section_prefixes = { ".vmp" };
26 |
27 | vtil::basic_block* lift_il( vtil::basic_block* block, vm_state* vstate );
28 | static vtil::routine* lift_il( vm_state* vstate )
29 | {
30 | if ( vtil::routine* rtn = lift_il( nullptr, vstate )->owner )
31 | return rtn;
32 | return nullptr;
33 | }
34 | };
--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 |
2 |
3 | 
4 |
5 |
6 |
NoVmp
7 |
8 |
9 |
10 | 
11 |
12 |
13 | 
14 |
15 |
16 |
17 |
18 | A static devirtualizer for VMProtect x64 3.x powered by VTIL.
19 |
20 |
21 |
22 | ### VMProtect? Nope.
23 | NoVmp is a project devirtualizing VMProtect x64 3.0 - 3.5 (latest) into optimized VTIL and optionally recompiling back to x64 using the [Virtual-machine Translation Intermediate Language](https://github.com/vtil-project/VTIL-Core) library. It is rather experimental and is mostly a PoC I wanted to release. Most things can be improved especially with the new NativeLifters repo, but it did not exist back in the time this was written.
24 |
25 | # Usage
26 | NoVmp accepts **unpacked binaries**, so if your binary is packed you'll have to dump it first, additionally if you did dump it using a tool like Scylla, you'll have to provide the original image base using the `-base` parameter like so:
27 |
28 | `-base 0x14000000`
29 |
30 | By default NoVmp will parse every single jump into a VM, if you are only interested in a number of **specific** virtualized routines you can use the `-vms` parameter like so with relative virtual addresses:
31 |
32 | `-vms 0x729B81 0x72521`
33 |
34 | These addresses should be pointing at the VMEnter, as shown below:
35 |
36 | 
37 |
38 | By default section discovery is automatic, but in case your calls are not being chained you should try adding the VMProtect section name into the section list using `-sections` as shown below:
39 |
40 | `-sections .xxx0 .yyy0`
41 |
42 | Note that the `.1` section is the merged VMProtect DLL which should not be inputted.
43 |
44 | Additionally you can use any of the following switches:
45 | - `-noopt`: Disables optimization.
46 | - `-opt:constant`: Optimizes the VMProtect Ultra constant obfuscation out.
47 | - `-experimental:recompile`: Enables the experimental x64 compiler.
48 |
49 | # Known bugs
50 | - Known issues from VTIL-Core, mainly the lack of jump table support and propagation passes taking too long/not being great which are being worked on.
51 | - Binaries compiled with relocations stripped are not fully supported yet.
52 | - Experimental compiler is a borderline broken demo, issues related to it should not be submitted as it'll be reworked and will be in VTIL-Core.
53 |
54 | # License
55 | NoVmp is licensed under the GNU General Public License v3.
56 |
--------------------------------------------------------------------------------
/appveyor.yml:
--------------------------------------------------------------------------------
1 | version: 1.0.{build}
2 | image: Visual Studio 2019
3 | build_script:
4 | - cmd: git submodule update --init --recursive
5 | - cmd: mkdir build && cd build
6 | - cmd: cmake ..
7 | - cmd: cmake --build . --config Release
8 |
--------------------------------------------------------------------------------
/assets/logo.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/Tai7sy/NoVmp/6c23c9a335f70e8d5ed6299668fd802f2314c896/assets/logo.png
--------------------------------------------------------------------------------
/assets/vmenter.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/Tai7sy/NoVmp/6c23c9a335f70e8d5ed6299668fd802f2314c896/assets/vmenter.png
--------------------------------------------------------------------------------