vmprotect-research

VMP Devirtualizer - Production Release Generalized VMProtect devirtualizer supporting versions 1.x, 2.x, and 3.x. Standalone CLI tool + Ghidra plugin. Status: ✅ Production Ready | Validation: 22/22 samples 100% | Scope: VMP ≤3.6 3.7+ requires reverse engineering Features Multi-Version Support: VM...

VMProtect-devirtualization

VMProtect Devirtualization An experimental dynamic approach to devirtualize pure functions protected by VMProtect 3.x TL;DR Introduction The approach Example 1: A simple bitwise operation protected Example 2: A MBA operation protected Example 3: More than one basic block Conclusion and limitation...

vmpdump

VMPDump Un volcador VMP dinámico y reparador de importaciones, impulsado por VTIL. Funciona para VMProtect 3.X x64. Antes vs Después Uso VMPDump.exe "" -ep= -disable-reloc Argumentos: : El ID del proceso objetivo, en forma decimal o hexadecimal. : El nombre del módulo que debe volcarse y reparars...

VMDragonSlayer

VMDragonSlayer プロジェクトは10月中旬に公開予定（リファクタリング中） 高度な仮想マシン検出・解析フレームワーク VMDragonSlayerは、VMProtect 2.x/3.x、Themida、カスタムマルウェアVMなどの仮想マシン（VM）ベースのプロテクタで保護されたバイナリを解析するための包括的なフレームワークです。このフレームワークは、動的タイントラッキング（DTT）、シンボリック実行（SE）、パターン分類、機械学習を含む複数の解析エンジンを組み合わせ、リバースエンジニアリングプロセスを自動化します。 目標 :...

VMUnprotect.Dumper

VMUnprotect.Dumper VMUnprotect.Dumper is a project engaged in hunting tampered VMProtect assemblies. It makes use of AsmResolver to dynamically unpack VMP protected assembly. Works on VMProtect 3.7.0 Latest and few versions back. Before usage of VMUnprotect.Dumper After usage of VMUnprotect.Dumpe...

unicorn_pe

Unicorn PE Unicorn PE 是一个基于 unicorn 的插桩项目/框架，旨在模拟 Windows PE 文件的代码执行，尤其是加壳的 PE 文件。 该项目已归档，不再维护。推荐使用 sogen 作为替代方案。 功能 从模拟内存中将 PE 镜像转储到文件，修复导入表，解密 VMProtect 字符串，解密 VMProtect 导入。 对异常的部分支持。（仅 DB 和 BP） 显示所有正在执行的指令的反汇编。 将 BlackBone 更新到最新版本（2020.4.5）。 TODO 功能：x86（低优先级）-- 0% 构建 Visual Studio 2017 或 2019 ...

vmp2

Introduction This repository is a collection of legacy tools for working with VMProtect 2 -protected binaries. These tools enable unpacking, analysis, and experimental devirtualization of software protected with VMProtect 2. At the core of this collection is vmprofiler , a utility library that...

0xGUARD

📄 Features Module remapping Thread filtering Module hiding Memory check Integrity check Anti-DLL Injection Anti-Debugging Process policy Literal string obfuscation Compatibility with Themida/VMProtect ✔️ Dependencies Windows 711 Visual Studio 2019 🔧 How to use 1. Set options in options.h and build...

Old certificate, new signature: Open-source tools forge signature timestamps on Windows drivers

Cisco Talos has observed threat actors taking advantage of a Windows policy loophole that allows the signing and loading of cross-signed kernel mode drivers with signature timestamp prior to July 29, 2015. Actors are leveraging multiple open-source tools that alter the signing date of kernel mode...

WINTAPIX Kernel Driver Targeting Middle Eastern Nations

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary The WINTAPIX driver, protected by VMProtect, targets Saudi Arabia and other Gulf countries, possibly linked to Iranian threat actors exploiting Exchange servers for malware deployment. To receive real-ti...

APT15 enhanced its arsenal with an updated variant of the Turian backdoor

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary APT15 has modified its toolkit to include new variants of the Turian backdoor, as well as new command and control infrastructure. The malware contains VMProtect, which obfuscates all API calls within the...

RangnarLocker Ransomware hits Critical Infrastructure Compromising 50+ Organizations

THREAT LEVEL: Red. For a detailed advisory, download the pdf file here The Federal Bureau of Investigation FBI has released an alert on Ragnarlocker campaign that has affected nearly 52 organizations encompassing 10 critical infrastructure sectors, including entities in significant manufacturing,...

Metamorfo Returns with Keylogger Trick to Target Financial Firms

Researchers have discovered a recent spate of phishing emails spreading a new variant of Metamorfo, a financial malware known for targeting Brazilian companies. Now, however, it’s expanding its geographic range and adding a new technique. Metamorfo was first discovered in April 2018, in various...

Adobe Flash Zero-Day Leveraged Via Office Docs in Campaign

An Adobe Flash Player zero-day exploit has been spotted in the wild as part of a widespread campaign, researchers said on Wednesday. Adobe has just issued a patch for the previously unknown critical flaw. The vulnerability, CVE-2018-15982, is a use-after-free flaw enabling arbitrary code executio...

Analyzing malware by API calls

Over the last quarter, we've seen an increase in malware using packers, crypters, and protectors—all methods used to obfuscate malicious code from systems or programs attempting to identify it. These packers make it very hard, or next to impossible to perform static analysis. The growing number o...

Threat Actors Target Chinese Language News Sites

A California-based news website covering China, called China Digital Times, was targeted in a spying campaign that involved phishing lures and the use of the NetWire remote access Trojan. The attacks began in February 2017 and were part of a wider campaign of phishing, reconnaissance and malware...

Any combination of instructions to achieve free kill-vulnerability warning-the black bar safety net

Note:writing flower instructions,refer to the following pairs of instructions,can be arbitrary free combination. Free to killeffect. push ebp pop ebp push eax pop eax push esp pop esp push 0 push 0 push 1 0 -------which numbers can be arbitrary,note the following correspondence push -10...

PcShare full free kill processing ideas-vulnerability warning-the black bar safety net

PcShare fullfree killprocessing ideas Pcshare software package within update 1 3 files 8 of which have the color of the icon is the function of the plug-in generally combined with good shell Beidou 2. 6 like a good Shell you can. 关键 处理 PcClient.dll PcInit.exe PcHide. sys three files. These days 0...