Jump to content
Tuts 4 You

An open source tool for analyzing vmp


fjqisba

Recommended Posts

Sean Park - Lovejoy
10 hours ago, fjqisba said:

Hi, everybody!

I am developing an ida plugin which can be used to analyze vmp3.5 x86.

If you are interested in vmp, Then you can view the source code of the project to learn it.

Suggestions and PRs are welcome.

https://github.com/fjqisba/VmpHelper

 

screenshot-54.png

 

An error!!! 

 

And for another example.

 

 

screenshot-54.png

 

Why does it just show one graph and no branches? but your github page shows like this.

 

graph.png

 

Regards.

sean.

  

Edited by Sean Park - Lovejoy
Link to comment
fjqisba
2 hours ago, Sean Park - Lovejoy said:

 

screenshot-54.png

 

An error!!! 

 

And for another example.

 

 

screenshot-54.png

 

Why does it just show one graph and no branches? but your github page shows like this.

 

graph.png

 

Regards.

sean.

  

Well, this is because it has not been fully developed yet.

you can try sending samples to me so I can fix it.

  • Like 1
Link to comment
Sean Park - Lovejoy
5 hours ago, fjqisba said:

Well, this is because it has not been fully developed yet.

you can try sending samples to me so I can fix it.

Win32GUI.vmp.zip

Regards.

sean.

Link to comment
fjqisba
24 minutes ago, Sean Park - Lovejoy said:

For current plugin, it seems too early to analyze vmp oep, because vmp does a lot of operations at the beginning.

Maybe you should try writing a small function, use vmp encryption, and then use plugin to analyze the begin of vmp function.

  • Like 1
Link to comment
Sean Park - Lovejoy
42 minutes ago, fjqisba said:

For current plugin, it seems too early to analyze vmp oep, because vmp does a lot of operations at the beginning.

Maybe you should try writing a small function, use vmp encryption, and then use plugin to analyze the begin of vmp function.

I virtualized below part and tested it.

 

004010C2 6A 01	push 01
004010C4 53	push ebx
004010C5 FF15 1C614000	call dword ptr [0040611C] → USER32.dll!EndDialog
004010CB EB 09	jmp 004010D6 ↓

 

It is cahnged to thses codes.

 

00A810C2           | E9 27BA1800      | JMP win32gui.vmp.C0CAEE                  |
00A810C7 <win32gui | 57               | PUSH EDI                                 | edi:EntryPoint
00A810C8           | C3               | RET                                      |
00A810C9 <win32gui | 56               | PUSH ESI                                 | esi:EntryPoint
00A810CA           | C3               | RET                                      |
00A810CB <win32gui | EB 09            | JMP win32gui.vmp.A810D6                  |

 

And I used your plugin by clicking the menu "VMP -> Show Graph" at the address of 00A810C2.

then It hung. the IDA version is 8.3.23.0608..

Regards.

sean.

  • Like 1
Link to comment
fjqisba
17 minutes ago, Sean Park - Lovejoy said:

I virtualized below part and tested it.

 

004010C2 6A 01	push 01
004010C4 53	push ebx
004010C5 FF15 1C614000	call dword ptr [0040611C] → USER32.dll!EndDialog
004010CB EB 09	jmp 004010D6 ↓

 

It is cahnged to thses codes.

 

00A810C2           | E9 27BA1800      | JMP win32gui.vmp.C0CAEE                  |
00A810C7 <win32gui | 57               | PUSH EDI                                 | edi:EntryPoint
00A810C8           | C3               | RET                                      |
00A810C9 <win32gui | 56               | PUSH ESI                                 | esi:EntryPoint
00A810CA           | C3               | RET                                      |
00A810CB <win32gui | EB 09            | JMP win32gui.vmp.A810D6                  |

 

And I used your plugin by clicking the menu "VMP -> Show Graph" at the address of 00A810C2.

then It hung. the IDA version is 8.3.23.0608..

Regards.

sean.

Well, the project is still a demo.

I updated the plugin and provided a program for my own testing,you can try that.

https://github.com/fjqisba/VmpHelper/releases

  • Thanks 1
Link to comment
Sean Park - Lovejoy
44 minutes ago, fjqisba said:

Well, the project is still a demo.

I updated the plugin and provided a program for my own testing,you can try that.

https://github.com/fjqisba/VmpHelper/releases

 

Now It works well but It takes some time to complete the job.

 

 

2024-04-19_184219.png.8548c3cc5baf5dac60c7d3f2389aadff.png

 

2024-04-19_183825.png.c812871f346df5e0f1feecc13916bdeb.png

 

Regards.

sean.

  • Like 1
Link to comment
Sean Park - Lovejoy
1 hour ago, jackyjask said:

@fjqisba  is GhidraVmp.dll  obsoleted and now one has to use Revampire.dll  instead?

@jackyjask maybe, we do not need it any more.

@fjqisba how does this IDA plugin help to analyze the vmprotect virtual machine?

 

2024-04-20_215403.png.cde903f60f17621d18eb6f0503612bd4.png

 

I do not know how to use this.

I will be really appreciated if you could explain about it.

Many thanks in advance.

Regards.

sean.

Link to comment
fjqisba
On 4/20/2024 at 8:58 PM, Sean Park - Lovejoy said:

@jackyjask maybe, we do not need it any more.

@fjqisba how does this IDA plugin help to analyze the vmprotect virtual machine?

 

2024-04-20_215403.png.cde903f60f17621d18eb6f0503612bd4.png

 

I do not know how to use this.

I will be really appreciated if you could explain about it.

Many thanks in advance.

Regards.

sean.

Maybe it helps you locate key branches.

The plugin is not finished yet,I think you can understand the principles and attack methods of vmp by looking at the source code

  • Thanks 1
Link to comment

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...