Search found 6 matches

by tmp
Mon Sep 07, 2020 6:01 am
Forum: Technical questions
Topic: VTIL
Replies: 20
Views: 23948

Re: VTIL

Another VTIL-based tool, targetting import protection this time: https://github.com/0xnobody/vmpdump . I know that packing, protecting imports, anti-dumping, memory protection, etc. are not a primary features of VMP but as others have pointed out, there are much bigger open issues right now. VTIL it...
by tmp
Sat Oct 10, 2015 8:43 am
Forum: Technical questions
Topic: VMP 3.0.5 drops support for Windows XP
Replies: 2
Views: 6267

VMP 3.0.5 drops support for Windows XP

The procedure entry point SetFileInformationByHandle could not be located in the dynamic link library KERNEL32.dll VMP itself won't run on XP because SetFileInformationByHandle is supported starting from Windows Vista therefore 3.0.5 drops support for this legacy OS. I had no time yet to test if th...
by tmp
Fri Sep 18, 2015 10:06 am
Forum: Technical questions
Topic: VMP3 - Import and Memory Protection
Replies: 3
Views: 6755

Re: VMP3 - Import and Memory Protection

Sample sent via PM.
by tmp
Thu Sep 17, 2015 8:48 pm
Forum: Technical questions
Topic: VMP3 - Import and Memory Protection
Replies: 3
Views: 6755

VMP3 - Import and Memory Protection

Hi, I was playing around with VMP 3.0.3 and I've noticed there is no import protection at all! All imports are visible under debugger regardless of "Import Protection" setting. IAT of protected application is completely intact. To me looks like a very serious bug. Import Protection is one ...
by tmp
Mon Sep 14, 2015 6:31 pm
Forum: Technical questions
Topic: Floating point instruction virtualization error
Replies: 4
Views: 6750

Re: Floating point instruction virtualization error

Thanks for fixing this issue in 3.0.3.481. Unfortunately I've found another corner case for virtualization:
Image

Again it's suprising that complementary pushad is handled properly but popad is not.
by tmp
Sun Sep 06, 2015 9:13 pm
Forum: Technical questions
Topic: Floating point instruction virtualization error
Replies: 4
Views: 6750

Floating point instruction virtualization error

Hi, I was testing latest version of VMProtect (3.0.2.470) and it seems that it cannot virtualize fldcw instruction. What's interesting its counterpart fstcw compiles without problems. Here's a minimal sample to reproduce this issue (compile using VS): __declspec(noinline) void vmProtectionFailureTes...