VMProtect v3.8.1 Ultra (Mutation + Virtualization)

[X0rby]

View File

VMProtect v3.8.1 Ultra (Mutation + Virtualization)

---

The target is an old software (from 2010) coded in c++, I just apply the VMP protection without any special code as I show in the two screenshots. All available protection features in VMProtect were used with this unpackme. Refer to the attached images for the specific protection settings used.

Challenge is to unpack the file, providing an explanation and details on your methodology.

---

• Submitter
  X0rby
• Submitted
  04/18/2023
• Category
  UnPackMe

 

[The Binary Expert]

It's hard to me. the entry codes are virtualized and mutated and even without titanhide kernel mode anti-debug utility. I can't debug it cause of the vmprotect's anti-debug techniques.

Edited June 7, 2023 by windowbase
editing some words.

[X0rby]

Reminder: this one is still unpacked.

[nova789]

Hmm the code is made in c++, one question if it was an .exe made in .net and protected with VMP 3.8.1 would it have been easy?

[X0rby]

5 hours ago, nova789 said:

 one question if it was an .exe made in .net and protected with VMP 3.8.1 would it have been easy?

Yes, I think so - the unpacking of NATIVE APPS is always harder than .NET

[X0rby]

After the leak of VMP source code it can be done now...

[X0rby]

Unpacked+devirtualized:

unpacked.exe

Cleaned (vmp 100% removed):

cleaned.exe

Edited April 2 by X0rby

[The Binary Expert]

11 hours ago, X0rby said:

Unpacked+devirtualized:

unpacked.exe 28.66 MB · 11 downloads

Cleaned (vmp 100% removed):

cleaned.exe 202 kB · 14 downloads

Please record the process and post it, so we can get benefit from you.

Regards.

sean.

[Oliver]

13 hours ago, X0rby said:

Unpacked+devirtualized:

unpacked.exe 28.66 MB · 31 downloads

Cleaned (vmp 100% removed):

cleaned.exe 202 kB · 35 downloads

 @X0rby bro please share the method instead of sharing unpacked files.

Regards.

[htmlsqldz]

@X0rbyplease share the method

 

[ra1n]

Lack of any explanation whatsoever, likely the author just ripped code directly from the source of the original program; which they clearly have access to given the details of the post. For those of you seeking guidance, I'd look elsewhere (old but gold).