added test, added code to vmctx to get vip and vsp native register usage

out of a vm_enter... added some shit to vmutils like print
zydis_routine's...

include/vmctx.hpp

@@ -6,10 +6,13 @@ class vmctx_t {
  public:
   explicit vmctx_t(std::uintptr_t module_base,
                    std::uintptr_t image_base,
-                   std::uintptr_t vm_entry_rva,
-                   std::uintptr_t image_size);
+                   std::uintptr_t image_size,
+                   std::uintptr_t vm_entry_rva);
   bool init();
   const std::uintptr_t m_module_base, m_image_base, m_vm_entry_rva,
       m_image_size;
+
+  zydis_register_t m_vip, m_vsp;
+  zydis_routine_t m_vm_entry;
 };
 }  // namespace vm

include/vmutils.hpp

@@ -2,6 +2,7 @@
 #include <Zydis/Zydis.h>
 #include <algorithm>
 #include <cstdint>
+#include <fstream>
 #include <functional>
 #include <nt/image.hpp>
 #include <vector>
@@ -41,6 +42,24 @@ inline void init() {
   }
 }
 
+inline bool open_binary_file(const std::string& file,
+                             std::vector<uint8_t>& data) {
+  std::ifstream fstr(file, std::ios::binary);
+  if (!fstr.is_open())
+    return false;
+
+  fstr.unsetf(std::ios::skipws);
+  fstr.seekg(0, std::ios::end);
+
+  const auto file_size = fstr.tellg();
+
+  fstr.seekg(NULL, std::ios::beg);
+  data.reserve(static_cast<uint32_t>(file_size));
+  data.insert(data.begin(), std::istream_iterator<uint8_t>(fstr),
+              std::istream_iterator<uint8_t>());
+  return true;
+}
+
 /// <summary>
 /// determines if a given decoded native instruction is a JCC...
 /// </summary>
@@ -48,6 +67,19 @@ inline void init() {
 /// <returns></returns>
 bool is_jmp(const zydis_decoded_instr_t& instr);
 
+/// <summary>
+/// prints a disassembly view of a routine...
+/// </summary>
+/// <param name="routine">reference to a zydis_routine_t to be
+/// printed...</param>
+void print(zydis_routine_t& routine);
+
+/// <summary>
+/// prints a single disassembly view of an instruction...
+/// </summary>
+/// <param name="instr">instruction to print...</param>
+void print(const zydis_decoded_instr_t& instr);
+
 /// <summary>
 /// utils pertaining to native registers...
 /// </summary>

src/vmctx.cpp

@@ -3,10 +3,51 @@
 namespace vm {
 vmctx_t::vmctx_t(std::uintptr_t module_base,
                  std::uintptr_t image_base,
-                 std::uintptr_t vm_entry_rva,
-                 std::uintptr_t image_size)
+                 std::uintptr_t image_size,
+                 std::uintptr_t vm_entry_rva)
     : m_module_base(module_base),
       m_image_base(image_base),
       m_vm_entry_rva(vm_entry_rva),
       m_image_size(image_size) {}
+
+bool vmctx_t::init() {
+  // flatten and deobfuscate the vm entry...
+  if (!vm::utils::flatten(m_vm_entry, m_module_base + m_vm_entry_rva))
+    return false;
+
+  vm::utils::deobfuscate(m_vm_entry);
+
+  // find mov reg, [rsp+0x90]. this register will be VIP...
+  const auto vip_fetch = std::find_if(
+      m_vm_entry.begin(), m_vm_entry.end(),
+      [&](const zydis_instr_t& instr) -> bool {
+        return instr.instr.mnemonic == ZYDIS_MNEMONIC_MOV &&
+               instr.instr.operands[0].type == ZYDIS_OPERAND_TYPE_REGISTER &&
+               instr.instr.operands[1].type == ZYDIS_OPERAND_TYPE_MEMORY &&
+               instr.instr.operands[1].mem.base == ZYDIS_REGISTER_RSP &&
+               instr.instr.operands[1].mem.disp.value == 0x90;
+      });
+
+  if (vip_fetch == m_vm_entry.end())
+    return false;
+
+  m_vip = vip_fetch->instr.operands[0].reg.value;
+
+  // find the register that will be used for the virtual stack...
+  // mov reg, rsp...
+  const auto vsp_fetch = std::find_if(
+      m_vm_entry.begin(), m_vm_entry.end(),
+      [&](const zydis_instr_t& instr) -> bool {
+        return instr.instr.mnemonic == ZYDIS_MNEMONIC_MOV &&
+               instr.instr.operands[0].type == ZYDIS_OPERAND_TYPE_REGISTER &&
+               instr.instr.operands[1].type == ZYDIS_OPERAND_TYPE_REGISTER &&
+               instr.instr.operands[1].reg.value == ZYDIS_REGISTER_RSP;
+      });
+
+  if (vsp_fetch == m_vm_entry.end())
+    return false;
+
+  m_vsp = vsp_fetch->instr.operands[0].reg.value;
+  return true;
+}
 }  // namespace vm

src/vmutils.cpp

@@ -1,6 +1,21 @@
 #include <vmutils.hpp>
 
-namespace vm::locate {
+namespace vm::utils {
+void print(const zydis_decoded_instr_t& instr) {
+  char buffer[256];
+  ZydisFormatterFormatInstruction(vm::utils::g_formatter.get(), &instr, buffer,
+                                  sizeof(buffer), 0u);
+  std::puts(buffer);
+}
+
+void print(zydis_routine_t& routine) {
+  char buffer[256];
+  for (auto [instr, raw, addr] : routine) {
+    ZydisFormatterFormatInstruction(vm::utils::g_formatter.get(), &instr,
+                                    buffer, sizeof(buffer), addr);
+    std::printf("> %p %s\n", addr, buffer);
+  }
+}
 
