I am currently working on some crackme, that has implemented an obfuscation technique, virtualisation. The virtual machine inside this crackme is a huge switch-case block (over 130 cases in it). I have already read dozens of article, but none are making things clear enough.
I have found some info though, that I can find some buffer in memory, containing opcodes, that are native assembly code that are then interpreted by the virtual machine in switch cases block.
Finding them will provide an opportunity to write a small disassembler on any language preferred, where in "case"-blocks would be the native operations written, like
printf("mov eax, dword ptr [ebp-4]"). That way I can figure out the algorithm of generating and checking the serial.
However, I am stuck on finding that memory location with opcodes. Can anyone advice me something on how to find these, some techniques, or at least some good literature or tutorials on how to deal with such a thing? May be there are some common ways to crack this kind of crackme.
Your help is very much appreciated.