[讨论]一个VMP1.20程序的伪指令总结-软件逆向-看雪-安全社区|安全招聘|kanxue.com

[讨论]一个VMP1.20程序的伪指令总结

发表于: 2007-11-7 23:12 12913

[讨论]一个VMP1.20程序的伪指令总结

wangdell

2007-11-7 23:12

12913

一个VMP1.20程序伪指令总结

参照几位牛人的精华贴，依葫芦画瓢总结如下：
1、VMP1.20的伪指令和VMP1.22略有不同：VMP1.20很多双字节的指令到1.22中是单字节的，1.22的SWITCH到跳转表通常使用的是jmp命令，1.20通常使用retn。。。。
2、使用堆栈进行交互和传递参数。
3、分为单字节、双字节（操作数1个字节），三字节（操作数2个字节），5字节指令（操作数4字节）如下几个伪指令
  序  号  :[跳转表地址]->跳转地址  ||[机器码地址]->机器码操作数 | 栈 |伪指令
第000061条:[0x1000141A]->0x100017DE||[0x10023F87]->0x29       |0036|VM_PUSH_ESP
第000062条:[0x10001726]->0x10001A41||[0x10023F88]->0xec 32b3b174 |0032|VM_PUSH_IMM
第000063条:[0x1000153E]->0x10001B68||[0x10023F8D]->0x72 9b61    |0030|VM_PUSHW_IMMW
第000064条:[0x1000165E]->0x100012FD||[0x10023F90]->0xba 07    |0032|VM_POPW_CONTEXT
4、按功能分：POP类，PUSH类，MOV类，Shift类，MUL/ADD/DIV类，Float类，杂类（包括RET和wait等）
助记名称规则：W为字操作指令，B为byte操作指令，_F为有标志位操作
PUSH类：
VM_PUSHW                   1000177F
VM_PUSHW_CONTEXT          10001957
VM_PUSHW_CONTEXTBH          100019A7
VM_PUSHW_CONTEXTBL          10001A61
VM_PUSHW_IMMW             10001B68
VM_PUSH_CONTEXT             10001AB3
VM_PUSH_CR0                1000185E
VM_PUSH_CR1                10001164
VM_PUSH_CR2                10001820
VM_PUSH_CR3                100012D9
VM_PUSH_CR4                10001776
VM_PUSH_CR5                10001A31
VM_PUSH_CR6                10001AF6
VM_PUSH_CR7                100012F4
VM_PUSH_CS                10001B44
VM_PUSH_DR0                100045CB
VM_PUSH_DR1                100012EB
VM_PUSH_DR2                10001180
VM_PUSH_DR3                10001090
VM_PUSH_DR4                10001087
VM_PUSH_DR5                10001019
VM_PUSH_DR6                100010F6
VM_PUSH_DR7                10001855
VM_PUSH_DS                1000123B
VM_PUSH_ES                1000122C
VM_PUSH_ESP                100017DE
VM_PUSH_FS                1000114D
VM_PUSH_GS                100045A7
VM_PUSH_IMM                10001A41
VM_PUSH_IMMB                10001099
VM_PUSH_IMMW                100019F7
VM_PUSH_SP                1000458F
VM_PUSH_SS                1000184B

POP类：
VM_POPW_CONTEXT             100012FD
VM_POPW_CONTEXTBH          10001867
VM_POPW_CONTEXTBL          10001BE1
VM_POP_CONTEXT             10001BBB
VM_POP_CR0                100012E2
VM_POP_CR1                100018E7
VM_POP_CR2                100012A8
VM_POP_CR3                10001032
VM_POP_CR4                100018DE
VM_POP_CR5                10001A9E
VM_POP_CR6                1000116D
VM_POP_CR7                10001A7B
VM_POP_CX                   10001368
VM_POP_DR0                100017B7
VM_POP_DR1                1000119F
VM_POP_DR2                10001AED
VM_POP_DR3                10001BFB
VM_POP_DR4                10001BA7
VM_POP_DR5                10001945
VM_POP_DR6                1000113A
VM_POP_DR7                100011B0
VM_POP_DS                   100018F0
VM_POP_ECX                100018B4
VM_POP_ES                   100012CF
VM_POP_ESP                100011CB
VM_POP_FS                   100011A8
VM_POP_GS                   100045C1
VM_POP_SP                   1000102B

MUL/ADD/DIV类：
VM_ADD                      10001838
VM_ADDB                   100010DD
VM_ADDB_F                   10001AA7
VM_ADDW                   10001BB0
VM_ADDW_F                   100012B1
VM_ADD_F                   100019C2
VM_DIV                      1000190A
VM_DIVW                   100010CB
VM_DIVW_QUOTIENT          10001123
VM_IDIV                   100018A8
VM_IDIVW                   1000121A
VM_IDIVW_QUOTIENT          10001B24
VM_IMULB_F                1000104A
VM_IMULW_F                1000124A
VM_IMUL_F                   10001157
VM_MULB_F                   1000196D
VM_MULW_F                   1000197C
VM_MUL_F                   100019EA

FLOAT类：
VM_F2XM1                   10001898
VM_FABS                   100011F9
VM_FADD                   100018BA
VM_FADDQ                   10001060
VM_FCHS                   10001998
VM_FCOMP                   10001AE5
VM_FCOMPQ                   1000199F
VM_FCOS                   1000136F
VM_FDECSTP                10001AFF
VM_FDIV                   10001233
VM_FDIVQ                   100017EF
VM_FILD                   1000455C
VM_FILDQ                   10001916
VM_FINCSTP                10001071
VM_FISTP                   10004554
VM_FISTPQ                   100012A0
VM_FISTPW                   1000100A
VM_FISUB                   10001200
VM_FISUBW                   10001B52
VM_FLD                      10001932
VM_FLD1                   100010FF
VM_FLDCW                   100017A8
VM_FLDLG2                   100017B0
VM_FLDLN2                   10001346
VM_FLDPI                   10001A3A
VM_FLDQ                   10001208
VM_FLDT                   10001B15
VM_FLDZ                   10001B1D
VM_FMUL                   10001242
VM_FMULQ                   10001A84
VM_FNCLEX                   10001059
VM_FNINIT                   100017CA
VM_FNSTCWW                100018F7
VM_FNSTSWW                10001A28
VM_FPATAN                   10001829
VM_FPREM                   1000453A
VM_FPREM1                   100010EF
VM_FPTAN                   10001B4B
VM_FRNDINT                100019DC
VM_FSIN                   1000133F
VM_FSQRT                   10001012
VM_FST                      100010E7
VM_FSTP                   10001830
VM_FSTPQ                   1000457D
VM_FSTPT                   10001890
VM_FSTQ                   100018CF
VM_FSUB                   10001B85
VM_FSUBQ                   10001805
VM_FSUBR                   10001197
VM_FSUBRQ                   100011C3
VM_FTST                   100018D7
VM_FYL2X                   100019E3

MOV类（分为byte,Word,DW几种），将[esp+0]定义为参数A,[esp+sizeof(operand)]定义为参数B,
VM_MOVB_A_TO_B             10004571
VM_MOVB_B_TO_A             100011EF
VM_MOVB_B_TO_CSA          10001ACA
VM_MOVB_B_TO_ESA          100011E4
VM_MOVB_B_TO_FSA          100017E4
VM_MOVB_B_TO_GSA          1000193A
VM_MOVB_B_TO_SSA          1000135D
VM_MOVB_CSA_TO_B          1000191E
VM_MOVB_GSA_TO_B          100010C0
VM_MOVW_A_TO_B             10001887
VM_MOVW_A_TO_SS             100011B9
VM_MOVW_B_TO_A             10001B31
VM_MOVW_B_TO_CSA          10001176
VM_MOVW_B_TO_ESA          100017C0
VM_MOVW_B_TO_FSA          1000125C
VM_MOVW_B_TO_GSA          100045AF
VM_MOVW_B_TO_SSA          1000198E
VM_MOVW_CSA_TO_B          10001B3A
VM_MOVW_ESA_TO_B          10001143
VM_MOVW_FSA_TO_B          10001130
VM_MOVW_GSA_TO_B          10001841
VM_MOVW_SSA_TO_B          10004585
VM_MOVZXB_ESA_TO_B          10001B9A
VM_MOVZXB_FSA_TO_B          100018C2
VM_MOVZXB_SSA_TO_B          10001BD4
VM_MOV_A_TO_B             10004541
VM_MOV_B_TO_A             100045B9
VM_MOV_B_TO_CSA             10001068
VM_MOV_B_TO_ESA             10001078
VM_MOV_B_TO_FSA             1000194E
VM_MOV_B_TO_GSA             10001A95
VM_MOV_B_TO_SSA             10001929
VM_MOV_CSA_TO_B             10001A8C
VM_MOV_ESA_TO_B             1000179F
VM_MOV_FSA_TO_B             10001022
VM_MOV_GSA_TO_B             1000189F
VM_MOV_SSA_TO_B             1000111A


