vmp2
/
vmprofiler-qt
3
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '7ba0e1dd67'
${ noResults }
vmprofiler-qt/README.md

1.2 KiB
Raw Blame History

vmprofiler-qt - VMProtect 2 QT Virtual Instruction Trace Inspector

vmprofiler-qt is a GUI program designed to view trace files generated by vmtracer programs. Currently um-tracer is the only program that will generate a trace file, however in the near future another repo will be added using unicorn to generate traces.

A trace is simply a file that contains all native register values, virtual stack values, virtual register values, for every single executed virtual instruction. This allows for very indepth analysis of the executed virtual instructions. Without this level of information it is very difficult to make sense of virtual instructions and the effects on the virtual stack.

Usage Requirements

In order to use vmprofiler-qt a few requirements must be met. When using the GUI make sure to have the following information ready:

  • vm_entry rva - the relative virtual address, from the base of the module, of vm_entry.
  • image base rva - the ImageBase value located inside of the optional PE header.
  • .vmp2 file - a trace file generated by vmtracer project such as um-tracer.
  • an unpacked VMProtect'ed binary which you know all of the above about (use vmprofiler-cli to locate the values you dont know).