Oreans UnVirtualizer ODBG Plug-in (WL/TMD/CV)

[estelle]

10062200 55 PUSH EBP
10062201 8BEC MOV EBP,ESP
10062203 6A FF PUSH -1
10062205 68 1F8C0810 PUSH mapledll.10088C1F
1006220A 64:A1 00000000 MOV EAX,DWORD PTR FS:[0]
10062210 50 PUSH EAX
10062211 B8 B43B0000 MOV EAX,3BB4
10062216 E8 E5F00000 CALL mapledll.10071300
1006221B A1 10BA0910 MOV EAX,DWORD PTR DS:[1009BA10]
10062220 33C5 XOR EAX,EBP
10062222 8945 F0 MOV DWORD PTR SS:[EBP-10],EAX
10062225 56 PUSH ESI
10062226 57 PUSH EDI
10062227 50 PUSH EAX
10062228 8D45 F4 LEA EAX,DWORD PTR SS:[EBP-C]
1006222B 64:A3 00000000 MOV DWORD PTR FS:[0],EAX
10062231 - E9 A2E92B00 JMP mapledll.10320BD8




@Label_10311F0B
10311F45 XOR EDX,EDX
10311F84 MOV ECX,0x8
10311FA4 DIV ECX
10311FE7 PUSH EDX
10311FF0 00D1
10311FF1 001C(00000007)
10311FFC 0018
10311FFD SBB EDX,EDX
10312037 PUSH EDX
10312044 00D1
10312045 001C(00000007)
10312050 0018
10312056 MOV BYTE PTR [EBP+0xffffc5bb],DL
10312088 MOV BYTE PTR [EBP+0xfffffffc],0x6
103120A2 LEA ECX,DWORD PTR [EBP+0xffffffb8]
103120F6 CALL 0x10002160

[Deathway]

Originally Posted by estelle

10062200 55 PUSH EBP
10062201 8BEC MOV EBP,ESP
10062203 6A FF PUSH -1
10062205 68 1F8C0810 PUSH mapledll.10088C1F
1006220A 64:A1 00000000 MOV EAX,DWORD PTR FS:[0]
10062210 50 PUSH EAX
10062211 B8 B43B0000 MOV EAX,3BB4
10062216 E8 E5F00000 CALL mapledll.10071300
1006221B A1 10BA0910 MOV EAX,DWORD PTR DS:[1009BA10]
10062220 33C5 XOR EAX,EBP
10062222 8945 F0 MOV DWORD PTR SS:[EBP-10],EAX
10062225 56 PUSH ESI
10062226 57 PUSH EDI
10062227 50 PUSH EAX
10062228 8D45 F4 LEA EAX,DWORD PTR SS:[EBP-C]
1006222B 64:A3 00000000 MOV DWORD PTR FS:[0],EAX
10062231 - E9 A2E92B00 JMP mapledll.10320BD8




@Label_10311F0B
10311F45 XOR EDX,EDX
10311F84 MOV ECX,0x8
10311FA4 DIV ECX
10311FE7 PUSH EDX
10311FF0 00D1
10311FF1 001C(00000007)
10311FFC 0018
10311FFD SBB EDX,EDX
10312037 PUSH EDX
10312044 00D1
10312045 001C(00000007)
10312050 0018
10312056 MOV BYTE PTR [EBP+0xffffc5bb],DL
10312088 MOV BYTE PTR [EBP+0xfffffffc],0x6
103120A2 LEA ECX,DWORD PTR [EBP+0xffffffb8]
103120F6 CALL 0x10002160

That's weird, that sequence was already translate, could you send me a PM along with the target

@all
A CRITICAL ERROR was found on version 1.3 and lower, if the unvirtualization routine has SHL, SHR, ROR, ROL, RCL, RCR, It was wrong unvirtualized. It will be fixed on next version (along with the ImageBase, ESP+REG32+MOFFS, minor bugs)

PD2: People are/is asking about RISC UnVirtualization, Today I've managed to get my first Handler dumps about this machine, but unfortunately, the final handlers are mix of the original (I mean three or 4 thunks make one Virtual Handler on the exe/dll), it doesn't preserve registers (possible lost of data when deofuscation). However if the small thunks are enough predictable, I'll do my best effort to bring you this feature (Not promise yet )

[estelle]

Originally Posted by Deathway

That's weird, that sequence was already translate, could you send me a PM along with the target

@all
A CRITICAL ERROR was found on version 1.3 and lower, if the unvirtualization routine has SHL, SHR, ROR, ROL, RCL, RCR, It was wrong unvirtualized. It will be fixed on next version (along with the ImageBase, ESP+REG32+MOFFS, minor bugs)

PD2: People are/is asking about RISC UnVirtualization, Today I've managed to get my first Handler dumps about this machine, but unfortunately, the final handlers are mix of the original (I mean three or 4 thunks make one Virtual Handler on the exe/dll), it doesn't preserve registers (possible lost of data when deofuscation). However if the small thunks are enough predictable, I'll do my best effort to bring you this feature (Not promise yet )

Look at email