移位类
VM_SHL                      10004549
VM_SHLB                   10004564
VM_SHLB_F                   100019CD
VM_SHLD_F                   10001811
VM_SHLW                   10004599
VM_SHLW_F                   1000134D
VM_SHL_F                   10001B8D
VM_SHR                      100018FF
VM_SHRB                   10001322
VM_SHRB_F                   10001313
VM_SHRD_F                   10001B06
VM_SHRW                   10001B5A
VM_SHRW_F                   10001AD5
VM_SHR_F                   100017D1

变形类
VM_NA_B_ANDW                100017F7
VM_NA_B_ANDW_F             1000132F
VM_NA_NB_AND                10001189
VM_NA_NB_ANDW             100012BE
VM_NA_NB_ANDW_F             100011D1
VM_NA_NB_AND_F             10001A14

杂类
VM_RETF                   1000180D
VM_RETN                   10001A24
VM_WAIT                   10001081

5、伪指令
; ???????????????????????????????????????????????????????????????????????????
VM_PUSH_DR5:                         ;
            mov    ecx, dr5
            push ecx
            jmp    VMLoop_EP    ; fetch Instruction Byte
; ???????????????????????????????????????????????????????????????????????????
VM_MOV_FSA_TO_B:                      ; DATA XREF: ????13CEo
            pop    edx
            push dword ptr fs:[edx]
            jmp    VMLoop_EP    ; fetch Instruction Byte
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_POP_SP    proc near
            pop    sp
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_POP_SP    endp
; ???????????????????????????????????????????????????????????????????????????
VM_POP_CR3:
            pop    edx
            mov    cr3, edx
            jmp    VMLoop_EP    ; fetch Instruction Byte
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_IMULB_F    proc near
            pop    dx
            pop    ax
            imul dl
            push ax
            pushfw
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_IMULB_F    endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_FNCLEX    proc near             ; DATA XREF: ????1602o
            fnclex
            jmp    VMLoop_EP    ; fetch Instruction Byte

VM_FNCLEX    endp
; ???????????????????????????????????????????????????????????????????????????
VM_FADDQ:                            ; DATA XREF: ????137Eo
            fadd qword ptr [esp]
            jmp    VMLoop_EP    ; fetch Instruction Byte
; ???????????????????????????????????????????????????????????????????????????
VM_MOV_B_TO_CSA:                      ; DATA XREF: ????1392o
            pop    ecx          ; des?
            pop    dword ptr cs:[ecx] ; src?
            jmp    VMLoop_EP    ; fetch Instruction Byte
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_FINCSTP    proc near             ; DATA XREF: ????15B2o
                                    ; ????15D6o
            fincstp
            jmp    VMLoop_EP    ; fetch Instruction Byte

VM_FINCSTP    endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_MOV_B_TO_ESA proc near             ; DATA XREF: ????14B6o
            pop    edx
            pop    dword ptr es:[edx]
            jmp    VMLoop_EP    ; fetch Instruction Byte

VM_MOV_B_TO_ESA endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_WAIT       proc near             ; DATA XREF: ????146Eo
            wait
            jmp    VMLoop_EP    ; fetch Instruction Byte

VM_WAIT       endp
; ???????????????????????????????????????????????????????????????????????????
VM_PUSH_DR4:                         ; DATA XREF: ????1516o
            mov    edx, dr4
            push edx
            jmp    VMLoop_EP    ; fetch Instruction Byte
; ???????????????????????????????????????????????????????????????????????????
VM_PUSH_DR3:                         ; DATA XREF: ????170Eo
            mov    eax, dr3
            push eax
            jmp    VMLoop_EP    ; fetch Instruction Byte
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_PUSH_IMMB proc near             ; DATA XREF: ????145Eo
            movzx eax, byte ptr [esi]
            add    al, bl
            sub    al, 0C4h
            lea    esi, [esi+1]
            not    al
            inc    al
            ror    al, 5
            inc    al
            ror    al, 6
            not    al
            add    al, 85h
            ror    al, 1
            add    bl, al
            cbw
            cwde
            push eax
            jmp    VMLoop_EP    ; fetch Instruction Byte

VM_PUSH_IMMB endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_MOVB_GSA_TO_B proc near             ; DATA XREF: ????1592o
            pop    edx
            mov    al, gs:[edx]
            push ax
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_MOVB_GSA_TO_B endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_DIVW       proc near             ; DATA XREF: ????1562o
            pop    dx
            pop    ax
            pop    cx
            div    cx
            push ax
            push dx
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_DIVW       endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_ADDB       proc near             ; DATA XREF: ????16D6o
            pop    dx
            add    [esp+0], dl
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_ADDB       endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_FST       proc near             ; DATA XREF: ????1652o
            fst    dword ptr [esp+0]
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_FST       endp
; ???????????????????????????????????????????????????????????????????????????
VM_FPREM1:                            ; DATA XREF: ????13BAo
            fprem1                ; è?óàêy￡¨IEEE￡?￡?í?FPREM￡?μ?ê?ê1ó?IEEE±ê×?[486]
            jmp    VMLoop_EP    ; fetch Instruction Byte
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_PUSH_DR6    proc near             ; DATA XREF: ????166Ao
            mov    ecx, dr6
            push ecx
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_PUSH_DR6    endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_FLD1       proc near             ; DATA XREF: ????168Ao
            fld1
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_FLD1       endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_MOV_SSA_TO_B proc near             ; DATA XREF: ????1416o
            pop    eax
            push dword ptr ss:[eax]
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_MOV_SSA_TO_B endp
; ???????????????????????????????????????????????????????????????????????????
VM_DIVW_QUOTIENT:                      ; DATA XREF: .text:VM_OP_TABLEo
            pop    ax
            pop    cx
            div    cl
            push ax
            jmp    VMLoop_EP    ; fetch Instruction Byte
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_MOVW_FSA_TO_B proc near             ; DATA XREF: ????15A2o
            pop    eax
            push small word ptr fs:[eax]
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_MOVW_FSA_TO_B endp
; ???????????????????????????????????????????????????????????????????????????
VM_POP_DR6:                            ; DATA XREF: ????139Eo
            pop    ecx
            mov    dr6, ecx
            jmp    VMLoop_EP    ; fetch Instruction Byte
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_MOVW_ESA_TO_B proc near             ; DATA XREF: ????1556o
            pop    eax
            push small word ptr es:[eax]
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_MOVW_ESA_TO_B endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_PUSH_FS    proc near             ; DATA XREF: ????13AAo
            mov    cx, fs
            push cx
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_PUSH_FS    endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_IMUL_F    proc near             ; DATA XREF: ????169Eo
            pop    edx
            pop    eax
            imul edx
            push eax
            push edx
            pushfw
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_IMUL_F    endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_PUSH_CR1    proc near             ; DATA XREF: ????155Eo
            mov    edx, cr1
            push edx
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_PUSH_CR1    endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_POP_CR6    proc near             ; DATA XREF: ????16DEo
            pop    ecx
            mov    cr6, ecx
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_POP_CR6    endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_MOVW_B_TO_CSA proc near             ; DATA XREF: ????1476o
            pop    edx
            pop    small word ptr cs:[edx]
            jmp    VMLoop_EP    ; fetch Instruction Byte

