• Stars
    star
    223
  • Rank 178,458 (Top 4 %)
  • Language
    C++
  • License
    The Unlicense
  • Created almost 3 years ago
  • Updated almost 3 years ago

Reviews

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Repository Details

Universal x86/x64 VMProtect 2.0-3.X Import fixer

vmpfix

VMPfix is a dynamic x86/x64 VMProtect 2.0-3.x import fixer. The main goal of this project was to build correct and reliable tool to fix imports in x86/x64 applications.

Note: this tool does not dump and rebuild import directory. You can do this from your favorite debugger.

Before

After

Usage

vmpfix.exe
-p: required.
Usage: Universal VMProtect Import fixer [options]

Optional arguments:
-h --help       shows help message and exits [default: false]
-v --version    prints version information and exits [default: false]
-p --pid        Target process id [required]
-s --sections   VMProtect sections in target module [default: {".vmp0" ".vmp1" ".be1" ".be0"}]
-i --iat        New IAT section name [default: ".vmp0"]
-m --module     VMProtected module name (default: main executable) [default: ""]

Example commands:

vmpfix.exe -p 3336 -m beservice_x64.exe -s .be0 -s .be1 -i .be0
vmpfix.exe -p 11250

VMProtect unpacking must be complete before running VMPfix.

Details

There are 3 types of IAT accesses that VMProtect patches: call, jmp and mov. Every stub resolves protected import with only 3 instructions:

lea reg, [imm]
mov reg, [reg + imm]
lea reg, [reg + imm]

Although stubs are obfuscated, there are only handful of instructions that matters:

push
pop
lea
mov
xchg
ret

Call stubs

Every call stub ends with xchg instruction:

call [IAT] -> call .vmp1; int3:

[!] push        rax
[!] mov         rax,qword ptr [rsp+8]
[!] lea         rax,[rax+1]
[!] mov         qword ptr [rsp+8],rax
[!] lea         rax,[1401269B2h]
[!] mov         rax,qword ptr [rax+0FE1D0h]
[!] lea         rax,[rax+445A4C4Eh]
[!] xchg        rax,qword ptr [rsp]
[!] ret

call [IAT] -> push rcx; call .vmp1:

[!] pop         rsi
[!] xchg        rsi,qword ptr [rsp]
[!] push        rsi
[!] lea         rsi,[1401832EDh]
[!] mov         rsi,qword ptr [rsi+0A7558h]
[!] lea         rsi,[rsi+49C80AACh]
[!] xchg        rsi,qword ptr [rsp]
[!] ret

Jmp stubs

Every jmp stub ends with ret 4/8 instruction:

jmp [IAT] -> push rcx; call .vmp1:

[!] pop         rcx
[!] xchg        rcx,qword ptr [rsp]
[!] push        rcx
[!] lea         rcx,[1400EE9C4h]
[!] mov         rcx,qword ptr [rcx+14F6B2h]
[!] lea         rcx,[rcx+36F801BAh]
[!] xchg        rcx,qword ptr [rsp]
[!] ret         8

Mov stubs

Every other stub can be considered as mov stub. There are some patterns as well. E.g. there is no ret 8 or xchg at the end.

mov rsi, [IAT] -> push rsi; call .vmp1:

[!] pop         rsi
[!] xchg        rsi,qword ptr [rsp]
[!] pop         rsi
[!] lea         rsi,[rsi+1]
[!] push        rsi
[!] lea         rsi,[14015634Fh]
[!] mov         rsi,qword ptr [rsi+0EF63Ch]
[!] lea         rsi,[rsi+0C2B009Ah]
[!] ret

Build

git clone --recurse-submodules https://github.com/archercreat/vmpfix.git
cd vmpfix
cmake -B build
cmake --build build

Tests

Successfully unpacked, dumped and ran:

steam.exe x86 752ac6ab6ec58c14bcbae0409ac732e4846a37838919806d1cf1b4cd19095f82

vncviewer.exe x64 4158a5e55cbd6a5a8f4ed38befe2a8c9fa0c7a7fbc91709a31592dda95110517

Credits

https://github.com/build-cpp/cmkr

https://github.com/can1357/linux-pe

https://github.com/DarthTon/Blackbone

TODO

  • kernel support