Jump to content
Tuts 4 You

[unpackme] ElCrabe's VM v2


r0ket

Recommended Posts

  • 2 weeks later...

Hello ElCrabe,

1. Good work! :)

2. I can rebuild the full OEP routine and get the target run

3. I can not rebuild the VMed Opcodes!Just some calls.

4. Looks very hard your new UnpackMe so I see no light to come forward to rebuild the VM code for the calc routine.

5. You are using a lot memory. :)

All in all its not easy for me or I am too blind or something. :) Maybe you can give us some advice where to have a deeper look to get/see some more about the used commands.

greetz

Link to comment

Same here too...i think the only possible way to solve it is to execute the part of stub that creates the vm near oep. Dump all is kindly impossible imho. Interesting one.

Link to comment

Hehe you're not telling me this is harder than Themida right. ;)

Anyways since you guys are already giving up this might be very interesting.

EDIT:

I like the hints, (virtual stack exceed etc. ;) )

Edited by quosego
Link to comment

of course it is not harder than themida. For example it does not have any it protectoin. Anyway to dump whole parts of needed vm could be hard...test by yourself :D

Link to comment

@LCF-AT

1. Thx =)

2. Gonna add some critical code to the virtualized ep code (if ep virtualization option is enabled) soon

5. Yep, as u already know vmed code length is too big, rewrite&reduce needed. Almost all other vm params r user configurable

Advice #0:

Trash opcode handlers have no calls inside.

@quosego

A lot of debug info inside :lol:

EDIT:

Do u need more advices now ?

Edited by ElCrabe
Link to comment
  • 3 weeks later...
  • 3 weeks later...

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...