This repository has been archived by the owner on Jan 9, 2022. It is now read-only.

如何识别 vmp 版本呢？ #1

Open

neighbads opened this issue Mar 22, 2018 · 1 comment

neighbads commented Mar 22, 2018

No description provided.

Owner

lmy375 commented Mar 22, 2018

外壳可以通过 exeinfo 和 peid 查。但结果比较粗略不一定准备

1.x 和 2.x 虚拟机都比较类似能找到解释循环代码中形如 mov edx, dword ptr [eax*4+0x404cf8] / ret 之类的指令

3.x 整体解释执行结构变了指令跳转变成链式结构靠 jmp edi 指令

这些指令特征可以作为识别版本的一点参考

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.