VMProfiler  v1.8
vmprofiler is a c++ library which is used to statically analyze VMProtect 2 polymorphic virtual machines. This project is inherited in vmprofiler-qt, vmprofiler-cli, and vmemu.
Variables
vm::handler::profile Namespace Reference

contains all profiles defined, as well as a vector of all of the defined profiles... More...

Variables

vm::handler::profile_t sregq
 
vm::handler::profile_t sregdw
 
vm::handler::profile_t sregw
 
vm::handler::profile_t lregq
 
vm::handler::profile_t lregdw
 
vm::handler::profile_t lconstq
 mov rax, [rsi] xor rax, rbx ; transformation bswap rax ; transformation lea rsi, [rsi+8] ; advance VIP… rol rax, 0Ch ; transformation inc rax ; transformation xor rbx, rax ; transformation (update rolling decrypt key) sub rbp, 8 mov [rbp+0], rax More...
 
vm::handler::profile_t lconstdw
 mov eax, [rsi-0x04] bswap eax add eax, ebx dec eax neg eax xor eax, 0x2FFD187C push rbx add [rsp], eax pop rbx sub rbp, 0x04 mov [rbp], eax add rsi, 0xFFFFFFFFFFFFFFFC More...
 
vm::handler::profile_t lconstw
 
vm::handler::profile_t lconstbzxw
 
vm::handler::profile_t lconstbsxdw
 
vm::handler::profile_t lconstbsxq
 
vm::handler::profile_t lconstdwsxq
 
vm::handler::profile_t lconstwsxq
 
vm::handler::profile_t lconstwsxdw
 
vm::handler::profile_t addq
 mov rax, [rbp+0] add [rbp+8], rax pushfq pop qword ptr [rbp+0] More...
 
vm::handler::profile_t adddw
 mov ax, [rbp] sub rbp, 0x06 add [rbp+0x08], ax pushfq pop [rbp] More...
 
vm::handler::profile_t addw
 
vm::handler::profile_t shlq
 
vm::handler::profile_t shldw
 
vm::handler::profile_t nandq
 
vm::handler::profile_t nanddw
 
vm::handler::profile_t nandw
 
vm::handler::profile_t writeq
 
vm::handler::profile_t writedw
 
vm::handler::profile_t writeb
 
vm::handler::profile_t readq
 
vm::handler::profile_t readdw
 
vm::handler::profile_t shrq
 
vm::handler::profile_t shrw
 
vm::handler::profile_t lrflags
 
vm::handler::profile_t call
 mov rdx, [rbp] add rbp, 0x08 call rdx More...
 
vm::handler::profile_t pushvsp
 
vm::handler::profile_t mulq
 
vm::handler::profile_t divq
 mov rdx, [rbp] mov rax, [rbp+0x08] div [rbp+0x10] mov [rbp+0x08], rdx mov [rbp+0x10], rax pushfq pop [rbp] More...
 
vm::handler::profile_t jmp
 mov esi, [rbp] add rbp, 0x08 lea r12, [0x0000000000048F29] mov rax, 0x00 ; image base bytes above 32bits... add rsi, rax mov rbx, rsi ; update decrypt key add rsi, [rbp] ; add module base address More...
 
vm::handler::profile_t lvsp
 mov rbp [rbp+0] More...
 
vm::handler::profile_t vmexit
 
std::vector< vm::handler::profile_t * > all
 a vector of pointers to all defined vm handler profiles... More...
 

Detailed Description

contains all profiles defined, as well as a vector of all of the defined profiles...

Variable Documentation

◆ adddw

vm::handler::profile_t vm::handler::profile::adddw
Initial value:
= {
"ADDDW",
ADDDW,
NULL,
{ {
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_ADD && instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_MEMORY &&
instr.operands[ 0 ].mem.base == ZYDIS_REGISTER_RBP &&
instr.operands[ 0 ].mem.disp.value == 0x8 &&
instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[ 1 ].reg.value == ZYDIS_REGISTER_EAX;
},
[]( const zydis_decoded_instr_t &instr ) -> bool { return instr.mnemonic == ZYDIS_MNEMONIC_PUSHFQ; },
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_POP && instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_MEMORY &&
instr.operands[ 0 ].mem.base == ZYDIS_REGISTER_RBP;
} } } }
vm::handler::ADDDW
@ ADDDW
Definition: vmprofiles.hpp:51
zydis_decoded_instr_t
ZydisDecodedInstruction zydis_decoded_instr_t
Definition: vmutils.hpp:18

mov ax, [rbp] sub rbp, 0x06 add [rbp+0x08], ax pushfq pop [rbp]

◆ addq

vm::handler::profile_t vm::handler::profile::addq
Initial value:
= {
"ADDQ",
ADDQ,
NULL,
{ {
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_ADD && instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_MEMORY &&
instr.operands[ 0 ].mem.base == ZYDIS_REGISTER_RBP &&
instr.operands[ 0 ].mem.disp.value == 0x8 &&
instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[ 1 ].reg.value == ZYDIS_REGISTER_RAX;
},
[]( const zydis_decoded_instr_t &instr ) -> bool { return instr.mnemonic == ZYDIS_MNEMONIC_PUSHFQ; },
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_POP && instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_MEMORY &&
instr.operands[ 0 ].mem.base == ZYDIS_REGISTER_RBP;
} } } }
vm::handler::ADDQ
@ ADDQ
Definition: vmprofiles.hpp:50

mov rax, [rbp+0] add [rbp+8], rax pushfq pop qword ptr [rbp+0]

◆ addw

vm::handler::profile_t vm::handler::profile::addw
Initial value:
= {
"ADDW",
ADDW,
NULL,
{ {
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_ADD && instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_MEMORY &&
instr.operands[ 0 ].mem.base == ZYDIS_REGISTER_RBP &&
instr.operands[ 0 ].mem.disp.value == 0x8 &&
instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[ 1 ].reg.value == ZYDIS_REGISTER_AX;
},
[]( const zydis_decoded_instr_t &instr ) -> bool { return instr.mnemonic == ZYDIS_MNEMONIC_PUSHFQ; },
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_POP && instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_MEMORY &&
instr.operands[ 0 ].mem.base == ZYDIS_REGISTER_RBP;
} } } }
vm::handler::ADDW
@ ADDW
Definition: vmprofiles.hpp:52

◆ all

std::vector< vm::handler::profile_t * > vm::handler::profile::all
inline
Initial value:
= {
&sregq, &sregdw, &sregw, &lregq, &lregdw, &lconstq, &lconstbzxw, &lconstbsxdw,
&lconstbsxq, &lconstdwsxq, &lconstwsxq, &lconstwsxdw, &lconstdw, &lconstw, &addq, &adddw,
&addw, &lvsp,
&shlq, &shldw, &writeq, &writedw, &writeb, &nandq, &nanddw, &nandw,
&shrq, &shrw, &readq, &readdw, &mulq, &pushvsp, &divq, &jmp,
&lrflags, &vmexit, &call }
vm::handler::profile::lconstw
vm::handler::profile_t lconstw
Definition: lconst.cpp:50
vm::handler::profile::writeb
vm::handler::profile_t writeb
Definition: write.cpp:85
vm::handler::profile::lconstwsxq
vm::handler::profile_t lconstwsxq
Definition: lconst.cpp:171
vm::handler::profile::lvsp
vm::handler::profile_t lvsp
mov rbp [rbp+0]
Definition: lvsp.cpp:5
vm::handler::profile::lconstdw
vm::handler::profile_t lconstdw
mov eax, [rsi-0x04] bswap eax add eax, ebx dec eax neg eax xor eax, 0x2FFD187C push rbx add [rsp],...
Definition: lconst.cpp:28
vm::handler::profile::pushvsp
vm::handler::profile_t pushvsp
Definition: pushvsp.cpp:5
vm::handler::profile::lconstbsxq
vm::handler::profile_t lconstbsxq
Definition: lconst.cpp:121
vm::handler::profile::lregq
vm::handler::profile_t lregq
Definition: lreg.cpp:5
vm::handler::profile::nandq
vm::handler::profile_t nandq
Definition: nand.cpp:5
vm::handler::profile::sregdw
vm::handler::profile_t sregdw
Definition: sreg.cpp:38
vm::handler::profile::sregw
vm::handler::profile_t sregw
Definition: sreg.cpp:72
vm::handler::profile::shrw
vm::handler::profile_t shrw
Definition: shr.cpp:64
vm::handler::profile::lrflags
vm::handler::profile_t lrflags
Definition: lflags.cpp:5
vm::handler::profile::mulq
vm::handler::profile_t mulq
Definition: mul.cpp:5
vm::handler::profile::nanddw
vm::handler::profile_t nanddw
Definition: nand.cpp:68
vm::handler::profile::adddw
vm::handler::profile_t adddw
mov ax, [rbp] sub rbp, 0x06 add [rbp+0x08], ax pushfq pop [rbp]
Definition: add.cpp:28
vm::handler::profile::writeq
vm::handler::profile_t writeq
Definition: write.cpp:5
vm::handler::profile::jmp
vm::handler::profile_t jmp
mov esi, [rbp] add rbp, 0x08 lea r12, [0x0000000000048F29] mov rax, 0x00 ; image base bytes above 32b...
Definition: jmp.cpp:5
vm::handler::profile::readq
vm::handler::profile_t readq
Definition: read.cpp:5
vm::handler::profile::writedw
vm::handler::profile_t writedw
Definition: write.cpp:45
vm::handler::profile::vmexit
vm::handler::profile_t vmexit
Definition: vmexit.cpp:5
vm::handler::profile::sregq
vm::handler::profile_t sregq
Definition: sreg.cpp:5
vm::handler::profile::addq
vm::handler::profile_t addq
mov rax, [rbp+0] add [rbp+8], rax pushfq pop qword ptr [rbp+0]
Definition: add.cpp:5
vm::handler::profile::readdw
vm::handler::profile_t readdw
Definition: read.cpp:27
vm::handler::profile::lconstbzxw
vm::handler::profile_t lconstbzxw
Definition: lconst.cpp:72
vm::handler::profile::shlq
vm::handler::profile_t shlq
Definition: shl.cpp:5
vm::handler::profile::call
vm::handler::profile_t call
mov rdx, [rbp] add rbp, 0x08 call rdx
Definition: call.cpp:5
vm::handler::profile::shldw
vm::handler::profile_t shldw
Definition: shl.cpp:64
vm::handler::profile::lconstbsxdw
vm::handler::profile_t lconstbsxdw
Definition: lconst.cpp:95
vm::handler::profile::lconstq
vm::handler::profile_t lconstq
mov rax, [rsi] xor rax, rbx ; transformation bswap rax ; transformation lea rsi, [rsi+8] ; advance VI...
Definition: lconst.cpp:5
vm::handler::profile::nandw
vm::handler::profile_t nandw
Definition: nand.cpp:115
vm::handler::profile::lregdw
vm::handler::profile_t lregdw
Definition: lreg.cpp:39
vm::handler::profile::lconstdwsxq
vm::handler::profile_t lconstdwsxq
Definition: lconst.cpp:147
vm::handler::profile::shrq
vm::handler::profile_t shrq
Definition: shr.cpp:5
vm::handler::profile::addw
vm::handler::profile_t addw
Definition: add.cpp:51
vm::handler::profile::lconstwsxdw
vm::handler::profile_t lconstwsxdw
Definition: lconst.cpp:197
vm::handler::profile::divq
vm::handler::profile_t divq
mov rdx, [rbp] mov rax, [rbp+0x08] div [rbp+0x10] mov [rbp+0x08], rdx mov [rbp+0x10],...
Definition: div.cpp:5

a vector of pointers to all defined vm handler profiles...

◆ call

vm::handler::profile_t vm::handler::profile::call
Initial value:
= {
"CALL",
CALL,
NULL,
{ {
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_MOV &&
instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[ 0 ].reg.value == ZYDIS_REGISTER_RDX &&
instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_MEMORY &&
instr.operands[ 1 ].mem.base == ZYDIS_REGISTER_RBP;
},
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_ADD &&
instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[ 0 ].reg.value == ZYDIS_REGISTER_RBP &&
instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_IMMEDIATE &&
instr.operands[ 1 ].imm.value.u == 0x8;
},
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_CALL &&
instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[ 0 ].reg.value == ZYDIS_REGISTER_RDX;
} } } }
vm::handler::CALL
@ CALL
Definition: vmprofiles.hpp:19

mov rdx, [rbp] add rbp, 0x08 call rdx

◆ divq

vm::handler::profile_t vm::handler::profile::divq

mov rdx, [rbp] mov rax, [rbp+0x08] div [rbp+0x10] mov [rbp+0x08], rdx mov [rbp+0x10], rax pushfq pop [rbp]

◆ jmp

vm::handler::profile_t vm::handler::profile::jmp

mov esi, [rbp] add rbp, 0x08 lea r12, [0x0000000000048F29] mov rax, 0x00 ; image base bytes above 32bits... add rsi, rax mov rbx, rsi ; update decrypt key add rsi, [rbp] ; add module base address

◆ lconstbsxdw

vm::handler::profile_t vm::handler::profile::lconstbsxdw
Initial value:
= {
"LCONSTBSXDW",
LCONSTBSXDW,
8,
{ {
[]( const zydis_decoded_instr_t &instr ) -> bool { return instr.mnemonic == ZYDIS_MNEMONIC_CWDE; },
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_SUB &&
instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[ 0 ].reg.value == ZYDIS_REGISTER_RBP &&
instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_IMMEDIATE &&
instr.operands[ 1 ].imm.value.u == 0x4;
},
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_MOV && instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_MEMORY &&
instr.operands[ 0 ].mem.base == ZYDIS_REGISTER_RBP &&
instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[ 1 ].reg.value == ZYDIS_REGISTER_EAX;
} } },
vm::handler::extention_t::sign_extend }
vm::handler::LCONSTBSXDW
@ LCONSTBSXDW
Definition: vmprofiles.hpp:34
vm::handler::sign_extend
@ sign_extend
Definition: vmprofiles.hpp:76

◆ lconstbsxq

vm::handler::profile_t vm::handler::profile::lconstbsxq
Initial value:
= {
"LCONSTBSXQ",
LCONSTBSXQ,
8,
{ {
[]( const zydis_decoded_instr_t &instr ) -> bool { return instr.mnemonic == ZYDIS_MNEMONIC_CDQE; },
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_SUB &&
instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[ 0 ].reg.value == ZYDIS_REGISTER_RBP &&
instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_IMMEDIATE &&
instr.operands[ 1 ].imm.value.u == 0x8;
},
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_MOV && instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_MEMORY &&
instr.operands[ 0 ].mem.base == ZYDIS_REGISTER_RBP &&
instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[ 1 ].reg.value == ZYDIS_REGISTER_RAX;
} } },
vm::handler::extention_t::sign_extend }
vm::handler::LCONSTBSXQ
@ LCONSTBSXQ
Definition: vmprofiles.hpp:33

◆ lconstbzxw

vm::handler::profile_t vm::handler::profile::lconstbzxw
Initial value:
= {
"LCONSTBZXW",
LCONSTBZXW,
8,
{ {
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_SUB &&
instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[ 0 ].reg.value == ZYDIS_REGISTER_RBP &&
instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_IMMEDIATE &&
instr.operands[ 1 ].imm.value.u == 0x2;
},
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_MOV && instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_MEMORY &&
instr.operands[ 0 ].mem.base == ZYDIS_REGISTER_RBP &&
instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[ 1 ].reg.value == ZYDIS_REGISTER_AX;
} } } }
vm::handler::LCONSTBZXW
@ LCONSTBZXW
Definition: vmprofiles.hpp:32

◆ lconstdw

vm::handler::profile_t vm::handler::profile::lconstdw
Initial value:
= {
"LCONSTDW",
LCONSTDW,
32,
{ {
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_SUB &&
instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[ 0 ].reg.value == ZYDIS_REGISTER_RBP &&
instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_IMMEDIATE &&
instr.operands[ 1 ].imm.value.u == 0x4;
},
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_MOV && instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_MEMORY &&
instr.operands[ 0 ].mem.base == ZYDIS_REGISTER_RBP &&
instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[ 1 ].reg.value == ZYDIS_REGISTER_EAX;
} } } }
vm::handler::LCONSTDW
@ LCONSTDW
Definition: vmprofiles.hpp:38

mov eax, [rsi-0x04] bswap eax add eax, ebx dec eax neg eax xor eax, 0x2FFD187C push rbx add [rsp], eax pop rbx sub rbp, 0x04 mov [rbp], eax add rsi, 0xFFFFFFFFFFFFFFFC

◆ lconstdwsxq

vm::handler::profile_t vm::handler::profile::lconstdwsxq
Initial value:
= {
"LCONSTDWSXQ",
LCONSTDWSXQ,
32,
{
[]( const zydis_decoded_instr_t &instr ) -> bool { return instr.mnemonic == ZYDIS_MNEMONIC_CDQE; },
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_SUB && instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[ 0 ].reg.value == ZYDIS_REGISTER_RBP &&
instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_IMMEDIATE && instr.operands[ 1 ].imm.value.u == 0x8;
},
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_MOV && instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_MEMORY &&
instr.operands[ 0 ].mem.base == ZYDIS_REGISTER_RBP &&
instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[ 1 ].reg.value == ZYDIS_REGISTER_RAX;
} },
vm::handler::extention_t::sign_extend }
vm::handler::LCONSTDWSXQ
@ LCONSTDWSXQ
Definition: vmprofiles.hpp:35

◆ lconstq

vm::handler::profile_t vm::handler::profile::lconstq
Initial value:
= {
"LCONSTQ",
LCONSTQ,
64,
{ {
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_SUB &&
instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[ 0 ].reg.value == ZYDIS_REGISTER_RBP &&
instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_IMMEDIATE &&
instr.operands[ 1 ].imm.value.u == 0x8;
},
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_MOV && instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_MEMORY &&
instr.operands[ 0 ].mem.base == ZYDIS_REGISTER_RBP &&
instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[ 1 ].reg.value == ZYDIS_REGISTER_RAX;
} } } }
vm::handler::LCONSTQ
@ LCONSTQ
Definition: vmprofiles.hpp:31

mov rax, [rsi] xor rax, rbx ; transformation bswap rax ; transformation lea rsi, [rsi+8] ; advance VIP… rol rax, 0Ch ; transformation inc rax ; transformation xor rbx, rax ; transformation (update rolling decrypt key) sub rbp, 8 mov [rbp+0], rax

◆ lconstw

vm::handler::profile_t vm::handler::profile::lconstw
Initial value:
= {
"LCONSTW",
LCONSTW,
16,
{ {
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_SUB &&
instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[ 0 ].reg.value == ZYDIS_REGISTER_RBP &&
instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_IMMEDIATE &&
instr.operands[ 1 ].imm.value.u == 0x2;
},
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_MOV && instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_MEMORY &&
instr.operands[ 0 ].mem.base == ZYDIS_REGISTER_RBP &&
instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[ 1 ].reg.value == ZYDIS_REGISTER_AX;
} } } }
vm::handler::LCONSTW
@ LCONSTW
Definition: vmprofiles.hpp:39

