Page 1 of 1
Manual Mapping
Posted: Sat Nov 28, 2015 3:23 pm
by karman
Hi, I'm trying to manual map a protected dll but it's not working, the code use to work with the previous version of vmprotect (2.x), there is some option that I should disable or something?
Regards
Re: Manual Mapping
Posted: Tue Dec 01, 2015 7:22 am
by Admin
Could you send us a test example (original DLL+MAP+VMP and very simple EXE that loads protected DLL)?
Re: Manual Mapping
Posted: Tue Dec 01, 2015 10:49 pm
by karman
Sended file by email to
info@vmpsoft.com.
Regards
Re: Manual Mapping
Posted: Wed Dec 02, 2015 2:06 pm
by Admin
It seems that your application doesn't support exception handling in manual mapping DLLs.
For example very simple DLL:
Code: Select all
#include "stdafx.h"
#include <iostream>
BOOL APIENTRY DllMain( HMODULE hModule,
DWORD ul_reason_for_call,
LPVOID lpReserved
)
{
switch (ul_reason_for_call)
{
case DLL_PROCESS_ATTACH:
__try {
throw 1;
} __except(EXCEPTION_EXECUTE_HANDLER) {
std::cout << "catch in DLL\n";
}
break;
case DLL_THREAD_ATTACH:
case DLL_THREAD_DETACH:
case DLL_PROCESS_DETACH:
break;
}
return TRUE;
}
This DLL (without protection with VMProtect) crashes after manual mapping, but after LoadLibrary works fine.
P.S. For loading DLL from "memory" we recommend to use the section "Files" in VMProtect Ultimate.
Re: Manual Mapping
Posted: Wed Dec 02, 2015 11:23 pm
by karman
Mm, but that's not the problem, if I use ZwCreateSection & ZwMapViewOfSection dll loads Ok, I've send you a new example showing this and also an image showing that in both methods sections seems to be equally loaded, also if I dump the memory and compare, both are equals, but when is manual crash :S.
Regards
Re: Manual Mapping
Posted: Thu Dec 03, 2015 3:31 am
by Admin
if I dump the memory and compare, both are equals
I don't think so. I can recommend you to compare results of VirtualQuery for both cases (I mean MEMORY_BASIC_INFORMATION.Type).
After that I recommend you to analyze code of __except_handler_3 (it's default exception handler of MSVC runtime).
Good luck
)
Re: Manual Mapping
Posted: Thu Dec 03, 2015 1:03 pm
by karman
Finally I make it work, I just need to disable "Virtualization Tools" detection from options and works! I don't know why with this option enabled fail, but, I don't care if it's open on a virtual machine
.
Regards