VM_MOVW_B_TO_CSA endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_PUSH_DR2    proc near             ; DATA XREF: ????13DAo
                                    ; ????15C6o
            mov    eax, dr2
            push eax
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_PUSH_DR2    endp
; ???????????????????????????????????????????????????????????????????????????
VM_NA_NB_AND:                         ; DATA XREF: ????163Ao
            pop    eax
            not    eax
            not    dword ptr [esp]
            and    [esp], eax
            jmp    VMLoop_EP    ; fetch Instruction Byte
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_FSUBR       proc near             ; DATA XREF: ????1552o
                                    ; ????15DEo
            fsubr dword ptr [esp+0]
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_FSUBR       endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_POP_DR1    proc near             ; DATA XREF: ????1422o
            pop    ecx
            mov    dr1, ecx
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_POP_DR1    endp
; ???????????????????????????????????????????????????????????????????????????
VM_POP_FS:                            ; DATA XREF: ????170Ao
            db    66h
            pop    fs
            jmp    VMLoop_EP    ; fetch Instruction Byte
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_POP_DR7    proc near             ; DATA XREF: ????172Eo
            pop    eax
            mov    dr7, eax
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_POP_DR7    endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_MOVW_A_TO_SS proc near             ; DATA XREF: ????16CAo
            pop    ax
            db    66h
            mov    ss, ax
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_MOVW_A_TO_SS endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_FSUBRQ    proc near             ; DATA XREF: ????1656o
            fsubr qword ptr [esp+0]
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_FSUBRQ    endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_POP_ESP    proc near             ; DATA XREF: ????144Ao
            pop    esp
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_POP_ESP    endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_NA_NB_ANDW_F proc near             ; DATA XREF: ????14AAo
            pop    dx
            pop    cx
            not    dl
            not    cl
            and    dl, cl
            push dx
            pushfw
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_NA_NB_ANDW_F endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_MOVB_B_TO_ESA proc near             ; DATA XREF: ????140Eo
            pop    ecx
            pop    dx
            mov    es:[ecx], dl
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_MOVB_B_TO_ESA endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_MOVB_B_TO_A  proc near             ; DATA XREF: ????14EAo
            pop    eax
            pop    cx
            mov    [eax], cl
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_MOVB_B_TO_A  endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
; abs(st(0))=>st(0)
VM_FABS       proc near             ; DATA XREF: ????14D2o
                                    ; ????1696o
            fabs
            jmp    VMLoop_EP    ; fetch Instruction Byte

VM_FABS       endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
; float sub int
VM_FISUB       proc near             ; DATA XREF: ????13D6o
            fisub dword ptr [esp+0]
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_FISUB       endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_FLDQ       proc near             ; DATA XREF: ????1606o
            fld    qword ptr [esp+0]
            jmp    VMLoop_EP    ; fetch Instruction Byte

VM_FLDQ       endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_IDIVW       proc near             ; DATA XREF: ????1436o
            pop    dx
            pop    ax
            pop    cx
            idiv cx
            push ax
            push dx
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_IDIVW       endp
; ???????????????????????????????????????????????????????????????????????????
VM_PUSH_ES:                            ; DATA XREF: ????13E2o
            db    66h
            push es
            jmp    VMLoop_EP    ; fetch Instruction Byte
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_FDIV       proc near             ; DATA XREF: ????16FEo
            fdiv dword ptr [esp+0]
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_FDIV       endp
; ???????????????????????????????????????????????????????????????????????????
VM_PUSH_DS:                            ; DATA XREF: ????1642o
            db    66h
            push ds
            jmp    VMLoop_EP    ; fetch Instruction Byte
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_FMUL       proc near             ; DATA XREF: ????13CAo
            fmul dword ptr [esp+0]
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_FMUL       endp

; ???????????????????????????????????????????????????????????????????????????
VM_IMULW_F:                            ; DATA XREF: ????13A6o
            pop    dx
            pop    ax
            imul dx
            push ax
            push dx
            pushfw
            jmp    VMLoop_EP    ; fetch Instruction Byte
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_MOVW_B_TO_FSA proc near             ; DATA XREF: ????16B2o
            pop    ecx
            pop    small word ptr fs:[ecx]
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_MOVW_B_TO_FSA endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_FISTPQ    proc near             ; DATA XREF: ????1646o
            fistp qword ptr [esp+0]
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_FISTPQ    endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_POP_CR2    proc near             ; DATA XREF: ????1512o
            pop    edx
            mov    cr2, edx
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_POP_CR2    endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_ADDW_F    proc near             ; DATA XREF: ????15FAo
            pop    ax
            add    [esp+0], ax
            pushfw
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_ADDW_F    endp
; ???????????????????????????????????????????????????????????????????????????
VM_NA_NB_ANDW:                         ; DATA XREF: ????138Ao
            pop    cx
            pop    dx
            not    cl
            not    dl
            and    cl, dl
            push cx
            jmp    VMLoop_EP    ; fetch Instruction Byte
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_POP_ES    proc near             ; DATA XREF: ????1396o
            pop    cx
            db    66h
            mov    es, cx
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_POP_ES    endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_PUSH_CR3    proc near             ; DATA XREF: ????161Eo
            mov    edx, cr3
            push edx
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_PUSH_CR3    endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_POP_CR0    proc near             ; DATA XREF: ????158Eo
            pop    ecx
            mov    cr0, ecx
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_POP_CR0    endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_PUSH_DR1    proc near             ; DATA XREF: ????157Ao
            mov    ecx, dr1
            push ecx
            jmp    VMLoop_EP    ; fetch Instruction Byte

VM_PUSH_DR1    endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_PUSH_CR7    proc near             ; DATA XREF: ????13EEo
                                    ; ????1682o
            mov    eax, cr7
            push eax
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_PUSH_CR7    endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_POPW_CONTEXT proc near             ; DATA XREF: ????165Eo
VM_CONTEXT = edi
            lodsb
            add    al, bl
            inc    al
            not    al
            add    al, 1Bh
            xor    al, 0A8h
            add    bl, al
            pop    small word ptr [VM_CONTEXT+eax*4]
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_POPW_CONTEXT endp

; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_SHRB_F    proc near             ; DATA XREF: ????1546o
            pop    ax
            pop    cx
            shr    al, cl
            push ax
            pushfw
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_SHRB_F    endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_SHRB       proc near             ; DATA XREF: ????148Ao
            pop    dx
            pop    cx
            shr    dl, cl
            push dx
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_SHRB       endp
; ???????????????????????????????????????????????????????????????????????????
VM_NA_B_ANDW_F:                      ; DATA XREF: ????1402o
            not    dword ptr [esp]
            pop    dx
            and    [esp], dx
            pushfw
            jmp    VMLoop_EP    ; fetch Instruction Byte
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_FSIN       proc near             ; DATA XREF: ????138Eo
            fsin
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_FSIN       endp
; ???????????????????????????????????????????????????????????????????????????
VM_FLDLN2:                            ; DATA XREF: ????13F2o
            fldln2
            jmp    VMLoop_EP    ; fetch Instruction Byte
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_SHLW_F    proc near             ; DATA XREF: ????143Eo
                                    ; ????14EEo
            pop    ax
            pop    cx
            shl    ax, cl
            push ax
            ushfw
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_SHLW_F    endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_MOVB_B_TO_SSA proc near             ; DATA XREF: ????1446o
            pop    eax
            pop    dx
            mov    ss:[eax], dl
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_MOVB_B_TO_SSA endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_POP_CX    proc near             ; DATA XREF: ????1582o
            pop    cx
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_POP_CX    endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_FCOS       proc near             ; DATA XREF: ????13B2o
            fcos
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_FCOS       endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_PUSH_CR4    proc near             ; DATA XREF: ????174Ao
            mov    edx, cr4
            push edx
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_PUSH_CR4    endp
; ???????????????????????????????????????????????????????????????????????????
VM_PUSHW:                            ; DATA XREF: ????14DAo
            lodsb
            add    al, bl
            sub    al, 0C4h
            not    al
            inc    al
            ror    al, 5
            inc    al
            ror    al, 6
            not    al
            add    al, 85h
            ror    al, 1
            add    bl, al
            push ax
            jmp    VMLoop_EP    ; fetch Instruction Byte
; ???????????????????????????????????????????????????????????????????????????
VM_MOV_ESA_TO_B:                      ; DATA XREF: ????14E6o
            pop    ecx
            push dword ptr es:[ecx]
            jmp    VMLoop_EP    ; fetch Instruction Byte
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
; load src to FPU CW(control word)
VM_FLDCW       proc near             ; DATA XREF: ????1706o
            fldcw word ptr [esp+0]
            jmp    VMLoop_EP    ; fetch Instruction Byte

