VMProtect 2 IL: Intermediate level of representation, or language. Other metadata about a given code block is also contained inside of this structure such as if the code block branches to two other code blocks, branches to only one code block, or exits the virtual machine.

A code block is represented in C++ as a structure ( vm::instrs::code_block_t) containing a vector of virtual instructions, along with the beginning address of the code block contained in the structure itself. An example of this would be any instructions following a JMP instruction and the next JMP or VMEXIT instruction. Rather, the creator(s) of said software are to be respected as their work is clearly impressive and has arguably stood the test of time.Ĭode Block: A virtual instruction block, or code block, is a sequence of virtual instructions which are contained between virtual branching instructions. My intentions behind this research is to further my knowledge in the subject of software protection via native code virtualization, and code obfuscation, it is not to profit nor slander the name of VMProtect. This article will also showcase all projects on /vmp2, however, these projects are subject to change. In addition, this post will focus primarily on the creation of static analysis tools using the knowledge disclosed in the prior post, and providing some detailed, albut unofficial, VTIL documentation. The purpose of this article is to expound upon the prior work disclosed in the last article titled “VMProtect 2 - Detailed Analysis of the Virtual Machine Architecture”, as well as correct a few mistakes. Conclusion - Final Words and Future Work.VMAssembler - Stage Four, C++ Header Generation.VMAssembler - Stage Three, Virtual Instruction Encryption.VMAssembler - Stage Two, Virtual Instruction Encoding.VMAssembler - Stage One, Lexical Analysis and Parsing.VMEmu - Unicorn Engine, Static Decryption Of Opcodes.VMProfiler - Virtual Branch Detection Algorithm.VMProfiler - Virtual Machine Handler Profiling.

Using namespace qt ida pro