vmp2
/
um-hook
3
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
VMProtect 2 Usermode Virtual Instruction Hook Demo
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
7 Commits
1 Branch
2 Tags
10 MiB
 
 
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from 'aa3eccfe20'
${ noResults }
Go to file
_xeroxz aa3eccfe20
Update README.md 		4 years ago
dependencies added ref builds and dependencies 4 years ago
refbuilds added ref builds and dependencies 4 years ago
src added a git ignore and fixed dependencies 4 years ago
.gitignore added ref builds and dependencies 4 years ago
.gitmodules added ref builds and dependencies 4 years ago
LICENSE Add LICENSE 4 years ago
README.md Update README.md 4 years ago

README.md

um-tracer - Usermode Virtual Instruction Tracer Demo

um-trace is a demo project/repo which contains an example of how to create a runtime trace of a VMProtect'ed binary (VMProtect 2). The binaries in this repo are not packed for simplicity sake, however in later demo's I will be applying packing to the executable.

Contents

  • dependencies/ - this project is dependent on vmtracer.
  • refbuilds/ - binaries protected with ultra virtualization and no packing. These bins are for you to mess with!
  • src/ - source code for the usermode tracer.
    • vmptest/ - source code for the the test bins
    • um-tracer/ - source code for usermode tracer, includes a hook on LCONSTBZX.

Usage

First download the repo with git clone --recursive https://githacks.org/vmp2/um-tracer.git, then compile the um-tracer by opening demo.sln inside of src/. There should be an executable called um-tracer.exe in x64/Release. This tracer program is compiled for the first vmptest binary in the refbuilds directly.

To create a trace file simply run the following:

um-tracer.exe --bin vmptest.vmp.exe --table 0x6473 --base 0x140000000 --out test.vmp2