vmp2
/
vmprofiler-cli
3
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Merge branch 'dev' into 'master'

Browse Source 
added vmp2 v4 parsing...

See merge request vmp2/vmprofiler-cli!5
merge-requests/6/merge
_xeroxz 3 years ago
parent 684ebc93c1 eb74df5c0f
commit 81538a1d54
3 changed files with 67 additions and 58 deletions
Show Stats Download Patch File Download Diff File

3
cmake.toml
Unescape View File

@ -2,13 +2,14 @@
name = "vmprofiler-cli" name = "vmprofiler-cli"
[subdir.dependencies] [subdir.dependencies]
[target.vmprofiler-cli] [target.vmprofiler-cli]
type = "executable" type = "executable"
sources = [ sources = [
"src/main.cpp", "src/main.cpp",
"src/icon.rc" "src/icon.rc"
] ]
link-libraries = [ link-libraries = [
"cli-parser", "cli-parser",
"xtils", "xtils",

2
dependencies/vmprofiler vendored

@ -1 +1 @@
Subproject commit 16aeb2d6d48c4822b89497ad660911eb0f5e54bd Subproject commit be144629075d10eceebbea30361d1b6c96512c01

120
src/main.cpp
Unescape View File

@ -9,8 +9,7 @@
int __cdecl main( int argc, const char *argv[] ) int __cdecl main( int argc, const char *argv[] )
{ {
argparse::argument_parser_t parser( "vmprofiler-cli", "virtual instruction pseudo code generator" ); argparse::argument_parser_t parser( "vmprofiler-cli", "virtual machine information inspector" );
parser.add_argument().names( { "--bin", "--vmpbin" } ).description( "unpacked binary protected with VMProtect 2" ); parser.add_argument().names( { "--bin", "--vmpbin" } ).description( "unpacked binary protected with VMProtect 2" );
parser.add_argument().names( { "--vmentry", "--entry" } ).description( "rva to push prior to a vm_entry" ); parser.add_argument().names( { "--vmentry", "--entry" } ).description( "rva to push prior to a vm_entry" );
parser.add_argument().name( "--showhandlers" ).description( "show all vm handlers..." ); parser.add_argument().name( "--showhandlers" ).description( "show all vm handlers..." );
@ -23,9 +22,12 @@ int __cdecl main( int argc, const char *argv[] )
.name( "--scanfortables" ) .name( "--scanfortables" )
.description( "scans all executable sections for vm handler tables..." ); .description( "scans all executable sections for vm handler tables..." );
parser.add_argument() parser.add_argument()
.name( "--showblockinstrs" ) .name( "--showvirtinstrs" )
.description( "show the virtual instructions of a specific code block..." ); .description( "show the virtual instructions of a specific virtual routine..." );
parser.add_argument().name( "--showallblocks" ).description( "shows all information for all code blocks..." ); parser.add_argument().name( "--showallrtns" ).description( "shows all information for all virtual routines..." );
parser.add_argument()
.name( "--rtnaddr" )
.description( "rva of the virtualized routine to apply another action upon such as --showallblocks..." );
parser.enable_help(); parser.enable_help();
auto err = parser.parse( argc, argv ); auto err = parser.parse( argc, argv );
@ -186,77 +188,83 @@ int __cdecl main( int argc, const char *argv[] )
return -1; return -1;
} }
const auto file_header = reinterpret_cast< vmp2::v3::file_header * >( vmp2file.data() ); const auto file_header = reinterpret_cast< vmp2::v4::file_header * >( vmp2file.data() );
if ( file_header->version != vmp2::version_t::v3 ) if ( file_header->version != vmp2::version_t::v4 )
{ {
std::printf( "[!] invalid vmp2 file version... this build uses v3...\n" ); std::printf( "[!] invalid vmp2 file version... this build uses v3...\n" );
return -1; return -1;
} }
auto first_block = reinterpret_cast< vmp2::v3::code_block_t * >( reinterpret_cast< std::uintptr_t >( file_header ) + auto first_rtn = reinterpret_cast< vmp2::v4::rtn_t * >( reinterpret_cast< std::uintptr_t >( file_header ) +
file_header->code_block_offset ); file_header->rtn_offset );
if ( parser.exists( "showallblocks" ) ) if ( parser.exists( "showallrtns" ) )
{ {
for ( auto [ code_block, code_block_num ] = std::tuple{ first_block, 0u }; for ( auto [ rtn_block, rtn_idx ] = std::pair{ first_rtn, 0ull }; rtn_idx < file_header->rtn_count;
code_block_num < file_header->code_block_count; ++rtn_idx, rtn_block = reinterpret_cast< vmp2::v4::rtn_t * >(
code_block = reinterpret_cast< vmp2::v3::code_block_t * >( reinterpret_cast< std::uintptr_t >( rtn_block ) + rtn_block->size ) )
reinterpret_cast< std::uintptr_t >( code_block ) + code_block->next_block_offset ),
++code_block_num )
{ {
std::printf( "[rtn_0x%p] number of code blocks = %d\n", rtn_block->code_blocks[ 0 ].vip_begin,
rtn_block->code_block_count );
