vmprofiler/ADD_VMP2_INSTR.md

Introduction

This page contains the steps needed to add additional VMProtect 2 virtual instruction profiles to VMProfiler. Understand that these instructions are for version 1.8 and may be different in later versions.

Example - Existing Profile

Consider the ADDQ profile which is displayed below which can be found inside of add.cpp

vm::handler::profile_t addq = {
    // ADD [RBP+8], RAX
    // PUSHFQ
    // POP [RBP]
    "ADDQ",
    ADDQ,
    NULL,
    { { // ADD [RBP+8], RAX
        []( const zydis_decoded_instr_t &instr ) -> bool {
            return instr.mnemonic == ZYDIS_MNEMONIC_ADD && instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_MEMORY &&
                   instr.operands[ 0 ].mem.base == ZYDIS_REGISTER_RBP &&
                   instr.operands[ 0 ].mem.disp.value == 0x8 &&
                   instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
                   instr.operands[ 1 ].reg.value == ZYDIS_REGISTER_RAX;
        },
        // PUSHFQ
        []( const zydis_decoded_instr_t &instr ) -> bool { return instr.mnemonic == ZYDIS_MNEMONIC_PUSHFQ; },
        // POP [RBP]
        []( const zydis_decoded_instr_t &instr ) -> bool {
            return instr.mnemonic == ZYDIS_MNEMONIC_POP && instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_MEMORY &&
                   instr.operands[ 0 ].mem.base == ZYDIS_REGISTER_RBP;
        } } } };

Inside of vmprofiles.hpp you can see a list of these profiles marked as extern.

namespace profile
{
    extern vm::handler::profile_t sregq;
    extern vm::handler::profile_t sregdw;
    extern vm::handler::profile_t sregw;

    extern vm::handler::profile_t lregq;
    extern vm::handler::profile_t lregdw;

    extern vm::handler::profile_t lconstq;
    extern vm::handler::profile_t lconstdw;
    extern vm::handler::profile_t lconstw;

    extern vm::handler::profile_t lconstbzxw;
    extern vm::handler::profile_t lconstbsxdw;
    extern vm::handler::profile_t lconstbsxq;
    extern vm::handler::profile_t lconstdwsxq;
    extern vm::handler::profile_t lconstwsxq;
    extern vm::handler::profile_t lconstwsxdw;

    extern vm::handler::profile_t addq; // as you can see a reference to addq is declared here...
    ...
}