Hi, I'm trying to manual map a protected dll but it's not working, the code use to work with the previous version of vmprotect (2.x), there is some option that I should disable or something?
Regards
Manual Mapping
Re: Manual Mapping
Could you send us a test example (original DLL+MAP+VMP and very simple EXE that loads protected DLL)?
Re: Manual Mapping
It seems that your application doesn't support exception handling in manual mapping DLLs.
For example very simple DLL:
This DLL (without protection with VMProtect) crashes after manual mapping, but after LoadLibrary works fine.
P.S. For loading DLL from "memory" we recommend to use the section "Files" in VMProtect Ultimate.
For example very simple DLL:
Code: Select all
#include "stdafx.h"
#include <iostream>
BOOL APIENTRY DllMain( HMODULE hModule,
DWORD ul_reason_for_call,
LPVOID lpReserved
)
{
switch (ul_reason_for_call)
{
case DLL_PROCESS_ATTACH:
__try {
throw 1;
} __except(EXCEPTION_EXECUTE_HANDLER) {
std::cout << "catch in DLL\n";
}
break;
case DLL_THREAD_ATTACH:
case DLL_THREAD_DETACH:
case DLL_PROCESS_DETACH:
break;
}
return TRUE;
}
P.S. For loading DLL from "memory" we recommend to use the section "Files" in VMProtect Ultimate.
- Attachments
-
- VMTestDll.rar
- (4.33 KiB) Downloaded 550 times
Re: Manual Mapping
Mm, but that's not the problem, if I use ZwCreateSection & ZwMapViewOfSection dll loads Ok, I've send you a new example showing this and also an image showing that in both methods sections seems to be equally loaded, also if I dump the memory and compare, both are equals, but when is manual crash :S.
Regards
Regards
- Attachments
-
- all.png (17.35 KiB) Viewed 13103 times
Re: Manual Mapping
I don't think so. I can recommend you to compare results of VirtualQuery for both cases (I mean MEMORY_BASIC_INFORMATION.Type).if I dump the memory and compare, both are equals
After that I recommend you to analyze code of __except_handler_3 (it's default exception handler of MSVC runtime).
Good luck )
Re: Manual Mapping
Finally I make it work, I just need to disable "Virtualization Tools" detection from options and works! I don't know why with this option enabled fail, but, I don't care if it's open on a virtual machine .
Regards
Regards