VM_FLDCW       endp
; ???????????????????????????????????????????????????????????????????????????
VM_FLDLG2:                            ; DATA XREF: ????14D6o
            fldlg2                ; load log2 to st0
            jmp    VMLoop_EP    ; fetch Instruction Byte
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_POP_DR0    proc near             ; DATA XREF: ????16C6o
            pop    ecx
            mov    dr0, ecx
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_POP_DR0    endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_MOVW_B_TO_ESA proc near             ; DATA XREF: ????143Ao
            pop    eax
            pop    small word ptr es:[eax]
            jmp    VMLoop_EP    ; fetch Instruction Byte

VM_MOVW_B_TO_ESA endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
; Initilize FPU without checking out FP exception
VM_FNINIT    proc near             ; DATA XREF: ????14F2o
            fninit
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_FNINIT    endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_SHR_F       proc near             ; DATA XREF: ????16A2o
            pop    edx
            pop    cx
            shr    edx, cl
            push edx
            pushfw
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_SHR_F       endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_PUSH_ESP    proc near             ; DATA XREF: ????141Ao
            push esp
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_PUSH_ESP    endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_MOVB_B_TO_FSA proc near             ; DATA XREF: ????160Eo
            pop    ecx
            pop    dx
            mov    fs:[ecx], dl
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_MOVB_B_TO_FSA endp
; ???????????????????????????????????????????????????????????????????????????
VM_FDIVQ:                            ; DATA XREF: ????14CEo
            fdiv qword ptr [esp]
            jmp    VMLoop_EP    ; fetch Instruction Byte
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_NA_B_ANDW proc near             ; DATA XREF: ????1686o
            not    dword ptr [esp+0]
            pop    ax
            and    [esp+0], ax
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_NA_B_ANDW endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_FSUBQ       proc near             ; DATA XREF: ????175Eo
            fsub qword ptr [esp+0]
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_FSUBQ       endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_RETF       proc far             ; DATA XREF: ????1596o
            pop    eax
            popa
            popf
            retf
VM_RETF       endp ; sp =  28h
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_SHLD_F    proc near             ; DATA XREF: ????141Eo
                                    ; ????16EEo
            pop    eax
            pop    edx
            pop    cx
            shld eax, edx, cl
            push eax
            pushfw
            jmp    VMLoop_EP    ; fetch Instruction Byte

VM_SHLD_F    endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_PUSH_CR2    proc near             ; DATA XREF: ????1466o
            mov    eax, cr2
            push eax
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_PUSH_CR2    endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_FPATAN    proc near             ; DATA XREF: ????1616o
            fpatan
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_FPATAN    endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_FSTP       proc near             ; DATA XREF: ????1662o
            fstp dword ptr [esp+0]
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_FSTP       endp
; ???????????????????????????????????????????????????????????????????????????
VM_ADD:                               ; DATA XREF: ????15EAo
            pop    edx
            add    [esp], edx
            jmp    VMLoop_EP    ; fetch Instruction Byte
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_MOVW_GSA_TO_B proc near             ; DATA XREF: ????14AEo
            pop    edx
            push small word ptr gs:[edx]
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_MOVW_GSA_TO_B endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_PUSH_SS    proc near             ; DATA XREF: ????173Ao
            mov    ax, ss
            push ax
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_PUSH_SS    endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_PUSH_DR7    proc near             ; DATA XREF: ????15F2o
            mov    ecx, dr7
            push ecx
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_PUSH_DR7    endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_PUSH_CR0    proc near             ; DATA XREF: ????15CAo
            mov    edx, cr0
            push edx
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_PUSH_CR0    endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_POPW_CONTEXTBH proc near          ; DATA XREF: ????151Eo
            movzx eax, byte ptr [esi]
            add    al, bl
            xor    al, 0B9h
            inc    al
            not    al
            ror    al, 6
            add    al, 0F2h
            add    bl, al
            lea    esi, [esi+1]
            pop    cx
            mov    [edi+eax*4+1], cl
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_POPW_CONTEXTBH endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_MOVW_A_TO_B  proc near             ; DATA XREF: ????162Eo
            pop    ecx
            push small word ptr [ecx]
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_MOVW_A_TO_B  endp
; ???????????????????????????????????????????????????????????????????????????
VM_FSTPT:                            ; DATA XREF: ????14DEo
            fstp tbyte ptr [esp]
            jmp    VMLoop_EP    ; fetch Instruction Byte
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
; (2^x)-1
VM_F2XM1       proc near             ; DATA XREF: ????14CAo
            f2xm1
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_F2XM1       endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_MOV_GSA_TO_B proc near             ; DATA XREF: ????15B6o
            pop    eax
            push dword ptr gs:[eax]
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_MOV_GSA_TO_B endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_IDIV       proc near             ; DATA XREF: ????15FEo
            pop    edx
            pop    eax
            pop    ecx
            idiv ecx
            push eax
            push edx
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_IDIV       endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_POP_ECX    proc near             ; DATA XREF: ????1442o
            pop    ecx
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_POP_ECX    endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_FADD       proc near             ; DATA XREF: ????1462o
            fadd dword ptr [esp+0]
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_FADD       endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_MOVZXB_FSA_TO_B proc near          ; DATA XREF: ????14A2o
            pop    ecx
            movzx dx, byte ptr fs:[ecx]
            push dx
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_MOVZXB_FSA_TO_B endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_FSTQ       proc near             ; DATA XREF: ????167Ao
            fst    qword ptr [esp+0]
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_FSTQ       endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_FTST       proc near             ; DATA XREF: ????16BAo
            ftst
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_FTST       endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_POP_CR4    proc near             ; DATA XREF: ????1626o
            pop    edx
            mov    cr4, edx
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_POP_CR4    endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_POP_CR1    proc near             ; DATA XREF: ????155Ao
            pop    eax
            mov    cr1, eax
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_POP_CR1    endp
; ???????????????????????????????????????????????????????????????????????????
VM_POP_DS:                            ; DATA XREF: ????14BAo
            db    66h
            pop    ds
            jmp    VMLoop_EP    ; fetch Instruction Byte
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_FNSTCWW    proc near             ; DATA XREF: ????160Ao
            fnstcw  word ptr [esp+0]
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_FNSTCWW    endp
; ???????????????????????????????????????????????????????????????????????????
VM_SHR:                               ; DATA XREF: ????14C6o
            pop    eax
            pop    cx
            shr    eax, cl
            push eax
            jmp    VMLoop_EP    ; fetch Instruction Byte
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_DIV       proc near             ; DATA XREF: ????16F6o
            pop    edx
            pop    eax
            pop    ecx
            div    ecx
            push eax
            push edx
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_DIV       endp
; ???????????????????????????????????????????????????????????????????????????
VM_FILDQ:                            ; DATA XREF: ????13C6o
                                    ; ????145Ao
            fild qword ptr [esp]
            jmp    VMLoop_EP    ; fetch Instruction Byte
; ???????????????????????????????????????????????????????????????????????????
VM_MOVB_CSA_TO_B:                      ; DATA XREF: ????1542o
            pop    ecx
            mov    al, cs:[ecx]
            push ax
            jmp    VMLoop_EP    ; fetch Instruction Byte
; ???????????????????????????????????????????????????????????????????????????
VM_MOV_B_TO_SSA:                      ; DATA XREF: ????1576o
            pop    edx
            pop    dword ptr ss:[edx]
            jmp    VMLoop_EP    ; fetch Instruction Byte
; ???????????????????????????????????????????????????????????????????????????
VM_FLD:                               ; DATA XREF: ????1426o
                                    ; ????1756o
            fld    dword ptr [esp]
            jmp    VMLoop_EP    ; fetch Instruction Byte
; ???????????????????????????????????????????????????????????????????????????
VM_MOVB_B_TO_GSA:                      ; DATA XREF: ????1716o
            pop    ecx
            pop    dx
            mov    gs:[ecx], dl
            jmp    VMLoop_EP    ; fetch Instruction Byte
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_POP_DR5    proc near             ; DATA XREF: ????154Ao
            pop    edx
            mov    dr5, edx
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_POP_DR5    endp
; ???????????????????????????????????????????????????????????????????????????
VM_MOV_B_TO_FSA:                      ; DATA XREF: ????1712o
            pop    edx
            pop    dword ptr fs:[edx]
            jmp    VMLoop_EP    ; fetch Instruction Byte
; ???????????????????????????????????????????????????????????????????????????
VM_PUSHW_CONTEXT:                      ; DATA XREF: ????139Ao
            lodsb
            add    al, bl
            inc    al
            not    al
            add    al, 1Bh
            xor    al, 0A8h
            add    bl, al
            push small word ptr [edi+eax*4]
            jmp    VMLoop_EP    ; fetch Instruction Byte
; ???????????????????????????????????????????????????????????????????????????
VM_MULB_F:                            ; DATA XREF: ????1456o
                                    ; ????176Eo
            pop    dx
            pop    ax
            mul    dl
            push ax
            pushfw
            jmp    VMLoop_EP    ; fetch Instruction Byte
; ???????????????????????????????????????????????????????????????????????????
VM_MULW_F:                            ; DATA XREF: ????1382o
            pop    dx
            pop    ax
            mul    dx
            push ax
            push dx
            pushfw
            jmp    VMLoop_EP    ; fetch Instruction Byte
; ???????????????????????????????????????????????????????????????????????????
VM_MOVW_B_TO_SSA:                      ; DATA XREF: ????151Ao
            pop    ecx
            pop    small word ptr ss:[ecx]
            jmp    VMLoop_EP    ; fetch Instruction Byte
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_FCHS       proc near             ; DATA XREF: ????1676o
            fchs
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_FCHS       endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_FCOMPQ    proc near             ; DATA XREF: ????1692o
            fcomp qword ptr [esp+0]
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_FCOMPQ    endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_PUSHW_CONTEXTBH proc near          ; DATA XREF: ????150Ao
            lodsb
            add    al, bl
            xor    al, 0B9h
            inc    al
            not    al
            ror    al, 6
            add    al, 0F2h
            add    bl, al
            mov    al, [edi+eax*4+1]
            push ax
            jmp    VMLoop_EP    ; fetch Instruction Byte

