I have a binary with VMProtect. Some tools giving info that this is 2.x, some that 3.x. How I could check it? Thanks.
-
Which tools are you using?– julian ♦Commented Sep 25, 2018 at 4:05
-
Could you show some disassembly of a vm handler? You can recognize you’re in a vm handler if you step and see a push xxxx; call yyy where yyy is in one of the vmp sections.– mrexodiaCommented Oct 5, 2018 at 6:47
-
@SYS_V I used Protection ID v6.90.– ZubasticCommented Oct 7, 2018 at 0:06
-
@mrexodia at birany only some function at VMProtect and code is long with big cound of jmp something like that: cmp [esi+ecx*2+0BAC1C45h], bl mov bh, 0EEh adc [esi], ebp pop esp mov eax, ds:5E830102h db 26h or eax, 0BA322563h xor [edi], esp push eax rcl dword ptr [edx], 1– ZubasticCommented Oct 7, 2018 at 0:08
Add a comment
|
1 Answer
Unfortunately there's no easy answer here.
Most of these tools employ different types of heuristics to determine the version used. Often times just applying binary signatures which could be inaccurate. Without gaining a decent understanding of VMProtect to recognize the differences this will be quite difficult.
If tools used are open-source or well-documented, you can go over the signature used to detect the version, and validate it manually once you have a good understanding of the rational behind it.