#include #include #include #include #include #include #include #include int __cdecl main(int argc, const char* argv[]) { argparse::argument_parser_t parser( "vmprofiler-cli", "virtual instruction pseudo code generator"); parser.add_argument() .names({ "--bin", "--vmpbin" }) .description("unpacked binary protected with VMProtect 2") .required(true); parser.add_argument() .names({ "--vmentry", "--entry" }) .description("rva to push prior to a vm_entry") .required(true); parser.add_argument() .names({ "--imagebase", "--base" }) .description("image base from OptionalHeader::ImageBase") .required(true); parser.add_argument() .names({ "--vmtrace", "--trace" }) .description("a vmp2 file generated by a vmtracer"); parser.enable_help(); auto err = parser.parse(argc, argv); if (err) { std::cout << err << std::endl; return -1; } if (parser.exists("help")) { parser.print_help(); return 0; } const auto module_base = reinterpret_cast( LoadLibraryExA(parser.get("bin").c_str(), NULL, DONT_RESOLVE_DLL_REFERENCES)); const auto vm_entry_ptr = module_base + std::strtoull( parser.get("vmentry").c_str(), nullptr, 16); const auto image_base = std::strtoull( parser.get("imagebase").c_str(), nullptr, 16); zydis_routine_t vm_entry; std::printf("> vm entry start = 0x%p\n", vm_entry_ptr); if (!vm::util::flatten(vm_entry, vm_entry_ptr)) { std::printf("> failed to flatten vm entry...\n"); return -1; } vm::util::deobfuscate(vm_entry); std::printf("> flattened vm entry...\n"); std::printf("> deobfuscated vm entry...\n"); vm::util::print(vm_entry); const auto vm_handler_table = vm::handler::table::get(vm_entry); if (!vm_handler_table) { std::printf("> failed to locate vm handler table...\n"); return -1; } std::printf("> located vm handler table... at = 0x%p, rva = 0x%p\n", vm_handler_table, (reinterpret_cast(vm_handler_table) - module_base) + image_base); std::vector vm_handlers; if (!vm::handler::get_all(module_base, image_base, vm_entry, vm_handler_table, vm_handlers)) { std::printf("> failed to get all vm handler meta data...\n"); return -1; } for (auto idx = 0u; idx < vm_handlers.size(); ++idx) { auto vm_handler = vm_handlers[idx]; std::printf("==========[vm handler %s, idx = %d, imm size = %d]========\n", vm_handler.profile ? vm_handler.profile->name : "UNKNOWN", idx, vm_handler.imm_size); std::printf("================[vm handler instructions]==============\n"); vm::util::print(vm_handler.instrs); if (vm_handler.imm_size) { std::printf("=================[vm handler transforms]===============\n"); for (const auto& [transform_type, transform] : vm_handler.transforms) vm::util::print(transform); } std::printf("=======================================================\n\n"); } if (parser.exists("vmtrace")) { std::ifstream vmp2_file( parser.get("vmtrace").c_str(), std::ios::binary); const auto file_size = std::filesystem::file_size( parser.get("vmtrace").c_str()); const auto file_header = reinterpret_cast(malloc(file_size)); vmp2_file.read((char*)file_header, file_size); const auto entry_list = reinterpret_cast( reinterpret_cast( file_header) + file_header->entry_offset); std::printf("> module base = 0x%p\n", file_header->module_base); std::getchar(); vm::vmctx_t vmctx( file_header, entry_list, vm_handlers, module_base, image_base ); for (auto [virt_instr, log_entry] = vmctx.step(); log_entry && !virt_instr.empty(); std::tie(virt_instr, log_entry) = vmctx.step()) std::printf("> %s\n", virt_instr.c_str()); } std::printf("> finished...\n"); std::getchar(); }