Exetools  

Go Back   Exetools > General > General Discussion

Notices

 
 
Thread Tools Display Modes
Prev Previous Post   Next Post Next
  #7  
Old 12-09-2006, 05:38
dyn!o's Avatar
dyn!o dyn!o is offline
Friend
 
Join Date: Nov 2003
Location: Own mind
Posts: 214
Rept. Given: 1
Rept. Rcvd 1 Time in 1 Post
Thanks Given: 8
Thanks Rcvd at 0 Times in 0 Posts
dyn!o Reputation: 1
Oh my , I have no advanced knowledge about virtual machines or protections. I just came today, after a long break, to raise my post count in order to keep my account alive - I am serious. I took the first thread in General Discussion - it was a coincidence of choosing this topic. I am talking about my dreams only. Not "the only truth".
Quote:
Well, I know the difference between virtualisation and a virtual machine. And, again, I didn't say this protection uses a VM.
I did not say you do.
Quote:
Of course a VM needs a operating environment. But anybody can code a VM in just two minutes (OK, maybe 2 hours if you don't just want to have a two-opcode VM, but something which can be used for something).
Interpreter my friend... I guess you had that thing in mind. Interpreter is not a virtual machine (it's only a part of it) but you are right: the simpliest interpreter can be coded in 2h. You can find it in many crackmes and less viruses.
Quote:
But the problem is not to create the VM, the problem is how to convert any existing piece of code into virtual opcodes, which behave in the VM exactly like the original opcodes on a real CPU.
So the question is: how do you want to achieve such a result without writing a virtual machine (quote: "But the problem is not to create the VM")?
Quote:
And if you've already analysed the original code deep enough to use the type of protection mentioned in the first post, it is just a simple step to convert any instruction into a virtual opcode and run it in the VM.
I cannot agree. I could do if it is about myself only but many people read this thread and many other will do it in the future. Let's do not suggest them that with x86 "scrambler" we are simple step from running the code inside virtual machine. Virtual machine requires own environment, while LiuTaoTao's solution, in its strongest theoretical assumption, requires only an interpreter. Please take a look at the quote below to find my humble opinion regarding this point too.
Quote:
What other really big part do you miss, if this "is not even a small step for vm development"? (assuming that I'm not a super great coding mastermind and therefore don't understand where the big problem is hiding)
I am also not a mastermind but let's take a look at things which seems a bit complex for me if we are talking about "what do we miss":

1. Stack frames (not to mention FPU stack pointer )
2. Registers
3. Code evaluation
4. Exceptions
5. Non-static code support
6. Memory management
7. Privileged instructions
8. System API emulator
9. Interrupts
10. Threads
11. System calls

If that seems easy for anyone then we can extend this list at least twice.

Kind regards.
Reply With Quote
 

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
.net modification of a method (without decompilation) Shub-Nigurrath General Discussion 8 10-15-2013 21:04
search method passwords goku General Discussion 7 07-14-2010 02:15
Protection against point-h method? TheDutchJewel General Discussion 7 05-06-2004 01:32
What method to use? bartster General Discussion 11 02-08-2004 23:19


All times are GMT +8. The time now is 00:31.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )