Code Virtualization Help
 

Helo, i have a little question about virtual machines which uses PE protectors. I google a lot, but I don't find any idea to create my own code protecting VM. Have you any ideas ? (...SORRY FOR MY ENGLISH...)

Study other VM protectors and steal their ideas. You have Themida, Securom, VMProtect to study...

check rewolfs release, really a good start; read the readme.

yeah study, but studiing some unpacked Protectors or Virtualizers is really hard :( and rewolfs ??? I don't hear about it. and goolge don't help me with rewolfs. Have you something else idea ? :)

Maybe this could help you to have some ideas... not well written but well... that's from a comercial protector ;)

http://www.codebreakers-journal.com/content/view/290/97/

scherzo

Take also a look to libemu

Regards

Here you can understand the basic workings of a VM.
_http://rapidshare.com/files/16968098/Inside_Code_Virtualizer.rar

And here is a VM compiler source code by 0rp posted a long time ago.
_http://www.woodmann.com/forum/showthread.php?t=10003

Cheers

^Thanks for those links!

Aren't there any open-source examples available? (Irony, I know -- OSS on an RE forum :D)

Here you can find the Rewolf's x86 Virtualizer Source code :) it's very simple but very easy to know how :)...
AND all users thanx for good reasons on this post :)

learn cv inside

@peexe : can u explain more ....... ???!!!!!

I think he refer at Inside Code Virtualizer by scherzo

Regards

Rolf's posts might also interest you.

http://www.openrce.org/blog/view/123...art_0:__Basics

It is not that difficult to write an own vm based protector. as the others explained read papers about commercial products. but you can also start with a minimum set of requirements.

- C/C++
- Disassembler Library

And there you go. First step could be just to virtualize only a single type of instruction, for example an arithmetic one like

add eax, 0x12345678

This will keep your code very small. There is no need to support hundereds of different opcodes if you just want to understand the concept.

Regards,
OHPen