From a0dca0bc5bf43147e4c4f3ef09434660d7d5f81e Mon Sep 17 00:00:00 2001 From: _xeroxz Date: Wed, 16 Jun 2021 13:47:14 -0700 Subject: [PATCH] working on readme's and new profiles... --- ADD_VMP2_INSTR.md | 3 +++ README.md | 57 +++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 60 insertions(+) create mode 100644 ADD_VMP2_INSTR.md diff --git a/ADD_VMP2_INSTR.md b/ADD_VMP2_INSTR.md new file mode 100644 index 0000000..2b3b0c4 --- /dev/null +++ b/ADD_VMP2_INSTR.md @@ -0,0 +1,3 @@ +# Introduction + +This page contains the steps needed to add additional VMProtect 2 virtual instruction profiles to VMProfiler. Understand that these instructions are for version 1.8 and may be different in later versions. \ No newline at end of file diff --git a/README.md b/README.md index 3f63fe4..e13a121 100644 --- a/README.md +++ b/README.md @@ -117,6 +117,63 @@ vm::util::print( vmctx.vm_entry ); > 0x00007FF7911A7954 jmp rdx ``` +You can also loop through all vm handlers easily. Below is an example of looping through the vm handler vector inside of `vm::ctx_t::vm_handlers`. + +```cpp +for ( auto idx = 0u; idx < vmctx.vm_handlers.size(); ++idx ) +{ + std::printf( "======================== [%s #%d] ========================\n", + vmctx.vm_handlers[ idx ].profile ? vmctx.vm_handlers[ idx ].profile->name : "UNK", idx ); + + vm::util::print( vmctx.vm_handlers[ idx ].instrs ); + + // if there is no imm then there are no transforms... + if ( !vmctx.vm_handlers[ idx ].imm_size ) + { + std::puts( "\n" ); + continue; + } + + std::puts( "======================== [transforms] ========================\n" ); + for ( auto &[ mnemonic, instr ] : vmctx.vm_handlers[ idx ].transforms ) + { + if ( instr.mnemonic == ZYDIS_MNEMONIC_INVALID ) + continue; + + vm::util::print( instr ); + } + std::puts( "\n" ); +} +``` + +***Output*** + +``` +... + +======================== [LCONSTBZXW #253] ======================== +> 0x00007FF6DEA85C2C and al, 0x45 +> 0x00007FF6DEA85C2E movzx eax, byte ptr [rsi] +> 0x00007FF6DEA85C82 add al, bl +> 0x00007FF6DEA85C85 add al, 0xD3 +> 0x00007FF6DEA86FC7 not al +> 0x00007FF6DEA84D23 inc al +> 0x00007FF6DEA85633 add bl, al +> 0x00007FF6DEA853D5 sub rsi, 0xFFFFFFFFFFFFFFFF +> 0x00007FF6DEA85CD1 sub rbp, 0x02 +> 0x00007FF6DEA862F8 mov [rbp], ax +> 0x00007FF6DEA844A7 rol ah, 0x07 +======================== [transforms] ======================== + +add al, bl +add al, 0xD3 +not al +inc al +add bl, al + +... +``` + ### License & Copyright Copyright (c) 2021 _xeroxz, Independent Researcher @back.engineering