of VM entries and import restoration.
- Accept - Apply entered values of segments without analysis
- Cancel - Exit without saving any changes

3) Display API names in p-code maps, relocations and function callings
4) Devirtualization of add esp, xx instruction
5) Improved restoration of partially wiped IAT
6) Import recovery such as: push reg; call vm -> call [api].
7) push/pop reg; call vm -> mov reg,[api].
8) Improved recognition of VM entries
9) Improved detection of VM loop

Fixed:
1) Code conversion: pop xx; jmp xx into retn.
2) Restructure of intermediate code. Blocks intersections.
3) Installed several exceptions during code devirtualization.
4) Removal of anti-dump code.

Translated from Russian

����ҧѧӧݧ֧ߧ�:
1. ���ҧ�ѧҧ���ڧܧ� FPU �ڧߧ����ܧ�ڧ�: fclex, fldcw, fstcw, fldz, fld1, fistp.
2. ���ܧߧ� �ӧӧ�է� �٧ߧѧ�֧ߧڧ� ��֧ԧާ֧ߧ��� �ܧ�է� �� ���� ��֧�֧�� �ڧާ֧֧� ���� �ܧߧ��ܧ�:
- Analyze - �ߧѧ�ѧ�� �ѧߧѧݧڧ� ����֧� �ӧ��է� �� ���� �� �ӧ����ѧߧ�ӧݧ֧ߧڧ� �ڧާ�����.
- Accept - ���ڧߧ��� �ӧӧ֧է֧ߧߧ��� �٧ߧѧ�֧ߧڧ� ��֧ԧާ֧ߧ��� �ҧ֧� �ӧ����ݧߧ֧ߧڧ� �ѧߧѧݧڧ٧�.
- Cancel - �ӧ��ۧ�� �ߧ� ����ڧ٧ӧ�է� �ߧڧܧѧܧڧ� �ڧ٧ާ֧ߧ֧ߧڧ�.
3. �����ӧ�� �ڧާ֧� API ���ߧܧ�ڧ� �� �ܧѧ��ѧ� ��ڧܧ�է�, ��֧ݧ�ܧ�� �� �ӧ��٧�ӧ�� ���ߧܧ�ڧ�.
4. ���֧ӧڧ���ѧݧڧ٧ѧ�ڧ� �ڧߧ����ܧ�ڧ� add esp, xx
5. ���ݧ���֧ߧ� �ӧ����ѧߧ�ӧݧ֧ߧڧ� ��ѧ��ڧ�ߧ� �٧ѧ�֧���� IAT.
6. �������ѧߧ�ӧݧ֧ߧڧ� �ڧާ����� ��ڧ��: push reg; call vm -> call [api].
7. �������ѧߧ�ӧݧ֧ߧڧ� �ڧާ����� ��ڧ��: push/pop reg; call vm -> mov reg,[api].
8. ���ݧ���֧ߧ� ��ѧ���٧ߧѧӧѧߧڧ� ����֧� �ӧ��է� �� ����.
9. ���ݧ���֧ߧ� ��ѧ���٧ߧѧӧѧߧڧ� ��ڧܧݧ� ����.
������ѧӧݧ֧ߧ�:
1. ����֧�ҧ�ѧ٧�ӧѧߧڧ� �ܧ�է� pop xx; jmp xx �� retn.
2. ���֧����ܧ���ڧ٧ѧ�ڧ� ����ާܧ�է�. ���֧�֧�֧�֧ߧڧ� �ҧݧ�ܧ��.
3. ������ѧߧ֧ߧ� �ߧ֧�ܧ�ݧ�ܧ� �ڧ�ܧݧ��֧ߧڧ� ���� �է֧ӧڧ���ѧݧڧ٧ѧ�ڧ� �ܧ�է�.
4. ���էѧݧ֧ߧڧ� �ܧ�է� �ѧߧ�ڧէѧާ��.

PS: Vam correct me if I translated it incorrectly and you meant something else :)

estelle 05-18-2011 13:07

antidebuger function can only be used in windowsxp system

BiTdEcOdE 06-14-2011 10:29

Quote:

Originally Posted by Vam (Post 71729)
Use clean WinXp SP3 or VMWare with WinXP SP3 then problems should not be.
Some options of assembler Olly influence quality of a code and analysis VMSweeper.

thx for Vam's useful tips. vmsweeper,powerful tool! :)

Av0id 06-19-2011 22:42

There is update for this tool

Download link:
Code:

http://rghost.ru/11532971
Original thread:
Code:

http://www.exelab.ru/f/index.php?action=vthread&forum=13&topic=15906&page=10#14
What was fixed:
Code:

������ѧӧݧ֧ߧ�:
1. fixed some errors with CodeVirtualizer decompiler, introduced with VMProtect decompiler development

Credits goes to Vamit

estelle 06-29-2011 17:08

Hope of a tut on vms plug to use and set

Vam 06-29-2011 23:48

Quote:

Originally Posted by estelle (Post 73788)
Hope of a tut on vms plug to use and set

Read and look here
Read a topic, decompile a test example, all is detail written, even from video...
Do not forget to read also chm help file.

estelle 07-06-2011 18:58

thank vam:p:p:p

fiy 07-08-2011 17:34

good,great tools.


All times are GMT +8. The time now is 15:49.

Powered by vBulletin® Version 3.8.8
Copyright ©2000 - 2026, vBulletin Solutions, Inc.
Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX