diff --git a/include/vmctx.hpp b/include/vmctx.hpp
index aad3163..5877f89 100644
--- a/include/vmctx.hpp
+++ b/include/vmctx.hpp
@@ -12,7 +12,15 @@ class vmctx_t {
const std::uintptr_t m_module_base, m_image_base, m_vm_entry_rva,
m_image_size;
+ ///
+ /// m_vip and m_vsp are volitile and are subject to change... they are set to
+ /// the ones used in vm enter but can be changed by external source code...
+ ///
zydis_register_t m_vip, m_vsp;
+
+ ///
+ /// the virtual machine enter flattened and deobfuscated...
+ ///
zydis_routine_t m_vm_entry;
};
} // namespace vm
\ No newline at end of file
diff --git a/tests/vm_entry_test/src/main.cpp b/tests/vm_entry_test/src/main.cpp
index 1bc52cb..c78b147 100644
--- a/tests/vm_entry_test/src/main.cpp
+++ b/tests/vm_entry_test/src/main.cpp
@@ -109,10 +109,10 @@ int __cdecl main(int argc, const char* argv[]) {
}
vm::utils::print(vmctx.m_vm_entry);
- std::printf("> Virtual Instruction Pointer Register: %s\n",
+ std::printf("> Starting Virtual Instruction Pointer Register: %s\n",
ZydisRegisterGetString(vmctx.m_vip));
- std::printf("> Virtual Stack Pointer Register: %s\n",
+ std::printf("> Starting Virtual Stack Pointer Register: %s\n",
ZydisRegisterGetString(vmctx.m_vsp));
// testing vmlocate port for vmp3...