Jump to content
View in the app

A better way to browse. Learn more.
Tuts 4 You

A full-screen app on your home screen with push notifications, badges and more.

To install this app on iOS and iPadOS
  1. Tap the Share icon in Safari
  2. Scroll the menu and tap Add to Home Screen.
  3. Tap Add in the top-right corner.
To install this app on Android
  1. Tap the 3-dot menu (⋮) in the top-right corner of the browser.
  2. Tap Add to Home screen or Install app.
  3. Confirm by tapping Install.

Pass Debugger Check in VMprotect 2.x

mojtaba
mojtaba
in Malware Reverse Engineering

Featured Replies

6 minutes ago, windowbase said:

@boot This driver has been blocked from loading.

what's wrong?

Regards.

sean.

This is normal, as I mentioned, you need to load the 32-bit driver on the 32-bit system. If loading on the 64-bit system, this prompt will appear.

    • Thanks 1
    • Replies 86
    • Views 19.4k
    • Created
    • Last Reply

    Top Posters In This Topic

    Popular Days

    Most Popular Posts

    • jackyjask
      jackyjask

      Just old good professional grade Ollydbg v2  + ScyllaHide, no any dangerous driver based titan hiders Before Be   After   Scylla Hide plugin:

    • X0rby
      X0rby

      @windowbasedon't use titanhide on your main system.

    • X0rby
      X0rby

      Even if you do everything correctly it can crush your system and give you a blue screen, not that only but as I already told you in the past you MUST create a VM dedicated only to RCE, not your main e

    Posted Images

    11 minutes ago, boot said:

    This is normal, as I mentioned, you need to load the 32-bit driver on the 32-bit system. If loading on the 64-bit system, this prompt will appear.

    @boot Many thanks.

    Regards.

    sean.

    Edited by windowbase
    editing some words.

    • Like 1
    6 minutes ago, windowbase said:

     

    Regards.

    sean.

    No. You can still debug x86 vmp, on 64-bit systems. :)

    All you need is:

    1. Load the 64-bit driver provided by me

    2. Copy .dp32 to the plugins folder of x32Dbg

    • Thanks 1
    2 minutes ago, boot said:

    No. You can still debug x86 vmp, on 64-bit systems. :)

    All you need is:

    1. Load the 64-bit driver provided by me

    2. Copy .dp32 to the plugins folder of x32Dbg

     

    • Like 1
    19 minutes ago, boot said:

    No. You can still debug x86 vmp, on 64-bit systems. :)

    All you need is:

    1. Load the 64-bit driver provided by me

    2. Copy .dp32 to the plugins folder of x32Dbg

    @boot Did you modify source code of driver and plugin, then recompile them?

    How many lines of code did you modify?

    Regards.

    sean.

    Edited by windowbase
    editing some words.

    • Like 1
    13 minutes ago, windowbase said:

    @boot Did you modify source code of driver and plugin, then recompile them?

    How many lines of code did you modify?

    Regards.

    sean.

    Just simply modified some configurations and recompiled.

    If you really need to load the 32-bit driver, you can go to this website to download the original .iso of the 32-bit system, and create a new virtual machine to install new .iso.

    https://msdn.itellyou.cn/

    After testing, this driver and plug-in can debug x86 vmp in WinXP (32-bit).

    Note: 32-bit systems cannot load 64-bit drivers and cannot run 64-bit programs.

    • Like 1
    2 minutes ago, boot said:

    Just simply modified some configurations and recompiled.

    If you really need to load the 32-bit driver, you can go to this website to download the original .iso of the 32-bit system, and create a new virtual machine to install new .iso.

    https://msdn.itellyou.cn/

    After testing, this driver and plug-in can debug x86 vmp in WinXP (32-bit).

    Note: 32-bit systems cannot load 64-bit drivers and cannot run 64-bit programs.

    Many thanks.

    Regards.

    sean.

    • Like 2
    7 hours ago, windowbase said:

    @boot Why isn't it working in the same OS? View this.

    https://youtu.be/0lFi6oaC6wA

    Regards.

    sean.

    It's really strange. Please try this, I'm not sure if it's suitable for your OS.

    MyDrv_Plugin_v0.003.zip

    • Thanks 1
    5 hours ago, boot said:

    It's really strange. Please try this, I'm not sure if it's suitable for your OS.

    MyDrv_Plugin_v0.003.zip 312.95 kB · 7 downloads

    @boot It is working in virtual machine windows 10 pro. but not in the real machine as you have seen.

