0
Watch
0
Star
0
Fork
0
Issue

fix vmp3.x import function used unicorn-engine.

win18216001
win18216001
pushedAt 1 year ago

win18216001/Vm2Import

Vm2Import

fix vmprotect import function used unicorn-engine.

it can repair functions such as call [module.function] or jmp [module.function] that are statically imported by the VM.

Use

  1. copy to x64dbg
x64dbg\release\x32\plugins\unicorn.dll

x64dbg\release\x32\plugins\Vm2Import.dp32

x64dbg\release\x64\plugins\unicorn.dll

x64dbg\release\x64\plugins\Vm2Import.dp64

  1. select "VM_Start" call vmp0.xxxxxxxx, right click menu "Vm2Import"->"Fix Import Call Address"

repair menu preview

  1. repair.

repair preview

original sample:

original preview

ucloud ads