6
votes
Accepted
Finding OEP in a VMProtect v3.0 protected malware
Here are a few links that address your question in a broad manner:
VMAttack: Deobfuscating Virtualization-Based Packed Binaries
Link to PDF Paper which uses the VMAttack IDA PRO Plugin.
Unpacking ...
- 136
3
votes
Finding OEP in a VMProtect v3.0 protected malware
Set a breakpoint on the "VM exit" instruction (though there may be more than one of these if the sample is using the multiple VM option, whose proper name I don't recall). From here you can see where ...
- 9,218
2
votes
Accepted
How to debug / analyze a Themida protected binary
I found the cause of the crash which is... Themida 🤦♂️
What happens is that from build 1607 and higher some exports have a double redirection using api sets. The app imports a couple of functions ...
- 3,283
2
votes
Finding OEP in a VMProtect v3.0 protected malware
Since you say it's malware please provide either the SHA256/MD5 hash or a Virustotal/Hybrid-analysis link of the target so that I can take a quick look at it.
VMP and its protection mechanisms ...
- 1,046
1
vote
Finding OEP in a VMProtect v3.0 protected malware
Note: I never unpacked VMProtect myself.
From looking at a sample unpackme, all intermodular calls that normally pointed to the IAT, are replaced with direct calls to what I think are obfuscated ...
- 11
Only top scored, non community-wiki answers of a minimum length are eligible