I wanted to run an app on a VM but there are PUSH PUSH RETs stopping me from looking at their anti VM code. There is a messagebox when I run it on a VM. I set a breakpoint at
MessageBoxA and it gets triggered as well as EAX is showing the message for the VM. It's all good until now.
I'm using x64dbg and I opened
Call Stack tab and double-clicked on the address after user32.MessageBoxA (basically 2nd record), so I could trace back the calls before the actual MessageBoxA. It landed me here:
I heard that
PUSH RET is like a
PUSH PUSH RET is like a
call. How do they work? Can they be deobfuscated with a tool/plugin or something?
PUSH 0xC9DFBF leads me here:
PUSH 0xA4DB49 leads me here:
When I follow that jmp, it leads to similar code to
PUSH 0xC9DFBF's image which ends with a jmp to MessageBoxA.
What could you recommend me to step into the code before the actual MessageBoxA call, so I can find their anti VM code and patch it? Do I need to step the instructions from the beginning one by one?
Dumps: http://ufile.io/56c5b2z6. Rebase to 0x1270000 and find 0181E65C address. This address is in the executable file. I attached two dumped DLLs as well, because they were referenced.