From c3c815b1d43ec86392648bcd78dd458b892933bb Mon Sep 17 00:00:00 2001 From: _xeroxz Date: Wed, 16 Jun 2021 20:50:45 +0000 Subject: [PATCH] Update ADD_VMP2_INSTR.md --- ADD_VMP2_INSTR.md | 31 ++++++++++++++++++++++++++++++- 1 file changed, 30 insertions(+), 1 deletion(-) diff --git a/ADD_VMP2_INSTR.md b/ADD_VMP2_INSTR.md index 2b3b0c4..0fbfcc3 100644 --- a/ADD_VMP2_INSTR.md +++ b/ADD_VMP2_INSTR.md @@ -1,3 +1,32 @@ # Introduction -This page contains the steps needed to add additional VMProtect 2 virtual instruction profiles to VMProfiler. Understand that these instructions are for version 1.8 and may be different in later versions. \ No newline at end of file +This page contains the steps needed to add additional VMProtect 2 virtual instruction profiles to VMProfiler. Understand that these instructions are for version 1.8 and may be different in later versions. + +# Example - Existing Profile + +Consider the `ADDQ` profile which is displayed below which can be found inside of `add.cpp` + +```cpp +vm::handler::profile_t addq = { + // ADD [RBP+8], RAX + // PUSHFQ + // POP [RBP] + "ADDQ", + ADDQ, + NULL, + { { // ADD [RBP+8], RAX + []( const zydis_decoded_instr_t &instr ) -> bool { + return instr.mnemonic == ZYDIS_MNEMONIC_ADD && instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_MEMORY && + instr.operands[ 0 ].mem.base == ZYDIS_REGISTER_RBP && + instr.operands[ 0 ].mem.disp.value == 0x8 && + instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_REGISTER && + instr.operands[ 1 ].reg.value == ZYDIS_REGISTER_RAX; + }, + // PUSHFQ + []( const zydis_decoded_instr_t &instr ) -> bool { return instr.mnemonic == ZYDIS_MNEMONIC_PUSHFQ; }, + // POP [RBP] + []( const zydis_decoded_instr_t &instr ) -> bool { + return instr.mnemonic == ZYDIS_MNEMONIC_POP && instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_MEMORY && + instr.operands[ 0 ].mem.base == ZYDIS_REGISTER_RBP; + } } } }; +``` \ No newline at end of file