9 votes

VMProtect anti-debug method

VMProtect uses a few anti-debug techniques. Firstly, you aren't going to want to tackle them on your own because there is quite and exhaustive set of techniques to detect a debugger. Consider using an ...
Jeremy's user avatar
  • 263
3 votes

x86 - How do I detect virtualized code by looking at the assembly?

That's tricky because obfuscated code often looks similar regardless of whether or not it specifically uses virtualization obfuscation. Most VMs ultimately have a similar high-level structure, as laid ...
Rolf Rolles's user avatar
  • 9,198
1 vote

VMProtect Anti-debugging method (without WiNAPI)

Yes, you are correct, there is a very common anti-emulation detection technique that is based on the rdtsc instruction, here are 2 variations of it (taken from al-khaser): BOOL rdtsc_diff_locky() { ...
rotem.salinas's user avatar
1 vote

Bypass USB key activation of a software

As expected, the USB was indeed detected but due that Linux has no idea how to deal with it without a proper driver, it only parses its hardware related parameters (Vendor and Product IDs) and stops ...
Abdullah Mohamed's user avatar
1 vote
Accepted

How detect version of VMProtect

Unfortunately there's no easy answer here. Most of these tools employ different types of heuristics to determine the version used. Often times just applying binary signatures which could be ...
NirIzr's user avatar
  • 11.8k
1 vote
Accepted

VMProtect keygen, turn off the anti-debugging

You can use something like ScyllaHide to hide your debugger while you still don‘t know the method they use to detect you.
manduca's user avatar
  • 351
1 vote

Hooking functions in a VMProtect'ed executable

If there's no way to debug it, use system mechanisms to load your DLL into protected process, then do whatever you like.
Anton Kukoba's user avatar
  • 1,840
1 vote

Hooking functions in a VMProtect'ed executable

StrongOD can have unexpected behaviour if you are using Win7 as your debugging environment. Try to use ScyllaHide plugin with the VMProtect profile on, ignore Invalid or privileged instruction ...
rustam Shirinov's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible