VM decompiler tool (VMProtect, CodeVirtualizer)

[ahmadmansoor]

Welcome Vam between us .... and Thanks for response .
I will send the target to ur PM , sorry from all , it is a private software .


Edit:

after it decoded "kernel32.GetVersion" , it produce the trc file , but not produce log file and olly exit

005C83ED 8DBF EC6A>lea edi, dword ptr [edi+B5826AEC]

in trc file it end at

0x0053992D: ret 58h

but the function end at

005C8415 C2 4000 ret 40
to back to this :

00447370 E8 0F6F12>call unpacked.0056E284 >>>>> Function
00447375 57 push edi >>>> back from ret 40
00447376 FFD6 call near esi ; kernel32.GetVersion

does VMware affect on the work of this plugin or not ??!!

[Vam]

I will send the target to ur PM

Has not understood in what a problem. At me Analyse all VM references passes successfully. Truth IAT restores not completely. Finds some inputs in VM. Decompiling goes, but there are errors, the code of functions is desirable for decompiling, that the point of an entry in VM was in a way of execution of a code.
When you give the information from trc or log a file that inform their address.