Simple VMProtect Loader (C++)

[ZeNiX]

For VMProtect and Themida/WinLicense,
Here is my method for loader.

1. Hook the API near OEP or near your patch point.
2. Check the return address from stack.

Then, you know when your target is unpacked.

[Newbie_Cracker]

Originally Posted by ZeNiX

For VMProtect and Themida/WinLicense,
Here is my method for loader.

1. Hook the API near OEP or near your patch point.
2. Check the return address from stack.

Then, you know when your target is unpacked.

Yeah, It is very useful especially for patching child process created by father process; such as Armadillo, SDProtect, etc.

I always use hook method when loaders like dUP2 fails to patch on time.

So if the VMProtect does not check for API hooking, this method is the best.

[Conquest]

Originally Posted by Newbie_Cracker

Yeah, It is very useful especially for patching child process created by father process; such as Armadillo, SDProtect, etc.

I always use hook method when loaders like dUP2 fails to patch on time.

So if the VMProtect does not check for API hooking, this method is the best.

Problem is ,like themida, vmp uses emulated api as well . so normally its hard to predict which api is "universally free" from api emulation and thus hooking doesnt work in all cases

[0x22]

Originally Posted by Conquest

Problem is ,like themida, vmp uses emulated api as well . so normally its hard to predict which api is "universally free" from api emulation and thus hooking doesnt work in all cases

This has worked bulletproof on VMProtect, Themida and Safengine for several dozen of loaders for me, never had any problems with using this method tbh.

[Conquest]

Originally Posted by 0x22

This has worked bulletproof on VMProtect, Themida and Safengine for several dozen of loaders for me, never had any problems with using this method tbh.

i dont see any link between your message and my statement . it doesnt apply to your method at all .

[0x22]

Originally Posted by Conquest

i dont see any link between your message and my statement . it doesnt apply to your method at all .

I'm sorry i must've misunderstood, my apologies