From 1516e2a2783308b778109659cce62ea2d78e4c82 Mon Sep 17 00:00:00 2001 From: xtremegamer1 Date: Fri, 9 Dec 2022 18:36:03 -0700 Subject: [PATCH] changed deobfuscation to keep register jumps --- src/vminstrs.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/vminstrs.cpp b/src/vminstrs.cpp index feee8f2..329408b 100644 --- a/src/vminstrs.cpp +++ b/src/vminstrs.cpp @@ -69,7 +69,7 @@ void deobfuscate(hndlr_trace_t& trace) { break; } - if (vm::utils::is_jmp(itr->m_instr)) { + if (vm::utils::is_jmp(itr->m_instr) && itr->m_instr.operands[0].type != ZYDIS_OPERAND_TYPE_REGISTER) { uct_context_free(itr->m_cpu); trace.m_instrs.erase(itr); break;