std::printf( "[code block #%d] begin = 0x%p, virtual instruction count = %d\n", code_block_num, for ( auto [ code_block, block_idx ] = std::pair{ &rtn_block->code_blocks[ 0 ], 0ull };
ABS_TO_IMG( code_block->vip_begin, file_header->module_base, file_header->image_base ), block_idx < rtn_block->code_block_count;
code_block->vinstr_count ); ++block_idx, code_block = reinterpret_cast< vmp2::v4::code_block_t * >(
reinterpret_cast< std::uintptr_t >( code_block ) + code_block->next_block_offset ) )
if ( code_block->jcc.has_jcc ) {
std::printf( std::printf( " [blk_0x%p] number of virtual instructions = %d\n", code_block->vip_begin,
"\tcode block branches to 0x%p and 0x%p\n", code_block->vinstr_count );
ABS_TO_IMG( code_block->jcc.block_addr[ 0 ], file_header->module_base, file_header->image_base ), }
ABS_TO_IMG( code_block->jcc.block_addr[ 1 ], file_header->module_base, file_header->image_base ) );
} }
} }
if ( parser.exists( "showblockinstrs" ) ) if ( parser.exists( "showvirtinstrs" ) && parser.exists( "rtnaddr" ) )
{ {
const auto block_img_addr = parser.get< std::string >( "showblockinstrs" ); auto rtn_addr = std::stoull( parser.get< std::string >( "rtnaddr" ).c_str(), nullptr, 16 );
for ( auto [ rtn_block, rtn_idx ] = std::pair{ first_rtn, 0ull }; rtn_idx < file_header->rtn_count;
for ( auto [ code_block, code_block_num ] = std::tuple{ first_block, 0u }; ++rtn_idx, rtn_block = reinterpret_cast< vmp2::v4::rtn_t * >(
code_block_num < file_header->code_block_count; reinterpret_cast< std::uintptr_t >( rtn_block ) + rtn_block->size ) )
code_block = reinterpret_cast< vmp2::v3::code_block_t * >(
reinterpret_cast< std::uintptr_t >( code_block ) + code_block->next_block_offset ),
++code_block_num )
{ {
if ( ABS_TO_IMG( code_block->vip_begin, file_header->module_base, file_header->image_base ) == if ( rtn_block->code_blocks[ 0 ].vip_begin == rtn_addr )
std::strtoull( block_img_addr.c_str(), nullptr, 16 ) )
{ {
std::printf( "[code block #%d] begin = 0x%p, virtual instruction count = %d\n", code_block_num, for ( auto [ code_block, block_idx ] = std::pair{ &rtn_block->code_blocks[ 0 ], 0ull };
ABS_TO_IMG( code_block->vip_begin, file_header->module_base, file_header->image_base ), block_idx < rtn_block->code_block_count;
code_block->vinstr_count ); ++block_idx, code_block = reinterpret_cast< vmp2::v4::code_block_t * >(
reinterpret_cast< std::uintptr_t >( code_block ) +
std::printf( "> -----------------------------------------------------------------------\n" ); code_block->next_block_offset ) )
std::printf( "> opcode | virtual instructions | virtual instruction pointer\n" );
std::printf( "> -----------------------------------------------------------------------\n" );
for ( auto idx = 0u; idx < code_block->vinstr_count; ++idx )
{ {
const auto vinstr = &code_block->vinstr[ idx ]; std::printf( "[blk_0x%p] number of virtual instructions = %d\n", code_block->vip_begin,
const auto vm_profile = vm::handler::get_profile( vinstr->mnemonic_t ); code_block->vinstr_count );
if ( vinstr->operand.has_imm )
{ std::printf( "> -----------------------------------------------------------------------\n" );
std::printf( std::printf( "> opcode | virtual instructions | virtual instruction pointer\n" );
"> %-6x | %-15s %-15p | 0x%p\n", vinstr->opcode, vm_profile ? vm_profile->name : "UNK", std::printf( "> -----------------------------------------------------------------------\n" );
vinstr->operand.imm.u,
ABS_TO_IMG( vinstr->trace_data.vip, file_header->module_base, file_header->image_base ) ); auto block_vinstrs = reinterpret_cast< vm::instrs::virt_instr_t * >(
} reinterpret_cast< std::uintptr_t >( code_block ) + sizeof vmp2::v4::code_block_t +
else ( code_block->num_block_addrs * 8 ) );
for ( auto idx = 0u; idx < code_block->vinstr_count; ++idx )
{ {
std::printf( const auto vinstr = &block_vinstrs[ idx ];
"> %-6x | %-32s | 0x%p\n", vinstr->opcode, vm_profile ? vm_profile->name : "UNK", const auto vm_profile = vm::handler::get_profile( vinstr->mnemonic_t );
ABS_TO_IMG( vinstr->trace_data.vip, file_header->module_base, file_header->image_base ) ); if ( vinstr->operand.has_imm )
{
std::printf( "> %-6x | %-15s %-15p | 0x%p\n", vinstr->opcode,
vm_profile ? vm_profile->name : "UNK", vinstr->operand.imm.u,
ABS_TO_IMG( vinstr->trace_data.vip, file_header->module_base,
file_header->image_base ) );
}
else
{
std::printf( "> %-6x | %-32s | 0x%p\n", vinstr->opcode,
vm_profile ? vm_profile->name : "UNK",
ABS_TO_IMG( vinstr->trace_data.vip, file_header->module_base,
file_header->image_base ) );
}
} }
} }
break;
} }
} }
} }

Write Preview
Loading…
Cancel
Save