VM_PUSHW_CONTEXTBH endp
; ???????????????????????????????????????????????????????????????????????????
VM_ADD_F:                            ; DATA XREF: ????1772o
            pop    edx
            add    [esp], edx
            pushfw
            jmp    VMLoop_EP    ; fetch Instruction Byte
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_SHLB_F    proc near             ; DATA XREF: ????14FAo
            pop    dx
            pop    cx
            shl    dl, cl
            push dx
            pushfw
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_SHLB_F    endp
; ???????????????????????????????????????????????????????????????????????????
VM_FRNDINT:                            ; DATA XREF: ????13FEo
            frndint                ; st(0) <- INT( st(0) ); depends on RC flag
            jmp    VMLoop_EP    ; fetch Instruction Byte
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_FYL2X       proc near             ; DATA XREF: ????1536o
            fyl2x
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_FYL2X       endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_MUL_F       proc near             ; DATA XREF: ????1566o
            pop    edx
            pop    eax
            mul    edx
            push eax
            push edx
            pushfw
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_MUL_F       endp
; ???????????????????????????????????????????????????????????????????????????
VM_PUSH_IMMW:                         ; DATA XREF: ????13DEo
            lodsw
            add    ax, bx
            xor    ax, 6609h
            not    ax
            ror    ax, 8
            dec    ax
            add    bx, ax
            cwde
            push eax
            jmp    VMLoop_EP    ; fetch Instruction Byte
; ???????????????????????????????????????????????????????????????????????????
VM_NA_NB_AND_F:                      ; DATA XREF: ????1526o
            pop    ecx
            not    ecx
            not    dword ptr [esp]
            and    [esp], ecx
            pushfw
            jmp    VMLoop_EP    ; fetch Instruction Byte
; ???????????????????????????????????????????????????????????????????????????
VM_RETN:                               ; DATA XREF: ????1406o
            pop    eax
            popa
            popf
            retn
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
; save status word to dest
VM_FNSTSWW    proc near             ; DATA XREF: ????16BEo
            fnstsw  ax
            push ax
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_FNSTSWW    endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_PUSH_CR5    proc near             ; DATA XREF: ????174Eo
            mov    edx, cr5
            push edx
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_PUSH_CR5    endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
; st(0) <- ?(ie, pi)
VM_FLDPI       proc near             ; DATA XREF: ????16AAo
            fldpi
            jmp    VMLoop_EP    ; fetch Instruction Byte

VM_FLDPI       endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_PUSH_IMM    proc near             ; DATA XREF: ????1726o
            mov    eax, [esi]
            add    eax, ebx
            add    eax, 23D30F4Fh ; <suspicious>
            rol    eax, 1Fh
            inc    eax
            add    esi, 4
            rol    eax, 0Bh
            sub    eax, 8E5C6C84h
            add    ebx, eax
            push eax
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_PUSH_IMM    endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_PUSHW_CONTEXTBL proc near          ; DATA XREF: ????158Ao
            lodsb
            add    al, bl
            xor    al, 0B9h
            inc    al
            not    al
            ror    al, 6
            add    al, 0F2h
            add    bl, al
            mov    al, [edi+eax*4]
            push ax
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_PUSHW_CONTEXTBL endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_POP_CR7    proc near             ; DATA XREF: ????14B2o
            pop    edx
            mov    cr7, edx
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_POP_CR7    endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_FMULQ       proc near             ; DATA XREF: ????171Eo
            fmul qword ptr [esp+0]
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_FMULQ       endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_MOV_CSA_TO_B proc near             ; DATA XREF: ????147Eo
            pop    ecx
            push dword ptr cs:[ecx]
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_MOV_CSA_TO_B endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_MOV_B_TO_GSA proc near             ; DATA XREF: ????1472o
            pop    eax
            pop    dword ptr gs:[eax]
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_MOV_B_TO_GSA endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_POP_CR5    proc near             ; DATA XREF: ????153Ao
            pop    eax
            mov    cr5, eax
            jmp    VMLoop_EP    ; fetch Instruction Byte

VM_POP_CR5    endp
; ???????????????????????????????????????????????????????????????????????????
VM_ADDB_F:                            ; DATA XREF: ????13AEo
                                    ; ????13C2o
            pop    cx
            add    [esp], cl
            pushfw
            jmp    VMLoop_EP    ; fetch Instruction Byte
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_PUSH_CONTEXT proc near             ; DATA XREF: ????1502o
            lodsb
            add    al, bl
            xor    al, 4Ah
            ror    al, 4
            sub    al, 0B7h
            rol    al, 6
            add    bl, al
            push dword ptr [edi+eax*4]
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_PUSH_CONTEXT endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_MOVB_B_TO_CSA proc near             ; DATA XREF: ????13A2o
            pop    ecx
            pop    ax
            mov    cs:[ecx], al
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_MOVB_B_TO_CSA endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_SHRW_F    proc near             ; DATA XREF: ????173Eo
            pop    ax
            pop    cx
            shr    ax, cl
            push ax
            pushfw
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_SHRW_F    endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_FCOMP       proc near             ; DATA XREF: ????15A6o
            fcomp dword ptr [esp+0]
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_FCOMP       endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_POP_DR2    proc near             ; DATA XREF: ????13FAo
            pop    ecx
            mov    dr2, ecx
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_POP_DR2    endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_PUSH_CR6    proc near             ; DATA XREF: ????13EAo
            mov    ecx, cr6
            push ecx
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_PUSH_CR6    endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_FDECSTP    proc near             ; DATA XREF: ????1432o
            fdecstp
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_FDECSTP    endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_SHRD_F    proc near             ; DATA XREF: ????1522o
            pop    eax
            pop    edx
            pop    cx
            shrd eax, edx, cl
            push eax
            pushfw
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_SHRD_F    endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_FLDT       proc near             ; DATA XREF: ????1762o
            fld    tbyte ptr [esp+0]
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_FLDT       endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_FLDZ       proc near             ; DATA XREF: ????14FEo
            fldz
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_FLDZ       endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_IDIVW_QUOTIENT proc near          ; DATA XREF: ????15CEo
            pop    ax
            pop    cx
            idiv cl
            push ax
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_IDIVW_QUOTIENT endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_MOVW_B_TO_A  proc near             ; DATA XREF: ????15E2o
            pop    edx
            pop    small word ptr [edx]
            jmp    VMLoop_EP    ; fetch Instruction Byte

