Skip to main content

Questions tagged [vmprotect]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
4 votes
0 answers
169 views

How can I learn VMP analysis?

I am currently interested in learning reverse engineering, and I have a foundation in assembly, PE structure, and the use of Win32Api. And also have some of the foundation for writing Windows drivers;...
Jack Lee's user avatar
3 votes
1 answer
1k views

VMProtect Anti-debugging method (without WiNAPI)

First, sorry for my bad english. I'm trying to make VMProtect unpacker with unicorn emulator, but one of my sample shows me like this anti-debugging message: WTSSendMessageW: "A debugger has been ...
schnabel's user avatar
2 votes
0 answers
69 views

analyze track program protected

What are the modern methods of dealing with obfuscation and code virtualization? all these protectors create unrealistic code traces?
bArt's user avatar
  • 21
2 votes
1 answer
565 views

x86 - How do I detect virtualized code by looking at the assembly?

How can I detected virtualized code by say, vmprotect, obsidium or themida just by looking at the assembly code? I know that just looking at the PE section name would help, but I wanted to detect ...
Alexey's user avatar
  • 69
1 vote
1 answer
6k views

Bypass USB key activation of a software

(The software is Chinese and contains malware. I do not know if I could upload it here, so temporarily, please let me describe it) I am asked by a spa store to "do something" to make a ...
BlackXIII's user avatar
2 votes
0 answers
304 views

Devirtualization

I've recently become pretty fascinated with virtualization and retrieving original code from a randomly generated byte code, such as protectors like VMProtect/etc. But I can not get a grasp on how it ...
user avatar
0 votes
0 answers
308 views

problems with figuring out if its vmprotect or upx

my name is eleven and I'm new to reverse engineering and I have a question. after scanning my program I have wanted to reverse engineer I have walked into a problem. this is a program I'm trying to ...
eleven's user avatar
  • 1
2 votes
0 answers
825 views

How to virtualize part of a code like VMProtect does?

I am a new student in the field of cybersecurity. I would like to learn more about how virtualization used by software such as CodeVirtualizer and VMProtect works, and ideally to be able to ...
Corentin Mar's user avatar
1 vote
0 answers
54 views

How to choose a .NET software protector which will have a small impact on run-time performance speed? [closed]

I am writing a .NET software which is doing calculations and drawing in real-time i.e when the user is moving the mouse. I want to protect this software from being reverse engineered and restrict its ...
ForeverNoob's user avatar
3 votes
1 answer
5k views

VMProtect anti-debug method

I recently found a nice crackme which uses VMProtect 3.x as defense. After doing a little research online I found couple of API's VMProtect uses as an anti debug method. I set software breakpoint on ...
anony's user avatar
  • 31
1 vote
1 answer
3k views

How detect version of VMProtect

I have a binary with VMProtect. Some tools giving info that this is 2.x, some that 3.x. How I could check it? Thanks.
Zubastic's user avatar
-1 votes
1 answer
2k views

VMProtect keygen, turn off the anti-debugging

who faced with VMProtect? I just found on the Internet crackme and decided to grunt it, but unfortunately not that good of it did not work out, as the message about prevention of debugging climbed out....
alex-rudenkiy's user avatar
4 votes
2 answers
2k views

Hooking functions in a VMProtect'ed executable

I'm trying to solve the Sharif CTF 2016 HI2.exe challenge. This challenge requires a specific (impossible to reach) environment (64 processors, 128GB RAM, ...) to display the flag. As the executable ...
Sebastien Damaye's user avatar