标 题: 【原创】Themida 2260 虚拟机 FISH 初探 （二）
作 者: xiaohang
时 间: 2016-03-03,14:35:18
链 接: http://bbs.pediy.com/showthread.php?t=208217

[v1.8]
- FISH BLACK variant avaible
- Fixed deofuscation order (GenV6)
- New deofucation scheme for FISH machine
- New smart code tracer for FISH machines
- Stack sort for FISH commands
- Improved management of memory (faster deofuscation)
- Added movzx reg32, [esp+eax+memoffset] on CISC machines
- Added a message prompt when the opcode buffer is not enough
- Added LEAVE instruction for FISH machines
- Added support for CALLs to VM section in FISH machines
- CHECK_PROTECTION macro disabled, now it must be restored by hand
- Fixed QWORD incorrect names for some opcodes
- Fixed a problem when deofuscating RISC machines

loc_1003ED83: ; jumptable 1003ED7C case 0
mov ecx, [ebp+arg_0_pTheMidaFishOpcode]
push ecx
mov edx, [ebp+arg_4_pOVopIAT]
push edx
mov ecx, [ebp+var_4]
call j_Make_pop
jmp loc_1003EF53

loc_1003ED98: ; jumptable 1003ED7C case 1
mov eax, [ebp+arg_0_pTheMidaFishOpcode]
push eax
mov ecx, [ebp+arg_4_pOVopIAT]
push ecx
mov ecx, [ebp+var_4]
call j__make_handle_type1_function
jmp loc_1003EF53

loc_1003EDAD: ; jumptable 1003ED7C case 2
mov edx, [ebp+arg_0_pTheMidaFishOpcode]
push edx
mov eax, [ebp+arg_4_pOVopIAT]
push eax
mov ecx, [ebp+var_4]
call j__make_handle_type2_function
jmp loc_1003EF53

[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课