    And when I set breakpoints before application starts, does vmprotect detect them?

    view this.

    https://youtu.be/77fqhFBjw0M

    Regards.

    sean.

    Edited by windowbase
    editing words.

    • Like 1

    This topic is interesting i worked before on two apps which very hard to run in the debugger, so I'll share them here for educational purposes to play with and enjoy ;)

    difficulty 5/10


    Rogue.exe

    difficulty 7/10

    Safari.exe

    Edited by RADIOX

    • Like 1

    Safari.exe is silently crashing (run without debugger), from crash dump:

    image.png.e820588a932926a3a45d0b7f7ef96739.png

    Rogue.exe  is a regular Themida protted app?

    image.png.5cd6166e34e92703e217afaf6d9bd440.png

    Edited by jackyjask

    • Like 1
    12 minutes ago, jackyjask said:

    Safari.exe is silently crashing (run without debugger), from crash dump:

    image.png.e820588a932926a3a45d0b7f7ef96739.png

    Rogue.exe  is a regular Themida protted app?

    image.png.5cd6166e34e92703e217afaf6d9bd440.png

    Right. rogue.exe is themida protected application. bypassed.

    but Safari.exe is silently terminated.

    screenshot_1.png.7255ffa3b65865605217a6719a3641bb.pngscreenshot_2.png.bf6d0071ae99ae464da2525aab9edfef.png

    Regards.

    sean.

    Edited by windowbase
    editing words.

    • Like 1

    @RADIOX what is so special about safari.exe, does it work in your case? does it have some pre-conditions?

    1 hour ago, windowbase said:

    Rogue.exe  is a regular Themida protted app?

    is not a regular Themida app even if you use Titanhide the app will not run in the Debigger

     

    10 minutes ago, jackyjask said:

    what is so special about safari.exe

    this app is very interesting :
    to be sure you run this app correctly you should have an internet connection 

    image.png.6457cb242027da95d2606e9e9818f27f.png

    which interesting about this app, changes its name after each successful run :
     

    image.png.7c1fbbde23918a55b9723b58117149f8.png

    • Like 1
    1 hour ago, RADIOX said:

    is not a regular Themida app even if you use Titanhide the app will not run in the Debigger

     

    this app is very interesting :
    to be sure you run this app correctly you should have an internet connection 

    image.png.6457cb242027da95d2606e9e9818f27f.png

    which interesting about this app, changes its name after each successful run :
     

    image.png.7c1fbbde23918a55b9723b58117149f8.png

    @RADIOX Is there any way to run the application in the debugger?

    Regards.

    sean.

    • Like 2
    18 hours ago, RADIOX said:

    is not a regular Themida app even if you use Titanhide the app will not run in the Debigger

     

    this app is very interesting :
    to be sure you run this app correctly you should have an internet connection 

    image.png.6457cb242027da95d2606e9e9818f27f.png

    which interesting about this app, changes its name after each successful run :
     

    image.png.7c1fbbde23918a55b9723b58117149f8.png

    This is hard too. try it. it is a vmprotected sample.

    IMPOSSIBLE.rar

    Regards.

    sean.

     

    • Like 1
    1 hour ago, windowbase said:

    it is a vmprotected sample.

    It's not. It's protected with a Chinese tool call TianYi T-VMProtect.

    While TianYi T-VMProtect claims to be based on VMProtect, the protection methods have been changed (I intentionally don't use a word "improved", as Chinese tools often sacrifice compatibility to gain additional "protection").

     

    • Like 1
    18 minutes ago, kao said:

    It's not. It's protected with a Chinese tool call TianYi T-VMProtect.

    While TianYi T-VMProtect claims to be based on VMProtect, the protection methods have been changed (I intentionally don't use a word "improved", as Chinese tools often sacrifice compatibility to gain additional "protection").

     

    Is it on the web? it doesn't seem to be any download link on the web.

    Regards.

    sean.

    • Like 1
    7 hours ago, windowbase said:

    This is hard too. try it. it is a vmprotected sample.

    • Like 1
    17 minutes ago, X0rby said:

    @X0rby Just showing off?

    Regards.

    sean.

    • Like 1
    • Haha 1

    Create an account or sign in to comment

    Go to topic listing

    Configure browser push notifications
    Chrome (Android)
    1. Tap the lock icon next to the address bar.
    2. Tap Permissions → Notifications.
    3. Adjust your preference.
    Chrome (Desktop)
    1. Click the padlock icon in the address bar.
    2. Select Site settings.
    3. Find Notifications and adjust your preference.