VM_MOVW_B_TO_A  endp
; ???????????????????????????????????????????????????????????????????????????
VM_MOVW_CSA_TO_B:                      ; DATA XREF: ????13E6o
            pop    eax
            push small word ptr cs:[eax]
            jmp    VMLoop_EP    ; fetch Instruction Byte
; ???????????????????????????????????????????????????????????????????????????
VM_PUSH_CS:                            ; DATA XREF: ????149Ao
            db    66h
            push cs
            jmp    VMLoop_EP    ; fetch Instruction Byte
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_FPTAN       proc near             ; DATA XREF: ????1482o
            fptan
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_FPTAN       endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_FISUBW    proc near             ; DATA XREF: ????16A6o
            fisub word ptr [esp+0]
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_FISUBW    endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_SHRW       proc near             ; DATA XREF: ????15AEo
            pop    ax
            pop    cx
            shr    ax, cl
            push ax
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_SHRW       endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_PUSHW_IMMW proc near             ; DATA XREF: ????153Eo
            lodsw
            add    ax, bx
            xor    ax, 6609h
            not    ax
            ror    ax, 8
            dec    ax
            add    bx, ax
            push ax
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_PUSHW_IMMW endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_FSUB       proc near             ; DATA XREF: ????1492o
            fsub dword ptr [esp+0]
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_FSUB       endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_SHL_F       proc near             ; DATA XREF: ????168Eo
            pop    edx
            pop    cx
            shl    edx, cl
            push edx
            pushfw
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_SHL_F       endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_MOVZXB_ESA_TO_B proc near          ; DATA XREF: ????1622o
            pop    eax
            movzx dx, byte ptr es:[eax]
            push dx
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_MOVZXB_ESA_TO_B endp
; ???????????????????????????????????????????????????????????????????????????
VM_POP_DR4:                            ; DATA XREF: ????159Ao
                                    ; ????1732o
            pop    edx
            mov    dr4, edx
            jmp    VMLoop_EP    ; fetch Instruction Byte
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_ADDW       proc near             ; DATA XREF: ????1752o
            pop    cx
            add    [esp+0], cx
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_ADDW       endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_POP_CONTEXT  proc near             ; DATA XREF: ????171Ao
            mov    al, [esi]
            add    al, bl
            xor    al, 4Ah
            ror    al, 4
            sub    al, 0B7h
            rol    al, 6
            add    bl, al
            pop    dword ptr [edi+eax*4]
            inc    esi
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_POP_CONTEXT  endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_MOVZXB_SSA_TO_B proc near          ; DATA XREF: ????140Ao
            pop    eax
            movzx dx, byte ptr ss:[eax]
            push dx
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_MOVZXB_SSA_TO_B endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_POPW_CONTEXTBL proc near          ; DATA XREF: ????1612o
            lodsb
            add    al, bl
            xor    al, 0B9h
            inc    al
            not    al
            ror    al, 6
            add    al, 0F2h
            add    bl, al
            pop    cx
            mov    [edi+eax*4], cl
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_POPW_CONTEXTBL endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_POP_DR3    proc near             ; DATA XREF: ????15F6o
            pop    ecx
            mov    dr3, ecx
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_POP_DR3    endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_FISTPW    proc near
            fistp word ptr [esp+0]
            jmp    VMLoop_EP    ; fetch Instruction Byte
VM_FISTPW    endp
; ???????????????????????????????????????????????????????????????????????????
VM_FSQRT:
            fsqrt
            jmp    VMLoop_EP    ; fetch Instruction Byte
; ???????????????????????????????????????????????????????????????????????????

6、伪指令块
通常每个伪指令块从一组VM_POP_CONTEXT开始，到一组VM_PUSH_CONTEXT+VM_RET结束。每个块可以
认为是更高一级的伪指令，或视为函数。指令执行记录顺序如下：
第000368条:[0x1000171A]->0x10001BBB||[0x10036BFE]->0xe9 00    |-012|VM_POP_CONTEXT
第000369条:[0x1000171A]->0x10001BBB||[0x10036C00]->0xe9 02    |-008|VM_POP_CONTEXT
第000370条:[0x1000171A]->0x10001BBB||[0x10036C02]->0xe9 0c    |-004|VM_POP_CONTEXT
第000371条:[0x1000171A]->0x10001BBB||[0x10036C04]->0xe9 0b    |0000|VM_POP_CONTEXT
第000372条:[0x1000171A]->0x10001BBB||[0x10036C06]->0xe9 04    |0004|VM_POP_CONTEXT
第000373条:[0x1000171A]->0x10001BBB||[0x10036C08]->0xe9 0a    |0008|VM_POP_CONTEXT
第000374条:[0x1000171A]->0x10001BBB||[0x10036C0A]->0xe9 01    |0012|VM_POP_CONTEXT
第000375条:[0x1000171A]->0x10001BBB||[0x10036C0C]->0xe9 03    |0016|VM_POP_CONTEXT
第000376条:[0x1000171A]->0x10001BBB||[0x10036C0E]->0xe9 08    |0020|VM_POP_CONTEXT
第000377条:[0x1000171A]->0x10001BBB||[0x10036C10]->0xe9 04    |0024|VM_POP_CONTEXT
第000378条:[0x10001442]->0x100018B4||[0x10036C12]->0x33       |0028|VM_POP_ECX
第000379条:[0x10001726]->0x10001A41||[0x10036C13]->0xec 2d236673 |0024|VM_PUSH_IMM
第000380条:[0x100014DA]->0x1000177F||[0x10036C18]->0x59 78    |0022|VM_PUSHW
第000381条:[0x1000165E]->0x100012FD||[0x10036C1A]->0xba 05    |0024|VM_POPW_CONTEXT
第000382条:[0x10001726]->0x10001A41||[0x10036C1C]->0xec d2dc9a72 |0020|VM_PUSH_IMM
...........
第000423条:[0x10001686]->0x100017F7||[0x10036C70]->0xc4       |0022|VM_NA_B_ANDW
第000424条:[0x10001502]->0x10001AB3||[0x10036C71]->0x63 06    |0018|VM_PUSH_CONTEXT
第000425条:[0x100015E2]->0x10001B31||[0x10036C73]->0x9b       |0024|VM_MOVW_B_TO_A
第000426条:[0x10001502]->0x10001AB3||[0x10036C74]->0x63 04    |0020|VM_PUSH_CONTEXT
第000427条:[0x10001502]->0x10001AB3||[0x10036C76]->0x63 09    |0016|VM_PUSH_CONTEXT
第000428条:[0x10001502]->0x10001AB3||[0x10036C78]->0x63 03    |0012|VM_PUSH_CONTEXT
第000429条:[0x10001502]->0x10001AB3||[0x10036C7A]->0x63 08    |0008|VM_PUSH_CONTEXT
第000430条:[0x10001502]->0x10001AB3||[0x10036C7C]->0x63 0a    |0004|VM_PUSH_CONTEXT
第000431条:[0x10001502]->0x10001AB3||[0x10036C7E]->0x63 09    |0000|VM_PUSH_CONTEXT
第000432条:[0x10001502]->0x10001AB3||[0x10036C80]->0x63 0b    |-004|VM_PUSH_CONTEXT
第000433条:[0x10001502]->0x10001AB3||[0x10036C82]->0x63 0c    |-008|VM_PUSH_CONTEXT
第000434条:[0x10001502]->0x10001AB3||[0x10036C84]->0x63 02    |-012|VM_PUSH_CONTEXT
第000435条:[0x10001502]->0x10001AB3||[0x10036C86]->0x63 00    |-016|VM_PUSH_CONTEXT
第000436条:[0x10001406]->0x10001A24||[0x10036C88]->0x24       |0024|VM_RETN

