Skip to content
This repository has been archived by the owner on Aug 27, 2022. It is now read-only.

Experimental disassembler for x86 binaries virtualized by VMProtect 3

Notifications You must be signed in to change notification settings

KiFilterFiberContext/VMP3-Disasm

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

5 Commits
 
 
 
 
 
 
 
 
 
 

Repository files navigation

VMProtect Disassembler

DISCLAIMER: VERY OLD CODE; NOT INTENDED FOR ACTUAL USE

Disassembler for x86 binaries virtualized by VMProtect 3

How?

Unlike NoVMP, this project attempts to lift VMProtect's virtual machine handlers into IL purely through instruction emulation using Triton. The procedure starts by emulating the VMINIT and recording the initial VM state, then proceeding to use this information to deobfuscate the rest of the VM handlers by tainting only relevant VM registers. The simplified VM handlers are converted to VM instructions by pattern matching certain instruction sequences then emulated to extract runtime information that is logged by the disassembler.

TODO

  • Handle VMINIT and VMEXIT handlers
  • Implement initial VM handler deobfuscator
  • Handle PE/ELF relocations and imports
  • Implement VM IL semantics to represent VM instruction
  • Implement VM IL optimizer (stuff like constant propagation, etc.)
  • Finish lifter for remaining VM handlers (VMPUSH, VMADD, VMDIV, etc.)
  • Handle virtual conditionals (likely to use Triton DSE)
  • Handle VM context swapping

References

About

Experimental disassembler for x86 binaries virtualized by VMProtect 3

Topics

Resources

Stars

Watchers

Forks