Exetools  

Go Back   Exetools > General > General Discussion

Notices

 
 
Thread Tools Display Modes
Prev Previous Post   Next Post Next
  #1  
Old 05-12-2016, 10:34
0xNOP 0xNOP is offline
Friend
 
Join Date: May 2016
Location: ::1
Posts: 4
Rept. Given: 0
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 9
Thanks Rcvd at 1 Time in 1 Post
0xNOP Reputation: 0
Talking [Help] Reversing VMProtect 3?

Hello,

Basically I'm initiating myself on VMProtect because someone came to me looking for help to see if I could help him reversing a program with VMProtect, yeah I know it's crazy... well I checked on PiD and shows VMProtect 3 detected.

So, I'm not that familiar with protectors like VMProtect except for Armadillo, but that was like for a project I was working on like a month ago or so, never got too deep in it neither.

The thing is, that I need some pointers on how to work with VMProtect, I've got past the anti-debugging protections at the beginning of execution (same ol' anti-debugger techinques to detect debugers, etc, etc.) but I'm failing in particularly one, and it's when I get into the VM, the inline polymorphic VM Handlers undo whatever I do to the Virtualized P-Code, but I'm getting kinda lost here...

I was reading this article -> http://lille1tv.univ-lille1.fr/telecharge.aspx?id=d5b2487e-cacc-4596-ab37-dab2b362cb9e that mainly gives a thorough explanation of what you will find inside a program protected with VMProtect, now the thing is that, I've tried reading but like I said, I'm not familiar with some of the concepts, or I don't even know if most of the concepts are up-to-date (guide was written in 2015 and now the latest version is VMProtect 3), mainly because I haven't yet understood how the underlying VM really works, just yet, and only knowing that the VM is always different after each compilation, it makes me cringe...

I will really appreciate any help anyone could bring to me and aid me on this clash of protected code vs reversing.
Reply With Quote
The Following User Says Thank You to 0xNOP For This Useful Post:
Dr.FarFar (02-26-2022)
 


Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
VMProtect v1.6 help _503_ General Discussion 3 02-21-2009 13:06


All times are GMT +8. The time now is 04:54.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )