I've been trying to reverse engineer a malware that has been packed with
VMProtect v3.0. My first instinct was to google an automated way for this and I found a script. Unfortunately the script to unpack
VMProtect protected binary does not work with version 3.0.
So far I've seen that the packer changes the access rights of the sections to be writable, decrypts the original code and writes the code to the sections then changes the access rights for those sections back to their initial values. I saw that by putting breakpoint on the
VirtualProtect API. After the final call to
VirtualProtect I put the access breakpoint on the sections that had
executable right and when my breakpoint was hit I expected it to be the
OEP but when I dumped the process it did not run.
From my research I understand that you need to rebuild the
IAT and tools like
Scylla won't be any help. Can you give me some tips on how to find the
OEP or how to deal with this kind of packing mechanism in general?
P.S. This is the first time I am dealing with
VMProtect protected malware.