6 votes
Accepted

Finding OEP in a VMProtect v3.0 protected malware

Here are a few links that address your question in a broad manner: VMAttack: Deobfuscating Virtualization-Based Packed Binaries Link to PDF Paper which uses the VMAttack IDA PRO Plugin. Unpacking ...
user avatar
  • 136
3 votes

Finding OEP in a VMProtect v3.0 protected malware

Set a breakpoint on the "VM exit" instruction (though there may be more than one of these if the sample is using the multiple VM option, whose proper name I don't recall). From here you can see where ...
user avatar
  • 7,799
2 votes

Finding OEP in a VMProtect v3.0 protected malware

Since you say it's malware please provide either the SHA256/MD5 hash or a Virustotal/Hybrid-analysis link of the target so that I can take a quick look at it. VMP and its protection mechanisms ...
user avatar
  • 1,026
1 vote
Accepted

How to debug / analyze a Themida protected binary

I found the cause of the crash which is... Themida 🤦‍♂️ What happens is that from build 1607 and higher some exports have a double redirection using api sets. The app imports a couple of functions ...
user avatar
  • 2,908
1 vote

Finding OEP in a VMProtect v3.0 protected malware

Note: I never unpacked VMProtect myself. From looking at a sample unpackme, all intermodular calls that normally pointed to the IAT, are replaced with direct calls to what I think are obfuscated ...
user avatar
  • 11

Only top scored, non community-wiki answers of a minimum length are eligible