Questions tagged [virtualizers]

Binary packers that convert CPU instructions into an emulated instruction set, and embed the virtual CPU code along the virtual code.

Filter by
Sorted by
Tagged with
2
votes
0answers
67 views

Devirtualization

I've recently become pretty fascinated with virtualization and retrieving original code from a randomly generated byte code, such as protectors like VMProtect/etc. But I can not get a grasp on how it ...
1
vote
0answers
257 views

How to virtualize part of a code like VMProtect does?

I am a new student in the field of cybersecurity. I would like to learn more about how virtualization used by software such as CodeVirtualizer and VMProtect works, and ideally to be able to ...
3
votes
1answer
919 views

How to deal with heavy control flow flattening?

I am trying to reverse engineer an executable that uses a lot of control flow flattening obfuscation (i.e, lots of subroutines that end with something like jmp esi, jmp eax) IDA Pro isn't able to ...
5
votes
1answer
1k views

Reverse engineering the virtual machine based crackme

I am currently working on some crackme, that has implemented an obfuscation technique, virtualisation. The virtual machine inside this crackme is a huge switch-case block (over 130 cases in it). I ...
4
votes
1answer
400 views

Which virtualized target is recommended for newbie on vm-obfuscation?

I'm newbie on virtualized code obfuscation. I can break many features to avoid debugging/reversing and packer/protector (even Themida, without vm option), but I'm not good at virtualized code. Though ...
1
vote
1answer
92 views

How to accurately virtualize bespoke hardware?

Here's my situation: I hate firewalls, load balancers, routers etc... want to root em all! Anyway, I can't buy em all, and a lot of people think that it's dumb to buy them anyway. Why? So the ...
4
votes
1answer
4k views

Can IDA Pro automatically deal with VM obfuscated binaries?

VM packers like Code Virtualizer and VMProtect seem challenging to existing reverse engineering work, especially static approach like IDA Pro. According to this slides www.hex-rays.com/products/ida/...
19
votes
4answers
6k views

How common are virtualized packers in the wild?

I'm just getting into the RE field, and I learned about virtualized packers (like VMProtect or Themida) in a class about a year ago. How often is malware in the wild really packed with virtualized ...