Devitalizing vmprotect/themida and others will now become easier

[dfnctsc]

Anyone in the scene is probably already aware of this, and given that this section of the forum seems heavily unmoderated given that half the posts have absolutely nothing to do with reverse engineering, I doubt this post will be of use to more than maybe a couple people.

 

With that said, check out 

Please Login or Register to see this Hidden Content

 

If anyone wants to discuss VTIL and maybe even potential collaborations on developing some tools using it I would love to have that conversation.

 

Hope helps someone as it has helped me!

[FaithHF]

Funny you mention this -- over the last few days I was actually searching for ways to analyze VMProtect binaries and this was one of the projects that actually held my interest. It's sad that it's still just in alpha stages essentially, but seems to still be in somewhat active development (last commit two weeks ago.)

 

The only other option I found was the Unicorn Engine and specifically unicorn-pe which just emulates (as in emulating hardware by architecture, not virtualizing like a VM) the binary and uses Blackbone to find all the important data like the 'actual' entrypoint of the binary and a rebuilt IAT, allowing for better analysis in memory. Still quite a process, but much easier than it would have been a few years ago.

 

VTIL looks promising. I just hope the project doesn't die after the guy is done his PhD or whatever it's for. Main dev (can1357) also has more specific projects that use VTIL to break current VMP implementations, like NoVmp and vmpdump, or for kernel-level analysis, ByePg to disable patchguard. Guy knows what he's doing.

 

If there was some actual documentation for the project, then maybe I'd write something with it. But for the time being, I can barely make any sense of most of it. Take a look at the Unicorn Engine if you want something a little more mature for emulation of software that has 'some' documentation to work with.

[legrando]

very interesting

[AminRezaeian70]

Please check your PM sir.

Thanks