对应的伪指令块如下：
VMInsBuff_03 db  1Dh                ; VM_POP_CONTEXT
            db 0E1h ; á
            db  32h ; 2          ; VM_POP_CONTEXT
            db  79h ; y
            db  3Dh ; =          ; VM_POP_CONTEXT
            db 0C4h ; ?
            db  49h ; I          ; VM_POP_CONTEXT
            db  92h ; ’
            db  5Ch ; \          ; VM_POP_CONTEXT
            db  26h ; &
            db  69h ; i          ; VM_POP_CONTEXT
            db  6Dh ; m
            db  7Fh ;          ; VM_POP_CONTEXT
            db 8
            db  93h ; “          ; VM_POP_CONTEXT
            db 0DDh ; Y
            db 0A2h ; ￠          ; VM_POP_CONTEXT
            db 0EBh ; ?
            db  92h ; ’          ; VM_POP_ECX
            db 8                ; VM_PUSH_IMM
            dd 8A186535h
            db  0Bh                ; VM_PUSHW
            db 6
            db  0Bh                ; VM_POPW_CONTEXT
            db 0
            db  19h                ; VM_PUSH_IMM
            dd 5C9E6D93h
            db  63h ; c          ; VM_ADD
            db  98h ; ?          ; VM_POP_CONTEXT
            db 0A2h ; ￠
            db  86h ; ?          ; VM_PUSH_ESP
            db  7Dh ; }          ; VM_POP_CONTEXT
            db 0C7h ; ?
            db  12h                ; VM_PUSH_IMM
            dd 0FA3FCC82h
            db 0A9h ; ?          ; VM_OP_114
            dw 0DAC5h
            db 0DEh ; T          ; VM_PUSH_SP
            db  25h ; %          ; VM_POP_CX
            db  4Dh ; M          ; VM_PUSH_ESP
            db 0A4h ; ¤          ; VM_MOV_SSA_TO_B
            db 0D5h ; ?          ; VM_POPW_CONTEXT
            db 0D2h ; ò
            db  55h ; U          ; VM_POP_CONTEXT
            db  59h ; Y
            db 0F1h ; ?          ; VM_PUSH_IMM
            dd 0AC9EC40Ah
            db  85h ; …          ; VM_ADD
            db  7Fh ;          ; VM_PUSH_CONTEXT
            db 84h
            db  85h ; …          ; VM_ADD
            db  40h ; @          ; VM_PUSH_IMM
            dd 0BDC0F22Dh
            db  11h                ; VM_PUSH_REG
            db  5Bh ; [
            db  28h ; (          ; VM_SHRB_F
            db  72h ; r          ; VM_POP_CONTEXT
            db  7Bh ; {
            db  64h ; d          ; VM_PUSH_ESP
            db 0A6h ; |          ; VM_MOVZXB_SSA_TO_B
            db 0AEh ; ?          ; VM_POPW_CONTEXT
            db 0A7h ; §
            db 0C0h ; à          ; VM_PUSH_IMM
            dd 8BC56656h
            db  59h ; Y          ; VM_ADD
            db  6Eh ; n          ; VM_PUSH_ESP
            db 0DEh ; T          ; VM_PUSH_IMMB
            db  28h ; (
            db  55h ; U          ; VM_ADD
            db  49h ; I          ; VM_MOV_SSA_TO_B
            db 0EBh ; ?          ; VM_PUSH_ESP
            db 0A1h ; ?          ; VM_MOV_SSA_TO_B
            db  63h ; c          ; VM_POP_CONTEXT
            db  2Ch ; ,
            db 0EDh ; í          ; VM_PUSH_IMMB
            db  27h ; '
            db  65h ; e          ; VM_ADD
            db 6                ; VM_MOV_B_TO_A
            db 0C7h ; ?          ; VM_PUSHW_IMMW
            dw 123Bh
            db  6Ch ; l          ; VM_PUSH_IMM
            dd 82EB9F59h
            db 0DCh ; ü          ; VM_POP_IMMWL
            db 0D5h ; ?
            db  21h ; !          ; VM_POPW_CONTEXT
            db  16h
            db 0E6h ; ?          ; VM_PUSHW_IMMW
            dw 0DAAAh
            db  9Fh ; ?          ; VM_NA_B_ANDW
            db 6                ; VM_PUSH_CONTEXT
            db  90h ; ?
            db  21h ; !          ; VM_MOVW_B_TO_A
            db 2                ; VM_PUSH_CONTEXT
            db  0Ch
            db  9Bh ; ?          ; VM_PUSH_CONTEXT
            db  66h ; f
            db  2Fh ; /          ; VM_PUSH_CONTEXT
            db  79h ; y
            db 0C9h ; é          ; VM_PUSH_CONTEXT
            db 0D4h ; ?
            db  5Eh ; ^          ; VM_PUSH_CONTEXT
            db 0E9h ; é
            db 0F1h ; ?          ; VM_PUSH_CONTEXT
            db 0BCh ; ?
            db  85h ; …          ; VM_PUSH_CONTEXT
            db 0CDh ; í
            db  17h                ; VM_PUSH_CONTEXT
            db  1Fh
            db 0A8h ; ¨          ; VM_PUSH_CONTEXT
            db  2Dh ; -
            db  43h ; C          ; VM_PUSH_CONTEXT
            db  48h ; H
            db  85h ; …          ; VM_RETN
7、多个伪指令块记录范例如下：
第0139次跳转，跳转到:0x10021F0F(VMInsBuff_14)
第0140次跳转，跳转到:0x10021622(VMInsBuff_20)
第0141次跳转，跳转到:0x1002186A(VMInsBuff_21)
第0142次跳转，跳转到:0x10022A11(VMInsBuff_22)
第0143次跳转，跳转到:0x1002202E(VMInsBuff_23)
第0144次跳转，跳转到:0x10021622(VMInsBuff_20)
第0145次跳转，跳转到:0x1002186A(VMInsBuff_21)
第0146次跳转，跳转到:0x10022A11(VMInsBuff_22)
第0147次跳转，跳转到:0x1002202E(VMInsBuff_23)
第0148次跳转，跳转到:0x10021622(VMInsBuff_20)
第0149次跳转，跳转到:0x1002186A(VMInsBuff_21)
第0150次跳转，跳转到:0x10022A11(VMInsBuff_22)
第0151次跳转，跳转到:0x1002202E(VMInsBuff_23)
第0152次跳转，跳转到:0x10021622(VMInsBuff_20)
第0153次跳转，跳转到:0x1002186A(VMInsBuff_21)
第0154次跳转，跳转到:0x10022A11(VMInsBuff_22)
第0155次跳转，跳转到:0x1002202E(VMInsBuff_23)
。。。。。。。。。
如上伪指令块执行记录，其中VMInsBuff_20到VMInsBuff_23循环执行

