{"id":31254,"date":"2023-11-14T07:18:27","date_gmt":"2023-11-14T07:18:27","guid":{"rendered":"https:\/\/kalilinuxtutorials.com\/?p=31254"},"modified":"2023-11-14T07:18:30","modified_gmt":"2023-11-14T07:18:30","slug":"novmp","status":"publish","type":"post","link":"https:\/\/kalilinuxtutorials.com\/novmp\/","title":{"rendered":"NoVmp – Unlocking VMProtect x64 With VTIL-Powered Devirtualization"},"content":{"rendered":"\n

Welcome to the world of NoVmp, a groundbreaking project that aims to unravel the complexities of VMProtect x64 3.0 – 3.5. <\/p>\n\n\n\n

In this article, we’ll dive into the intriguing realm of devirtualization, exploring how NoVmp utilizes VTIL (Virtual-machine Translation Intermediate Language) to breathe new life into protected binaries. <\/p>\n\n\n\n

Get ready to unlock the secrets of VMProtect and discover the power of NoVmp.<\/p>\n\n\n\n

VMProtect? Nope.<\/strong><\/a><\/h2>\n\n\n\n

NoVmp is a project devirtualizing VMProtect x64 3.0 – 3.5 (latest) into optimized VTIL and optionally recompiling back to x64 using the\u00a0Virtual-machine Translation Intermediate Language<\/a>\u00a0library. It is rather experimental and is mostly a PoC I wanted to release. Most things can be improved especially with the new NativeLifters repo, but it did not exist back in the time this was written.<\/p>\n\n\n\n

Usage<\/strong><\/a><\/h2>\n\n\n\n

NoVmp accepts unpacked binaries<\/strong>, so if your binary is packed you’ll have to dump it first, additionally if you did dump it using a tool like Scylla, you’ll have to provide the original image base using the -base<\/code> parameter like so:<\/p>\n\n\n\n

-base 0x14000000<\/code><\/p>\n\n\n\n

By default NoVmp will parse every single jump into a VM, if you are only interested in a number of specific<\/strong> virtualized routines you can use the -vms<\/code> parameter like so with relative virtual addresses:<\/p>\n\n\n\n

-vms 0x729B81 0x72521<\/code><\/p>\n\n\n\n

These addresses should be pointing at the VMEnter, as shown below:<\/p>\n\n\n\n

<\/p>\n\n\n\n

By default section discovery is automatic, but in case your calls are not being chained you should try adding the VMProtect section name into the section list using -sections<\/code> as shown below:<\/p>\n\n\n\n

-sections .xxx0 .yyy0<\/code><\/p>\n\n\n\n

Note that the .<vmp>1<\/code> section is the merged VMProtect DLL which should not be inputted.<\/p>\n\n\n\n

Additionally you can use any of the following switches:<\/p>\n\n\n\n