首页
社区
课程
招聘
[转帖]Oreans UnVirtualizer 1.3
发表于: 2011-3-28 08:25 15386

[转帖]Oreans UnVirtualizer 1.3

2011-3-28 08:25
15386
Oreans UnVirtualizer ODBG Plug-in (WL/TMD/CV)

[QUOTE=Deathway@exetools]
Hi All 

This tool will help conversion VirtualOpcodes -> Assembly Instruction
restoring the original code of your virtualized Application, the basic engine
was from CodeUnvirtualizer, my other tool

[Features]
- Supports WinLicense/Themida/CodeVirtualizer Cisc Machines
- Supports almost all common opcodes
- Supports CHECK_MACRO_PROTECTION
- Supppots MultiBranch Tech

[Use]
- Right-click on the jump leading to the Virtual Machine Area and press Unvirtualize (If machine isn't found
you have to click again, after checking that the full machine was correctly deofuscated)

[Oreans UnVirtualizer]
[v1.0]
- First public Version

[v1.1]
- Fixed Decode GenV1
- Added CALL [EBX+ESI+0x234234]
- Video logs Added
- Updated OreansJunk.cfg

[v1.2]
- Fixed Decode MovV1
- Added REP - REPNE - CMPS - MOVS - LODS - STOS - SCAS Instructions
- Added CISC-2 Micro-opcodes UnVirtualizer
- Fixed Decode MovV2
- OreansJunk.cfg updated
- OreansAssembler.cfg updated
- Added Virtual Opcode Mutation Tech
- Fixed Jcc Jumps leading outside Virtual Machine
- Fixed Crash on reading Register Handlers
- Cisc_Vo_Dump.txt is no longer created

[v1.3]
- Fixed Identifying Some handler variants
- Added NEG - NOT - BSWAP instructions
- Updated OreansAssembler
- Added Options Panel
- Added Hotkeys
- Added UnVirtualize With/Without Jumps
- Fixed DeOfuscation GenV4
- Added optimization on reading virtual labels
- Updated references panel

[Request]
- Since is almost impossible to create a full database with every opcode combination
I would appreciate if you got errors by some unknown opcodes, wrong decompiled, etc
a full diagnosis including Cisc_Vo_Dump.txt, Cisc_Vo_Syntax.txt, Cisc_Uv_Dump.txt and
Cisc_Iat_XXXXXX.txt file on your report

[/QUOTE]

[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入!

上传的附件:
收藏
免费 0
支持
分享
最新回复 (15)
雪    币: 284
活跃值: (16)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
2
mark太强大了
2011-3-28 08:28
0
雪    币: 4902
活跃值: (120)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
3
非常感谢哈。。。
2011-3-28 10:16
0
雪    币: 8739
活跃值: (5205)
能力值: ( LV4,RANK:50 )
在线值:
发帖
回帖
粉丝
4
强烈支持。。。
2011-11-25 09:45
0
雪    币: 8847
活跃值: (4158)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
5
支持~~~~~~~
2011-11-30 22:02
0
雪    币: 97697
活跃值: (200744)
能力值: (RANK:10 )
在线值:
发帖
回帖
粉丝
6
Oreans UnVirtualizer 1.5

Welcome forum.forum is a home.

Please respect the copyright from the Internet.
Пожалуйста, уважайте авторское право в Интернете.
來源于互聯網, 請尊重版權.
所發資源全部來自對互聯網公共資源的收集和整理,僅供學習之用,請于下載后24小時自行刪除!
Issued by all the resources of public resources from the Internet to collect and collate, study purposes only,
please delete themselves 24 hours after downloading!
Выпущено всеми ресурсами государственных ресурсов из Интернет
а на сбор и обобщение, изучение целей, пожалуйста, удалите себя
24 часов после скачивания!
You can Google.