登录后可查看完整内容

[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！

#VM保护

收藏・11

免费・7

支持

最新回复 (16)
Bughoho 雪币： 1946 活跃值： (248) 能力值： (RANK：330 ) 在线值：发帖 72 回帖 1217 粉丝 27 关注私信	Bughoho 8 2 楼好贴，顺便发发exe吧 2007-11-7 23:23 0
wangdell 雪币： 87 活跃值： (47) 能力值： ( LV12，RANK：250 ) 在线值：发帖 52 回帖 328 粉丝 3 关注私信	wangdell 6 3 楼回的这么快？多谢。是个dll，不发了吧，是个国内软件。用notepad.exe测试应该差不多结果。 2007-11-7 23:27 0
十三少雪币： 226 活跃值： (15) 能力值： ( LV6，RANK：90 ) 在线值：发帖 10 回帖 402 粉丝 1 关注私信	十三少 2 4 楼很好，很强大 2007-11-7 23:27 0
Bughoho 雪币： 1946 活跃值： (248) 能力值： (RANK：330 ) 在线值：发帖 72 回帖 1217 粉丝 27 关注私信	Bughoho 8 5 楼最近有时间了准备酝酿vmp1.2 unpacker，这篇文章写得太好了，我想对比一下指令，既然LZ不方便，那就算了吧。 2007-11-7 23:30 0
十三少雪币： 226 活跃值： (15) 能力值： ( LV6，RANK：90 ) 在线值：发帖 10 回帖 402 粉丝 1 关注私信	十三少 2 6 楼 VM_NA_NB_AND_F: ; DATA XREF: ????1526o pop ecx not ecx not dword ptr [esp] and [esp], ecx pushfw jmp VMLoop_EP ; fetch Instruction Byte 这个是vxor 2007-11-7 23:34 0
wangdell 雪币： 87 活跃值： (47) 能力值： ( LV12，RANK：250 ) 在线值：发帖 52 回帖 328 粉丝 3 关注私信	wangdell 6 7 楼多谢指点，其它还有错误吗? 是啊，这是个简单的逻辑代数公式，想复杂了。 2007-11-7 23:37 0
十三少雪币： 226 活跃值： (15) 能力值： ( LV6，RANK：90 ) 在线值：发帖 10 回帖 402 粉丝 1 关注私信	十三少 2 8 楼没有跳转指令，不过估计你要破的东西也差不多可以搞定了。 2007-11-7 23:40 0
linxer 雪币： 1746 活跃值： (287) 能力值： (RANK：450 ) 在线值：发帖 26 回帖 164 粉丝 21 关注私信	linxer 11 9 楼看来1.2要惨遭毒手了 2007-11-7 23:43 0
forgot 雪币： 6075 活跃值： (2236) 能力值： (RANK：1060 ) 在线值：发帖 155 回帖 3771 粉丝 16 关注私信	forgot 26 10 楼那个not not and，用demorgan定律，应该是或非门吧 2007-11-8 00:42 0
wangdell 雪币： 87 活跃值： (47) 能力值： ( LV12，RANK：250 ) 在线值：发帖 52 回帖 328 粉丝 3 关注私信	wangdell 6 11 楼是或非这样？ VM_NA_NB_AND => VM_NOR VM_NA_NB_ANDW => VM_NORW VM_NA_NB_ANDW_F => VM_NORW_F VM_NA_NB_AND_F => VM_NOR_F 2007-11-8 09:10 0
当哩个当雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 3 回帖 21 粉丝 0 关注私信	当哩个当 12 楼好帖如美人。。。我顶 2007-11-9 10:47 0
sbright 雪币： 146 活跃值： (33) 能力值： ( LV6，RANK：90 ) 在线值：发帖 120 回帖 995 粉丝 1 关注私信	sbright 2 13 楼这么长的文章还是放在word里传上来好点,鼠标都卡住了!! 2007-11-9 12:13 0
kanxue 雪币： 47147 活跃值： (20445) 能力值： (RANK：350 ) 在线值：发帖 2375 回帖 17045 粉丝 541 关注私信	kanxue 8 14 楼呵～各有长处从我角度希望文本帖出来，好处： 1.方便搜索 2.方便整理精华集（如是word，还得导出来，格式转换，工作量很大） 2007-11-9 12:26 0
KuNgBiM 雪币： 817 活跃值： (1927) 能力值： ( LV12，RANK：2670 ) 在线值：发帖 500 回帖 2517 粉丝 22 关注私信	KuNgBiM 66 15 楼看来离vmp1.2unpacker、VMP1.2clear for OllyDbg、VMP1.2 sig for IDA到来不远了 2007-11-10 02:04 0
lustylol 雪币： 207 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 16 回帖 106 粉丝 0 关注私信	lustylol 16 楼相同指令每次vmp后的指令都不一样，脱壳机很难的，除非遍历所有子集，这个工作量可大了。而且代码vm后的填入了很长垃圾代码，正向分析vmp的加密过程可能更好些 2007-11-13 11:09 0
bbbsl 雪币： 111 活跃值： (211) 能力值： ( LV2，RANK：10 ) 在线值：发帖 1 回帖 124 粉丝 0 关注私信	bbbsl 17 楼偶像太强了,xx门都懂啊 2007-12-8 11:57 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复

wangdell

发帖

328

回帖

250

RANK

关注

私信

他的文章

关于我们

联系我们

企业服务

看雪公众号

最新回复 (16)
Bughoho 雪币： 1946 活跃值： (248) 能力值： (RANK：330 ) 在线值：发帖 72 回帖 1217 粉丝 27 关注私信	Bughoho 8 2 楼好贴，顺便发发exe吧 2007-11-7 23:23 0
wangdell 雪币： 87 活跃值： (47) 能力值： ( LV12，RANK：250 ) 在线值：发帖 52 回帖 328 粉丝 3 关注私信	wangdell 6 3 楼回的这么快？多谢。是个dll，不发了吧，是个国内软件。用notepad.exe测试应该差不多结果。 2007-11-7 23:27 0
十三少雪币： 226 活跃值： (15) 能力值： ( LV6，RANK：90 ) 在线值：发帖 10 回帖 402 粉丝 1 关注私信	十三少 2 4 楼很好，很强大 2007-11-7 23:27 0
Bughoho 雪币： 1946 活跃值： (248) 能力值： (RANK：330 ) 在线值：发帖 72 回帖 1217 粉丝 27 关注私信	Bughoho 8 5 楼最近有时间了准备酝酿vmp1.2 unpacker，这篇文章写得太好了，我想对比一下指令，既然LZ不方便，那就算了吧。 2007-11-7 23:30 0
十三少雪币： 226 活跃值： (15) 能力值： ( LV6，RANK：90 ) 在线值：发帖 10 回帖 402 粉丝 1 关注私信	十三少 2 6 楼 VM_NA_NB_AND_F: ; DATA XREF: ????1526o pop ecx not ecx not dword ptr [esp] and [esp], ecx pushfw jmp VMLoop_EP ; fetch Instruction Byte 这个是vxor 2007-11-7 23:34 0
wangdell 雪币： 87 活跃值： (47) 能力值： ( LV12，RANK：250 ) 在线值：发帖 52 回帖 328 粉丝 3 关注私信	wangdell 6 7 楼多谢指点，其它还有错误吗? 是啊，这是个简单的逻辑代数公式，想复杂了。 2007-11-7 23:37 0
十三少雪币： 226 活跃值： (15) 能力值： ( LV6，RANK：90 ) 在线值：发帖 10 回帖 402 粉丝 1 关注私信	十三少 2 8 楼没有跳转指令，不过估计你要破的东西也差不多可以搞定了。 2007-11-7 23:40 0
linxer 雪币： 1746 活跃值： (287) 能力值： (RANK：450 ) 在线值：发帖 26 回帖 164 粉丝 21 关注私信	linxer 11 9 楼看来1.2要惨遭毒手了 2007-11-7 23:43 0
forgot 雪币： 6075 活跃值： (2236) 能力值： (RANK：1060 ) 在线值：发帖 155 回帖 3771 粉丝 16 关注私信	forgot 26 10 楼那个not not and，用demorgan定律，应该是或非门吧 2007-11-8 00:42 0
wangdell 雪币： 87 活跃值： (47) 能力值： ( LV12，RANK：250 ) 在线值：发帖 52 回帖 328 粉丝 3 关注私信	wangdell 6 11 楼是或非这样？ VM_NA_NB_AND => VM_NOR VM_NA_NB_ANDW => VM_NORW VM_NA_NB_ANDW_F => VM_NORW_F VM_NA_NB_AND_F => VM_NOR_F 2007-11-8 09:10 0
当哩个当雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 3 回帖 21 粉丝 0 关注私信	当哩个当 12 楼好帖如美人。。。我顶 2007-11-9 10:47 0
sbright 雪币： 146 活跃值： (33) 能力值： ( LV6，RANK：90 ) 在线值：发帖 120 回帖 995 粉丝 1 关注私信	sbright 2 13 楼这么长的文章还是放在word里传上来好点,鼠标都卡住了!! 2007-11-9 12:13 0
kanxue 雪币： 47147 活跃值： (20445) 能力值： (RANK：350 ) 在线值：发帖 2375 回帖 17045 粉丝 541 关注私信	kanxue 8 14 楼呵～各有长处从我角度希望文本帖出来，好处： 1.方便搜索 2.方便整理精华集（如是word，还得导出来，格式转换，工作量很大） 2007-11-9 12:26 0
KuNgBiM 雪币： 817 活跃值： (1927) 能力值： ( LV12，RANK：2670 ) 在线值：发帖 500 回帖 2517 粉丝 22 关注私信	KuNgBiM 66 15 楼看来离vmp1.2unpacker、VMP1.2clear for OllyDbg、VMP1.2 sig for IDA到来不远了 2007-11-10 02:04 0
lustylol 雪币： 207 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 16 回帖 106 粉丝 0 关注私信	lustylol 16 楼相同指令每次vmp后的指令都不一样，脱壳机很难的，除非遍历所有子集，这个工作量可大了。而且代码vm后的填入了很长垃圾代码，正向分析vmp的加密过程可能更好些 2007-11-13 11:09 0
bbbsl 雪币： 111 活跃值： (211) 能力值： ( LV2，RANK：10 ) 在线值：发帖 1 回帖 124 粉丝 0 关注私信	bbbsl 17 楼偶像太强了,xx门都懂啊 2007-12-8 11:57 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复