From 8a0870607ef8d82cb74bdb97331ec41d5f2e67c7 Mon Sep 17 00:00:00 2001 From: _xeroxz Date: Wed, 2 Jun 2021 22:14:46 -0700 Subject: [PATCH] able to staticlly determine if a code block has a virtual JCC or not, also staticlly decrypt the addresses of both branches... >:) --- dependencies/vmprofiler | 2 +- src/main.cpp | 10 ++++++++++ 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/dependencies/vmprofiler b/dependencies/vmprofiler index ffd45ec..cf40312 160000 --- a/dependencies/vmprofiler +++ b/dependencies/vmprofiler @@ -1 +1 @@ -Subproject commit ffd45ecb8a6a6a5d066a9b5e96c878ed9e09e243 +Subproject commit cf403125643ac1e23391a36a3d8f484b33546a1f diff --git a/src/main.cpp b/src/main.cpp index dd728f7..0162192 100644 --- a/src/main.cpp +++ b/src/main.cpp @@ -65,4 +65,14 @@ int __cdecl main( int argc, const char *argv[] ) std::printf( "[!] something failed during tracing, review the console for more information...\n" ); std::printf( "> number of blocks = %d\n", code_blocks.size() ); + for ( auto &code_block : code_blocks ) + { + std::printf( "> code block starts at = %p\n", code_block.vip_begin ); + std::printf( "> number of virtual instructions = %d\n", code_block.vinstrs.size() ); + std::printf( "> does this code block have a jcc? %s\n", code_block.jcc.has_jcc ? "yes" : "no" ); + + if ( code_block.jcc.has_jcc ) + std::printf( "> branch 1 = %p, branch 2 = %p\n", code_block.jcc.block_rva[ 0 ], + code_block.jcc.block_rva[ 1 ] ); + } }