-
Notifications
You must be signed in to change notification settings - Fork 71
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
fjqisba
committed
Nov 6, 2023
0 parents
commit 858a020
Showing
4 changed files
with
73 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,18 @@ | ||
# VmpHelper | ||
|
||
一款基于Ghidra反编译引擎编写的IDA插件,目前还在开发当中 | ||
|
||
仅支持Vmp3.5 x86 | ||
|
||
使用方法: | ||
|
||
1、将Ghidra目录和GhidraVmp.dll放置于IDA插件目录下 | ||
|
||
2、在程序的VMP入口处,右键弹出菜单 -> Vmp -> Show Graph打印出流程图 | ||
|
||
## 赞助本项目 | ||
|
||
如果你觉得本插件对你有帮助,可以请作者吃顿饭 | ||
|
||
 | ||
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,6 @@ | ||
git checkout --orphan newBranch | ||
git add -A | ||
git commit -am "commit message" | ||
git branch -D main | ||
git branch -m main | ||
git push -f origin main |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,49 @@ | ||
# 开发者日志 | ||
|
||
2023年11月5日 | ||
|
||
优化对VM BasicBlock入口的识别,修复对BSR、CMOVB、JMP这一类分支指令的一处处理Bug | ||
|
||
2023年11月4日 | ||
|
||
初步完成VM控制流程图打印 | ||
|
||
2023年10月28日 | ||
|
||
开始编写IDA插件,需要重新优化寄存器识别,以精准识别出vm代码寄存器和堆栈寄存器。 | ||
|
||
2023年9月27日 | ||
|
||
调研vmp纯静态反编译的可行性,开始处理静态分析代码 | ||
|
||
2023年9月13日 | ||
|
||
对抗unicorn检测,优化unicorn跟踪逻辑 | ||
|
||
2023年9月9日 | ||
|
||
开始编写vmp38的handler解析规则 | ||
|
||
2023年9月7日 | ||
|
||
进一步针对vmp3.8的堆栈混淆指令进行优化,增加对堆栈读写结果记录 | ||
|
||
2023年9月5日 | ||
|
||
处理vmp3.8堆栈混淆指令,优化对BSR、CMOVB、JMP这一类分支指令的处理 | ||
|
||
2023年8月30日 | ||
|
||
增加vCpuid和vShl指令的识别 | ||
|
||
2023年8月29日 | ||
|
||
优化VmInitHandler识别和打印处理 | ||
|
||
2023年8月28日 | ||
|
||
修复vJmp的Handler识别Bug,增加vWriteMem和vRdtsc两个Handler | ||
|
||
2023年8月27日 | ||
|
||
搭建好框架,完成Demo测试版本 |