![]() |
|
|
|
#1
|
|||
|
|||
|
beta 11
http://rghost.net/6720721
Added: 1) Handlers of FPU instructions fclex, fldcw, fstcw, fldz, fld1, fistp 2) Window with code segments input and VM has 3 buttons now: - Analyze - Start analysis of VM entries and import restoration. - Accept - Apply entered values of segments without analysis - Cancel - Exit without saving any changes 3) Display API names in p-code maps, relocations and function callings 4) Devirtualization of add esp, xx instruction 5) Improved restoration of partially wiped IAT 6) Import recovery such as: push reg; call vm -> call [api]. 7) push/pop reg; call vm -> mov reg,[api]. 8) Improved recognition of VM entries 9) Improved detection of VM loop Fixed: 1) Code conversion: pop xx; jmp xx into retn. 2) Restructure of intermediate code. Blocks intersections. 3) Installed several exceptions during code devirtualization. 4) Removal of anti-dump code. Translated from Russian ����ҧѧӧݧ֧ߧ�: 1. ���ҧ�ѧҧ���ڧܧ� FPU �ڧߧ����ܧ�ڧ�: fclex, fldcw, fstcw, fldz, fld1, fistp. 2. ���ܧߧ� �ӧӧ�է� �٧ߧѧ�֧ߧڧ� ��֧ԧާ֧ߧ��� �ܧ�է� �� ���� ��֧�֧�� �ڧާ֧֧� ���� �ܧߧ��ܧ�: - Analyze - �ߧѧ�ѧ�� �ѧߧѧݧڧ� ����֧� �ӧ��է� �� ���� �� �ӧ����ѧߧ�ӧݧ֧ߧڧ� �ڧާ�����. - Accept - ���ڧߧ��� �ӧӧ֧է֧ߧߧ��� �٧ߧѧ�֧ߧڧ� ��֧ԧާ֧ߧ��� �ҧ֧� �ӧ����ݧߧ֧ߧڧ� �ѧߧѧݧڧ٧�. - Cancel - �ӧ��ۧ�� �ߧ� ����ڧ٧ӧ�է� �ߧڧܧѧܧڧ� �ڧ٧ާ֧ߧ֧ߧڧ�. 3. �����ӧ�� �ڧާ֧� API ���ߧܧ�ڧ� �� �ܧѧ��ѧ� ��ڧܧ�է�, ��֧ݧ�ܧ�� �� �ӧ��٧�ӧ�� ���ߧܧ�ڧ�. 4. ���֧ӧڧ���ѧݧڧ٧ѧ�ڧ� �ڧߧ����ܧ�ڧ� add esp, xx 5. ���ݧ���֧ߧ� �ӧ����ѧߧ�ӧݧ֧ߧڧ� ��ѧ��ڧ�ߧ� �٧ѧ�֧���� IAT. 6. �������ѧߧ�ӧݧ֧ߧڧ� �ڧާ����� ��ڧ��: push reg; call vm -> call [api]. 7. �������ѧߧ�ӧݧ֧ߧڧ� �ڧާ����� ��ڧ��: push/pop reg; call vm -> mov reg,[api]. 8. ���ݧ���֧ߧ� ��ѧ���٧ߧѧӧѧߧڧ� ����֧� �ӧ��է� �� ����. 9. ���ݧ���֧ߧ� ��ѧ���٧ߧѧӧѧߧڧ� ��ڧܧݧ� ����. ������ѧӧݧ֧ߧ�: 1. ����֧�ҧ�ѧ٧�ӧѧߧڧ� �ܧ�է� pop xx; jmp xx �� retn. 2. ���֧����ܧ���ڧ٧ѧ�ڧ� ����ާܧ�է�. ���֧�֧�֧�֧ߧڧ� �ҧݧ�ܧ��. 3. ������ѧߧ֧ߧ� �ߧ֧�ܧ�ݧ�ܧ� �ڧ�ܧݧ��֧ߧڧ� ���� �է֧ӧڧ���ѧݧڧ٧ѧ�ڧ� �ܧ�է�. 4. ���էѧݧ֧ߧڧ� �ܧ�է� �ѧߧ�ڧէѧާ��. PS: Vam correct me if I translated it incorrectly and you meant something else
Last edited by V0ldemAr; 05-17-2011 at 19:08. |
![]() |
| Tags |
| codevirualizer, decompiler, vmprotect, vmsweeper |
| Thread Tools | |
| Display Modes | |
|
|
Similar Threads
|
||||
| Thread | Thread Starter | Forum | Replies | Last Post |
| Is there linux vm tool like vmprotect? | swlepus | General Discussion | 4 | 12-23-2011 10:07 |