VMProtect-devirtualization

VMProtect Devirtualization An experimental dynamic approach to devirtualize pure functions protected by VMProtect 3.x TL;DR Introduction The approach Example 1: A simple bitwise operation protected Example 2: A MBA operation protected Example 3: More than one basic block Conclusion and limitation...

vmprotect-research

VMP Devirtualizer - Production Release Generalized VMProtect devirtualizer supporting versions 1.x, 2.x, and 3.x. Standalone CLI tool + Ghidra plugin. Status: ✅ Production Ready | Validation: 22/22 samples 100% | Scope: VMP ≤3.6 3.7+ requires reverse engineering Features Multi-Version Support: VM...

VMDragonSlayer

VMDragonSlayer Project will be public by mid-October Refactoring In Progress Advanced Virtual Machine Detection and Analysis Framework VMDragonSlayer is a comprehensive framework for analyzing binaries protected by Virtual Machine VM based protectors such as VMProtect 2.x/3.x, Themida, and custom...

vmpdump

VMPDump 一个动态VMP转储和导入修复工具，基于VTIL。适用于VMProtect 3.X x64。 前后对比 用法 VMPDump.exe "" -ep= -disable-reloc 参数： ：目标进程的ID，十进制或十六进制形式。 ：要转储和修复的模块名称。如果希望使用进程映像模块，可以传入空字符串""。 -ep=：可选提供的入口点RVA，十六进制形式。VMPDump将用此值覆盖可选头中的入口点。 -disable-reloc：可选设置，指示VMPDump在输出映像中标记重定位已被剥离，强制映像加载到转储的ImageBase。如果需要可运行的转储，这很有用。...

VMUnprotect.Dumper

VMUnprotect.Dumper VMUnprotect.Dumper es un proyecto dedicado a la caza de ensamblados de VMProtect manipulados. Hace uso de AsmResolver para desempaquetar dinámicamente ensamblados protegidos por VMP. Funciona en VMProtect 3.7.0 la última versión y algunas versiones anteriores. Antes del uso de...

unicorn_pe

Unicorn PE Unicorn PE es un proyecto/framework de instrumentación basado en unicorn diseñado para emular la ejecución de código de archivos PE de Windows, especialmente aquellos empaquetados. Este proyecto está archivado y ya no recibe mantenimiento. Se recomienda sogen como sucesor...

vmp2

Introducción Este repositorio es una colección de herramientas heredadas para trabajar con binarios protegidos con VMProtect 2. Estas herramientas permiten desempaquetar, analizar y realizar desvirtualización experimental de software protegido con VMProtect 2. En el núcleo de esta colección se...

0xGUARD

📄 Características Remapeo de módulos Filtrado de subprocesos Ocultamiento de módulos Comprobación de memoria Comprobación de integridad Anti-Inyección de DLL Anti-Depuración Política de procesos Ofuscación de cadenas literales Compatibilidad con Themida/VMProtect ✔️ Dependencias Windows 711 Visual...

Old certificate, new signature: Open-source tools forge signature timestamps on Windows drivers

Cisco Talos has observed threat actors taking advantage of a Windows policy loophole that allows the signing and loading of cross-signed kernel mode drivers with signature timestamp prior to July 29, 2015. Actors are leveraging multiple open-source tools that alter the signing date of kernel mode...

WINTAPIX Kernel Driver Targeting Middle Eastern Nations

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary The WINTAPIX driver, protected by VMProtect, targets Saudi Arabia and other Gulf countries, possibly linked to Iranian threat actors exploiting Exchange servers for malware deployment. To receive real-ti...

APT15 enhanced its arsenal with an updated variant of the Turian backdoor

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary APT15 has modified its toolkit to include new variants of the Turian backdoor, as well as new command and control infrastructure. The malware contains VMProtect, which obfuscates all API calls within the...

RangnarLocker Ransomware hits Critical Infrastructure Compromising 50+ Organizations

THREAT LEVEL: Red. For a detailed advisory, download the pdf file here The Federal Bureau of Investigation FBI has released an alert on Ragnarlocker campaign that has affected nearly 52 organizations encompassing 10 critical infrastructure sectors, including entities in significant manufacturing,...

Metamorfo Returns with Keylogger Trick to Target Financial Firms

Researchers have discovered a recent spate of phishing emails spreading a new variant of Metamorfo, a financial malware known for targeting Brazilian companies. Now, however, it’s expanding its geographic range and adding a new technique. Metamorfo was first discovered in April 2018, in various...

Adobe Flash Zero-Day Leveraged Via Office Docs in Campaign

An Adobe Flash Player zero-day exploit has been spotted in the wild as part of a widespread campaign, researchers said on Wednesday. Adobe has just issued a patch for the previously unknown critical flaw. The vulnerability, CVE-2018-15982, is a use-after-free flaw enabling arbitrary code executio...

Analyzing malware by API calls

Over the last quarter, we've seen an increase in malware using packers, crypters, and protectors—all methods used to obfuscate malicious code from systems or programs attempting to identify it. These packers make it very hard, or next to impossible to perform static analysis. The growing number o...

Threat Actors Target Chinese Language News Sites

A California-based news website covering China, called China Digital Times, was targeted in a spying campaign that involved phishing lures and the use of the NetWire remote access Trojan. The attacks began in February 2017 and were part of a wider campaign of phishing, reconnaissance and malware...

Any combination of instructions to achieve free kill-vulnerability warning-the black bar safety net

Note:writing flower instructions,refer to the following pairs of instructions,can be arbitrary free combination. Free to killeffect. push ebp pop ebp push eax pop eax push esp pop esp push 0 push 0 push 1 0 -------which numbers can be arbitrary,note the following correspondence push -10...

PcShare full free kill processing ideas-vulnerability warning-the black bar safety net

PcShare fullfree killprocessing ideas Pcshare software package within update 1 3 files 8 of which have the color of the icon is the function of the plug-in generally combined with good shell Beidou 2. 6 like a good Shell you can. 关键 处理 PcClient.dll PcInit.exe PcHide. sys three files. These days 0...