VMProtect v3.4.0.1155

[whoknows]

View File

VMProtect v3.4.0.1155

---

Try to unpack or alternatively provide a serial. If there is no solution provided by Saturday 11am (GMT+0) I will attach the same without debugger detection.

Protections used:

• Debugger detection (User-mode + Kernel-mode)
• Ultra (Mutation + Virtualization)

Disabled protections:

• Virtual Machine
• Packer

---

• Submitter
  whoknows
• Submitted
  05/19/2020
• Category
  UnPackMe (.NET)

 

Edited May 21, 2020 by whoknows

[Reza-HNA]

they've done a really nice job!

valid key:

Spoiler

AQIDBAUGBwgJCgsMDQ4PEBESExQVFhcYGRobHB0eHyALFitASwYHCAkKCwwNDg8QERITFBUWFxgZGhscHR4fIGHRcMBz6P0wXIZTrWJI90jLU8o6lxAeWJxxcF1s2xwm

how:

simply you need to figure out how VM read instructions/Eh etc and restore them. devirtualizing all .net targets are the same so try to write a devirtualizer for simple VM and learn how to deal with them.
some other info you can find here & here.

awesome.vmp-devirtualized.exe

Edited May 21, 2020 by Reza-HNA

[CodeExplorer]

@Reza-HNA, with all the respect there isn't any tutorial on how you did it.

 

[whoknows]

@Reza-HNA shared the solution through PM, restore body method and decrypt the string.

Edited May 22, 2020 by whoknows

[Reza-HNA]

@CodeExplorer hi, added some info

[Teddy Rogers]

10 hours ago, Reza-HNA said:

@CodeExplorer hi, added some info

That is still light on with detail and context. It basically links to a tool you used and someone else's post...

Ted.

[whoknows]

without debugger detection

awesome.vmp_nodbg.rar

[BlackHat]

On 5/21/2020 at 1:33 PM, whoknows said:

@Reza-HNA shared the solution through PM, restore body method and decrypt the string.

Can you explain bro little bit info regarding removing VMProtect Anti Tamper Remove and restoring Strings ? 

[whoknows]

asking me ? hope @Reza-HNA PM u.

[N0P/ribthegreat99]

16 hours ago, BlackHat said:

Can you explain bro little bit info regarding removing VMProtect Anti Tamper Remove and restoring Strings ? 

The anti-tamper method is virtualized, so yes you can remove anti-tamper but the app will crash every time because the anti-tamper check method is virtualized.

[system24]

Please share the solution through PM

[vietnguyen09]

You guys are amazing, VMProtect still the best? Which is better between DNGuard and VMProtect?

[bruhware2811]

Hey can somebody teach me how to unpack vmprotect for .net? I would be really thankful.

[MaslovKK]

awesome.vmp_dump-cleaned.exe

[BlackHat]

awesome_cracked.exe

My Solution Details - https://telegra.ph/VMP-Unpacking-11-02

VMP Unpacking - Telegraph.html

[kao]

@BlackHat: thank you, it's a nice tutorial!  

But could you please fix images in the tutorial, they are very small and unreadable?

[BlackHat]

5 hours ago, kao said:

@BlackHat: thank you, it's a nice tutorial!  

But could you please fix images in the tutorial, they are very small and unreadable?

 

This is a basic approach example apply on almost all tool protected using vmprotect as suggested by wwh1004 

 

Image 1 - 

Image 2 - 

 

 

Edited November 3, 2020 by BlackHat

[jezani]

Thank you

Edited September 16, 2022 by jezani

[phoenixdiag]

l have small exe l needed unpack code.. Posible?

[wavie]

thxx