Simple VMProtect Loader (C++)

[0x22]

Originally Posted by mr.exodia

Hi,

Nice stuff, but could you also explain where you got the constants 0x447E2A and 0x00A89010 ?

Greetings

0x00447E2A is the place where i patched(the crack itself), change it to where you wish to patch.
0x00A89010 is taken from the dump window, anywhere near your previous patch(explained above).
The loader will now know exactly when to patch, not a second before and not a second later(to avoid being caught by the VMP self checks)

In other words when 0x00A89010 is being read by the loader it will read the first bytes in the buffer 0xE4 and then second buffer 0xA6.
If this equals, it will know that "now is the time to insert patch".

Might also explain this:
buffer[0] = 0x90;
buffer[1] = 0x90;
buffer[2] = 0x90;
buffer[3] = 0x90;
buffer[4] = 0x90;

0x90 = nop as we all know,
It will now nop 5 times at 0x00447E2A, -> 90 90 90 90 90