Программное обеспечение выпуска и Windows Crack Обучение
Нам-Dabei Guanyin Бодхисаттва Нам без митабха
上传的附件:
2012-5-19 18:36
0
雪    币: 97697
活跃值: (200744)
能力值: (RANK:10 )
在线值:
发帖
回帖
粉丝
7
Oreans UnVirtualizer v1.6.rar
上传的附件:
2012-12-29 06:24
0
雪    币: 130
活跃值: (66)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
8
顶。。。thx
2013-1-23 15:47
0
雪    币: 2147
活跃值: (3206)
能力值: (RANK:260 )
在线值:
发帖
回帖
粉丝
9
支持,好东西啊
2013-2-26 02:15
0
雪    币: 97697
活跃值: (200744)
能力值: (RANK:10 )
在线值:
发帖
回帖
粉丝
10
_http://forum.exetools.com/showpost.php?p=89678&postcount=34
[v1.7]
- FISH machine avaible (WHITE and RED variants)
- Added Vm signatures

Hi all, the new version of this plug-in supports the FISH virtual machine, WHITE and RED variants.

Some words about this machine...

It mixes both CISC and RISC architecture, but the code isn't like template anymore, every virtual machine has a new different number of handlers, and every handler contains a different execution path, a little tricky, but nothing that can't be 'devirtualized' , maybe i'll write a paper about FISH and TIGER machines later.

Some specs that aren't coded yet:
- Support for Check macro;
- Sort algo is very unstable
- This plugin may crash when deofuscating very rare sequences, (most of them are 'expected' specially when crash was due to an ud2 instruction).
- Suppor for BLACK variants

... About TIGER, I have no plans for the moment, but it isn't very different from FISH analog.
Plug-in was tested with 2.2.6.0 version, other versions may have variants that this plug-in couldn't handle.


Deathway.

上传的附件:
2014-2-1 15:49
0
雪    币: 627
活跃值: (663)
能力值: ( LV9,RANK:270 )
在线值:
发帖
回帖
粉丝
11
[v1.8]
- FISH BLACK variant avaible
- Fixed deofuscation order (GenV6)
- New deofucation scheme for FISH machine
- New smart code tracer for FISH machines
- Stack sort for FISH commands
- Improved management of memory (faster deofuscation)
- Added movzx reg32, [esp+eax+memoffset] on CISC machines
- Added a message prompt when the opcode buffer is not enough
- Added LEAVE instruction for FISH machines
- Added support for CALLs to VM section in FISH machines
- CHECK_PROTECTION macro disabled, now it must be restored by hand
- Fixed QWORD incorrect names for some opcodes
- Fixed a problem when deofuscating RISC machines


Oreans UnVirtualizer ODBG Plug-in (WL/TMD/CV)
2014-2-7 14:28
0
雪    币: 546
活跃值: (1616)
能力值: ( LV12,RANK:210 )
在线值:
发帖
回帖
粉丝
12
[QUOTE=MistHill;1259513]Oreans UnVirtualizer ODBG Plug-in (WL/TMD/CV)[/QUOTE]

3ks
2014-2-7 19:21
0
雪    币: 4343
活跃值: (4328)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
13
新年快乐    林版,已有1.8  求本地... 辛苦了
2014-2-7 19:29
0
雪    币: 546
活跃值: (1616)
能力值: ( LV12,RANK:210 )
在线值:
发帖
回帖
粉丝
14
论坛备份一份,方便大家下载:

Oreans UnVirtualizer v1.8.rar
上传的附件:
2014-2-7 21:33
0
雪    币: 1844
活跃值: (35)
能力值: ( LV3,RANK:30 )
在线值:
发帖
回帖
粉丝
15
[QUOTE=我是土匪;1259613]论坛备份一份,方便大家下载:

Oreans UnVirtualizer v1.8.rar[/QUOTE]

thx..................... ;):
2014-2-7 23:43
0
雪    币: 5
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
16
为什么这插件的所有输入框都不能输入字符? 换了好几个版本都是如此.
2015-8-7 18:21
0
游客
登录 | 注册 方可回帖
返回
//