From f252173d7c3d8b237f9055033a9392f594ee5915 Mon Sep 17 00:00:00 2001 From: John Doe Date: Tue, 21 Dec 2021 01:24:19 -0800 Subject: [PATCH] added some docs to vmctx... updated test code... --- include/vmctx.hpp | 8 ++++++++ tests/vm_entry_test/src/main.cpp | 4 ++-- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/include/vmctx.hpp b/include/vmctx.hpp index aad3163..5877f89 100644 --- a/include/vmctx.hpp +++ b/include/vmctx.hpp @@ -12,7 +12,15 @@ class vmctx_t { const std::uintptr_t m_module_base, m_image_base, m_vm_entry_rva, m_image_size; + /// + /// m_vip and m_vsp are volitile and are subject to change... they are set to + /// the ones used in vm enter but can be changed by external source code... + /// zydis_register_t m_vip, m_vsp; + + /// + /// the virtual machine enter flattened and deobfuscated... + /// zydis_routine_t m_vm_entry; }; } // namespace vm \ No newline at end of file diff --git a/tests/vm_entry_test/src/main.cpp b/tests/vm_entry_test/src/main.cpp index 1bc52cb..c78b147 100644 --- a/tests/vm_entry_test/src/main.cpp +++ b/tests/vm_entry_test/src/main.cpp @@ -109,10 +109,10 @@ int __cdecl main(int argc, const char* argv[]) { } vm::utils::print(vmctx.m_vm_entry); - std::printf("> Virtual Instruction Pointer Register: %s\n", + std::printf("> Starting Virtual Instruction Pointer Register: %s\n", ZydisRegisterGetString(vmctx.m_vip)); - std::printf("> Virtual Stack Pointer Register: %s\n", + std::printf("> Starting Virtual Stack Pointer Register: %s\n", ZydisRegisterGetString(vmctx.m_vsp)); // testing vmlocate port for vmp3...