Exetools  

Go Back   Exetools > General > Community Tools

Notices

Reply
 
Thread Tools Display Modes
  #1  
Old 05-17-2011, 19:03
V0ldemAr
 
Posts: n/a
beta 11

http://rghost.net/6720721

Added:
1) Handlers of FPU instructions fclex, fldcw, fstcw, fldz, fld1, fistp
2) Window with code segments input and VM has 3 buttons now:
- Analyze - Start analysis of VM entries and import restoration.
- Accept - Apply entered values of segments without analysis
- Cancel - Exit without saving any changes

3) Display API names in p-code maps, relocations and function callings
4) Devirtualization of add esp, xx instruction
5) Improved restoration of partially wiped IAT
6) Import recovery such as: push reg; call vm -> call [api].
7) push/pop reg; call vm -> mov reg,[api].
8) Improved recognition of VM entries
9) Improved detection of VM loop

Fixed:
1) Code conversion: pop xx; jmp xx into retn.
2) Restructure of intermediate code. Blocks intersections.
3) Installed several exceptions during code devirtualization.
4) Removal of anti-dump code.

Translated from Russian

����ҧѧӧݧ֧ߧ�:
1. ���ҧ�ѧҧ���ڧܧ� FPU �ڧߧ����ܧ�ڧ�: fclex, fldcw, fstcw, fldz, fld1, fistp.
2. ���ܧߧ� �ӧӧ�է� �٧ߧѧ�֧ߧڧ� ��֧ԧާ֧ߧ��� �ܧ�է� �� ���� ��֧�֧�� �ڧާ֧֧� ���� �ܧߧ��ܧ�:
- Analyze - �ߧѧ�ѧ�� �ѧߧѧݧڧ� ����֧� �ӧ��է� �� ���� �� �ӧ����ѧߧ�ӧݧ֧ߧڧ� �ڧާ�����.
- Accept - ���ڧߧ��� �ӧӧ֧է֧ߧߧ��� �٧ߧѧ�֧ߧڧ� ��֧ԧާ֧ߧ��� �ҧ֧� �ӧ����ݧߧ֧ߧڧ� �ѧߧѧݧڧ٧�.
- Cancel - �ӧ��ۧ�� �ߧ� ����ڧ٧ӧ�է� �ߧڧܧѧܧڧ� �ڧ٧ާ֧ߧ֧ߧڧ�.
3. �����ӧ�� �ڧާ֧� API ���ߧܧ�ڧ� �� �ܧѧ��ѧ� ��ڧܧ�է�, ��֧ݧ�ܧ�� �� �ӧ��٧�ӧ�� ���ߧܧ�ڧ�.
4. ���֧ӧڧ���ѧݧڧ٧ѧ�ڧ� �ڧߧ����ܧ�ڧ� add esp, xx
5. ���ݧ���֧ߧ� �ӧ����ѧߧ�ӧݧ֧ߧڧ� ��ѧ��ڧ�ߧ� �٧ѧ�֧���� IAT.
6. �������ѧߧ�ӧݧ֧ߧڧ� �ڧާ����� ��ڧ��: push reg; call vm -> call [api].
7. �������ѧߧ�ӧݧ֧ߧڧ� �ڧާ����� ��ڧ��: push/pop reg; call vm -> mov reg,[api].
8. ���ݧ���֧ߧ� ��ѧ���٧ߧѧӧѧߧڧ� ����֧� �ӧ��է� �� ����.
9. ���ݧ���֧ߧ� ��ѧ���٧ߧѧӧѧߧڧ� ��ڧܧݧ� ����.
������ѧӧݧ֧ߧ�:
1. ����֧�ҧ�ѧ٧�ӧѧߧڧ� �ܧ�է� pop xx; jmp xx �� retn.
2. ���֧����ܧ���ڧ٧ѧ�ڧ� ����ާܧ�է�. ���֧�֧�֧�֧ߧڧ� �ҧݧ�ܧ��.
3. ������ѧߧ֧ߧ� �ߧ֧�ܧ�ݧ�ܧ� �ڧ�ܧݧ��֧ߧڧ� ���� �է֧ӧڧ���ѧݧڧ٧ѧ�ڧ� �ܧ�է�.
4. ���էѧݧ֧ߧڧ� �ܧ�է� �ѧߧ�ڧէѧާ��.

PS: Vam correct me if I translated it incorrectly and you meant something else

Last edited by V0ldemAr; 05-17-2011 at 19:08.
Reply With Quote
The Following 2 Users Gave Reputation+1 to For This Useful Post:
greengo (05-18-2011), JeRRy (05-17-2011)
Reply

Tags
codevirualizer, decompiler, vmprotect, vmsweeper

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Is there linux vm tool like vmprotect? swlepus General Discussion 4 12-23-2011 10:07


All times are GMT +8. The time now is 00:53.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )