1

I have a binary with VMProtect. Some tools giving info that this is 2.x, some that 3.x. How I could check it? Thanks.

  • Which tools are you using? – julian Sep 25 '18 at 4:05
  • Could you show some disassembly of a vm handler? You can recognize you’re in a vm handler if you step and see a push xxxx; call yyy where yyy is in one of the vmp sections. – mrexodia Oct 5 '18 at 6:47
  • @SYS_V I used Protection ID v6.90. – Zubastic Oct 7 '18 at 0:06
  • @mrexodia at birany only some function at VMProtect and code is long with big cound of jmp something like that: cmp [esi+ecx*2+0BAC1C45h], bl mov bh, 0EEh adc [esi], ebp pop esp mov eax, ds:5E830102h db 26h or eax, 0BA322563h xor [edi], esp push eax rcl dword ptr [edx], 1 – Zubastic Oct 7 '18 at 0:08
1

Unfortunately there's no easy answer here.

Most of these tools employ different types of heuristics to determine the version used. Often times just applying binary signatures which could be inaccurate. Without gaining a decent understanding of VMProtect to recognize the differences this will be quite difficult.

If tools used are open-source or well-documented, you can go over the signature used to detect the version, and validate it manually once you have a good understanding of the rational behind it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.