 bool is_jmp(const zydis_decoded_instr_t& instr) {
   return instr.mnemonic >= ZYDIS_MNEMONIC_JB &&
@@ -208,4 +223,4 @@ bool executable(std::uint64_t module_base, std::uint64_t ptr) {
   return false;
 }
 }  // namespace scn
-}  // namespace vm::locate
+}  // namespace vm::utils

tests/vm_entry_test/src/main.cpp

@@ -1,6 +1,121 @@
-#include <vmprofiler.hpp>
 #include <cli-parser.hpp>
+#include <vmprofiler.hpp>
+
+int __cdecl main(int argc, const char* argv[]) {
+  argparse::argument_parser_t parser("VMEmu",
+                                     "VMProtect 3 VM Handler Emulator");
+  parser.add_argument()
+      .name("--vmentry")
+      .description("relative virtual address to a vm entry...")
+      .required(true);
+
+  parser.add_argument()
+      .name("--bin")
+      .description("path to unpacked virtualized binary...")
+      .required(true);
+
+  parser.enable_help();
+  auto result = parser.parse(argc, argv);
+
+  if (result) {
+    std::printf("[!] error parsing commandline arguments... reason = %s\n",
+                result.what().c_str());
+    return -1;
+  }
+
+  if (parser.exists("help")) {
+    parser.print_help();
+    return 0;
+  }
+
+  vm::utils::init();
+  std::vector<std::uint8_t> module_data, tmp, unpacked_bin;
+  if (!vm::utils::open_binary_file(parser.get<std::string>("bin"),
+                                   module_data)) {
+    std::printf("[!] failed to open binary file...\n");
+    return -1;
+  }
+
+  auto img = reinterpret_cast<win::image_t<>*>(module_data.data());
+  auto image_size = img->get_nt_headers()->optional_header.size_image;
+  const auto image_base = img->get_nt_headers()->optional_header.image_base;
+
+  // page align the vector allocation so that unicorn-engine is happy girl...
+  tmp.resize(image_size + 0x1000);
+  const std::uintptr_t module_base =
+      reinterpret_cast<std::uintptr_t>(tmp.data()) +
+      (0x1000 - (reinterpret_cast<std::uintptr_t>(tmp.data()) & 0xFFFull));
+
+  std::memcpy((void*)module_base, module_data.data(), 0x1000);
+  std::for_each(img->get_nt_headers()->get_sections(),
+                img->get_nt_headers()->get_sections() +
+                    img->get_nt_headers()->file_header.num_sections,
+                [&](const auto& section_header) {
+                  std::memcpy(
+                      (void*)(module_base + section_header.virtual_address),
+                      module_data.data() + section_header.ptr_raw_data,
+                      section_header.size_raw_data);
+                });
+
+  auto win_img = reinterpret_cast<win::image_t<>*>(module_base);
+
+  auto basereloc_dir =
+      win_img->get_directory(win::directory_id::directory_entry_basereloc);
+
+  auto reloc_dir = reinterpret_cast<win::reloc_directory_t*>(
+      basereloc_dir->rva + module_base);
+
+  win::reloc_block_t* reloc_block = &reloc_dir->first_block;
+
+  // apply relocations to all sections...
+  while (reloc_block->base_rva && reloc_block->size_block) {
+    std::for_each(reloc_block->begin(), reloc_block->end(),
+                  [&](win::reloc_entry_t& entry) {
+                    switch (entry.type) {
+                      case win::reloc_type_id::rel_based_dir64: {
+                        auto reloc_at = reinterpret_cast<std::uintptr_t*>(
+                            entry.offset + reloc_block->base_rva + module_base);
+                        *reloc_at = module_base + ((*reloc_at) - image_base);
+                        break;
+                      }
+                      default:
+                        break;
+                    }
+                  });
+
+    reloc_block = reloc_block->next();
+  }
+
+  std::printf("> image base = %p, image size = %p, module base = %p\n",
+              image_base, image_size, module_base);
+
+  if (!image_base || !image_size || !module_base) {
+    std::printf("[!] failed to open binary on disk...\n");
+    return -1;
+  }
+
+  const auto vm_entry_rva =
+      std::strtoull(parser.get<std::string>("vmentry").c_str(), nullptr, 16);
+
+  vm::vmctx_t vmctx(module_base, image_base, image_size, vm_entry_rva);
+
+  if (!vmctx.init()) {
+    std::printf(
+        "[!] failed to init vmctx... this can be for many reasons..."
+        " try validating your vm entry rva... make sure the binary is "
+        "unpacked and is"
+        "protected with VMProtect 3...\n");
+    return -1;
+  }
+
+  vm::utils::print(vmctx.m_vm_entry);
+  std::printf("> Virtual Instruction Pointer Register: %s\n",
+              ZydisRegisterGetString(vmctx.m_vip));
 
-int __cdecl main(int argc, char* argv[]) {
+  std::printf("> Virtual Stack Pointer Register: %s\n",
+              ZydisRegisterGetString(vmctx.m_vsp));
 
+  // testing vmlocate port for vmp3...
+  const auto vm_entries = vm::locate::get_vm_entries(module_base, image_size);
+  std::printf("> number of vm entries = %d\n", vm_entries.size());
 }