◆ lconstwsxdw

vm::handler::profile_t vm::handler::profile::lconstwsxdw
Initial value:
= {
"LCONSTWSXDW",
LCONSTWSXDW,
16,
{ {
[]( const zydis_decoded_instr_t &instr ) -> bool { return instr.mnemonic == ZYDIS_MNEMONIC_CWDE; },
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_SUB &&
instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[ 0 ].reg.value == ZYDIS_REGISTER_RBP &&
instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_IMMEDIATE &&
instr.operands[ 1 ].imm.value.u == 0x4;
},
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_MOV && instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_MEMORY &&
instr.operands[ 0 ].mem.base == ZYDIS_REGISTER_RBP &&
instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[ 1 ].reg.value == ZYDIS_REGISTER_EAX;
} } },
vm::handler::extention_t::sign_extend }
vm::handler::LCONSTWSXDW
@ LCONSTWSXDW
Definition: vmprofiles.hpp:37

◆ lconstwsxq

vm::handler::profile_t vm::handler::profile::lconstwsxq
Initial value:
= {
"LCONSTWSXQ",
LCONSTWSXQ,
16,
{ {
[]( const zydis_decoded_instr_t &instr ) -> bool { return instr.mnemonic == ZYDIS_MNEMONIC_CDQE; },
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_SUB &&
instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[ 0 ].reg.value == ZYDIS_REGISTER_RBP &&
instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_IMMEDIATE &&
instr.operands[ 1 ].imm.value.u == 0x8;
},
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_MOV && instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_MEMORY &&
instr.operands[ 0 ].mem.base == ZYDIS_REGISTER_RBP &&
instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[ 1 ].reg.value == ZYDIS_REGISTER_RAX;
} } },
vm::handler::extention_t::sign_extend }
vm::handler::LCONSTWSXQ
@ LCONSTWSXQ
Definition: vmprofiles.hpp:36

◆ lregdw

vm::handler::profile_t vm::handler::profile::lregdw

◆ lregq

vm::handler::profile_t vm::handler::profile::lregq

◆ lrflags

vm::handler::profile_t vm::handler::profile::lrflags
Initial value:
= {
"LRFLAGS",
LRFLAGS,
NULL,
{ {
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_PUSH && instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_MEMORY &&
instr.operands[ 0 ].mem.base == ZYDIS_REGISTER_RBP;
},
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_ADD &&
instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[ 0 ].reg.value == ZYDIS_REGISTER_RBP &&
instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_IMMEDIATE &&
instr.operands[ 1 ].imm.value.u == 0x8;
},
[]( const zydis_decoded_instr_t &instr ) -> bool { return instr.mnemonic == ZYDIS_MNEMONIC_POPFQ; } } } }
vm::handler::LRFLAGS
@ LRFLAGS
Definition: vmprofiles.hpp:15

◆ lvsp

vm::handler::profile_t vm::handler::profile::lvsp
Initial value:
= {
"LVSP",
LVSP,
NULL,
{ { []( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_MOV && instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[ 0 ].reg.value == ZYDIS_REGISTER_RBP &&
instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_MEMORY &&
instr.operands[ 1 ].mem.base == ZYDIS_REGISTER_RBP;
} } } }
vm::handler::LVSP
@ LVSP
Definition: vmprofiles.hpp:22

mov rbp [rbp+0]

