PandaObfuscator, with custom VM

[CodeOfDark 0]

Difficulty : 2-3
Language : .NET
Platform : Windows
OS Version : Windows7+
Packer / Protector : PandaObfuscator (Modded Confuser) with Custom VM

Description :

Just basic UnpackMe, want to see if my obfuscator good/bad

Screenshot :

GetMe.7z

[SHADOW_UA 469]

Unpacked

Use any long key to pass checks.

GetMe_unp.zip

[tathanhdinh 0]

I'm cannot resolve the challenge yet, it's indeed very hard (at least for me). I would like just to know whether I've got the correct partial result or not.

I've managed to "dump" the key checking procedure, which locates on several non-contiguous pages (!?). The attached image is a part of it (I don't know how to capture all the function). I've found that there is a loop which reads each chararacter (input key is a wide string, each char is 2 bytes) by the instruction

movz ecx, [eax + ebx * 2]

the character is then checked with several values (e.g. "-", etc). But I still cannot go further.

Edited January 8 by tathanhdinh
code reformat (see edit history)

[tathanhdinh 0]

WTF, I've gone seriously wrong with this challenge 🤐 .

Excellent work, @SHADOW_UA

Edited January 9 by tathanhdinh (see edit history)

[CodeOfDark 0]

Gj @SHADOW_UA

[Zyhes 0]

On 1/8/2019 at 9:47 PM, SHADOW_UA said:

Unpacked

Use any long key to pass checks.

GetMe_unp.zip

 

Any info of how you did it?

Edited January 31 by Zyhes (see edit history)