From f4513155a8c42c12fee3f7621199bbc23adb0d5b Mon Sep 17 00:00:00 2001 From: _xeroxz Date: Thu, 1 Jul 2021 00:21:19 +0000 Subject: [PATCH] Update README.md --- README.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 200ec0b..92443d6 100644 --- a/README.md +++ b/README.md @@ -27,7 +27,8 @@ Integrity checks outside of the VMProtect 2 virtual machine are not effected by *Side Note: Check out that len? its not aligned, this means you can patch the alignment/padding at the end of both of these sections if you wanted and the SHA1 integrity checks would be fine...* -Thus a hook is placed on this SHA1 hash function and spoofed results are computed... +Thus a hook is placed on this SHA1 hash function and spoofed results are computed... you can locate this function by searching for SHA1 magic numbers: 0x67452301, 0xEFCDAB89, 0x98BADCFE, 0x10325476, 0xC3D2E1F0... The SHA1 function should really be virtualized since these magic constant values can be located instantly... + ### Solution, Possible Alternatives