◆ mulq

vm::handler::profile_t vm::handler::profile::mulq

◆ nanddw

vm::handler::profile_t vm::handler::profile::nanddw

◆ nandq

vm::handler::profile_t vm::handler::profile::nandq

◆ nandw

vm::handler::profile_t vm::handler::profile::nandw

◆ pushvsp

vm::handler::profile_t vm::handler::profile::pushvsp
Initial value:
= {
"PUSHVSP",
PUSHVSP,
NULL,
{ {
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_MOV &&
instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[ 0 ].reg.value == ZYDIS_REGISTER_RAX &&
instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[ 1 ].reg.value == ZYDIS_REGISTER_RBP;
},
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_SUB &&
instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[ 0 ].reg.value == ZYDIS_REGISTER_RBP &&
instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_IMMEDIATE &&
instr.operands[ 1 ].imm.value.u == 0x8;
},
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_MOV && instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_MEMORY &&
instr.operands[ 0 ].mem.base == ZYDIS_REGISTER_RBP &&
instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[ 1 ].reg.value == ZYDIS_REGISTER_RAX;
} } } }
vm::handler::PUSHVSP
@ PUSHVSP
Definition: vmprofiles.hpp:16

◆ readdw

vm::handler::profile_t vm::handler::profile::readdw
Initial value:
= {
"READDW",
READDW,
NULL,
{ {
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_ADD &&
instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[ 0 ].reg.value == ZYDIS_REGISTER_RBP &&
instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_IMMEDIATE &&
instr.operands[ 1 ].imm.value.u == 0x4;
},
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_MOV &&
instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[ 0 ].reg.value == ZYDIS_REGISTER_EAX &&
instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_MEMORY &&
instr.operands[ 1 ].mem.base == ZYDIS_REGISTER_RAX;
},
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_MOV && instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_MEMORY &&
instr.operands[ 0 ].mem.base == ZYDIS_REGISTER_RBP &&
instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[ 1 ].reg.value == ZYDIS_REGISTER_EAX;
} } } }
vm::handler::READDW
@ READDW
Definition: vmprofiles.hpp:42

◆ readq

vm::handler::profile_t vm::handler::profile::readq
Initial value:
= {
"READQ",
READQ,
NULL,
{ {
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_MOV &&
instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[ 0 ].reg.value == ZYDIS_REGISTER_RAX &&
instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_MEMORY &&
instr.operands[ 1 ].mem.base == ZYDIS_REGISTER_RAX;
},
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_MOV && instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_MEMORY &&
instr.operands[ 0 ].mem.base == ZYDIS_REGISTER_RBP &&
instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[ 1 ].reg.value == ZYDIS_REGISTER_RAX;
} } } }
vm::handler::READQ
@ READQ
Definition: vmprofiles.hpp:41

◆ shldw

vm::handler::profile_t vm::handler::profile::shldw

◆ shlq

vm::handler::profile_t vm::handler::profile::shlq

◆ shrq

vm::handler::profile_t vm::handler::profile::shrq

◆ shrw

vm::handler::profile_t vm::handler::profile::shrw

◆ sregdw

vm::handler::profile_t vm::handler::profile::sregdw

◆ sregq

vm::handler::profile_t vm::handler::profile::sregq

◆ sregw

vm::handler::profile_t vm::handler::profile::sregw

◆ vmexit

vm::handler::profile_t vm::handler::profile::vmexit
Initial value:
= {
"VMEXIT",
VMEXIT,
NULL,
{ {
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_MOV &&
instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[ 0 ].reg.value == ZYDIS_REGISTER_RSP &&
instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[ 1 ].reg.value == ZYDIS_REGISTER_RBP;
},
[]( const zydis_decoded_instr_t &instr ) -> bool { return instr.mnemonic == ZYDIS_MNEMONIC_RET; } } } }
vm::handler::VMEXIT
@ VMEXIT
Definition: vmprofiles.hpp:21

◆ writeb

vm::handler::profile_t vm::handler::profile::writeb

◆ writedw

vm::handler::profile_t vm::handler::profile::writedw

◆ writeq

vm::handler::profile_t vm::handler::profile::writeq
Generated by doxygen 1.9.1