I have a binary with VMProtect. Some tools giving info that this is 2.x, some that 3.x. How I could check it? Thanks.

  • Which tools are you using?
    – julian
    Sep 25, 2018 at 4:05
  • Could you show some disassembly of a vm handler? You can recognize you’re in a vm handler if you step and see a push xxxx; call yyy where yyy is in one of the vmp sections.
    – mrexodia
    Oct 5, 2018 at 6:47
  • @SYS_V I used Protection ID v6.90.
    – Zubastic
    Oct 7, 2018 at 0:06
  • @mrexodia at birany only some function at VMProtect and code is long with big cound of jmp something like that: cmp [esi+ecx*2+0BAC1C45h], bl mov bh, 0EEh adc [esi], ebp pop esp mov eax, ds:5E830102h db 26h or eax, 0BA322563h xor [edi], esp push eax rcl dword ptr [edx], 1
    – Zubastic
    Oct 7, 2018 at 0:08

1 Answer 1


Unfortunately there's no easy answer here.

Most of these tools employ different types of heuristics to determine the version used. Often times just applying binary signatures which could be inaccurate. Without gaining a decent understanding of VMProtect to recognize the differences this will be quite difficult.

If tools used are open-source or well-documented, you can go over the signature used to detect the version, and validate it manually once you have a good understanding of the rational behind it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.