PinVMP

主要功能是辅助分析 VMProtect 等虚拟化保护代码。

自用二进制分析工具，代码渣，许多功能尚在开发中。离完全自动化分析 VMP 还很远。

基本思路：

使用 Pin 插装运行，记录 trace，离线分析
构造执行基本块图
使用 Miasm 对基本块进行符号执行。

配置

下载 pin-3.2-81205-msvc-windows

将 repo 中的文件编译成 pintool。（编译过程参考Pin文档）

# 配置 VS 命令行编译环境
"C:\Program Files (x86)\Microsoft Visual Studio\2017\Community\VC\Auxiliary\Build\vcvarsall.bat" x86
# 开始编译
make all TARGET=ia32

安装 Miasm
- 可直接将 miasm2 文件夹 copy 到 C:\Python27\Lib\site-packages\miasm2

命令行使用

配置 py/config.py 中的各项值。
- EXE_PATH 分析的文件
- START_ADDR VM 入口地址 0x401000
- END_ADDR VM 出口地址
- 其他主要是各类文件路径
运行 py/main.py
查看 html 的报告

交互使用

本工具主要是用来交互使用的，使用 ipython 加载并交互运行。

D:\papers\pin\pin-3.2-81205-msvc-windows\source\tools\MyPinTool (master)
λ ipython -i py\main.py
Python 2.7.11 (v2.7.11:6d1b6a68f775, Dec  5 2015, 20:40:30) [MSC v.1500 64 bit (AMD64)]
Type "copyright", "credits" or "license" for more information.

IPython 5.1.0 -- An enhanced Interactive Python.
?         -> Introduction and overview of IPython's features.
%quickref -> Quick reference.
help      -> Python's own help system.
object?   -> Details about 'object', use 'object??' for extra details.
[*] Target: C:\Users\Moon\Desktop\vmp1.81\test.vmp_2.13.8_pro.exe
----- STEP 1 -----
[*] Running PinTool ...
################################################################################
################################################################################
[*] Pin instrument finished.
----- STEP 2 -----
[*] Loading instructions from D:\papers\pin\pin-3.2-81205-msvc-windows\source\tools\MyPinTool\py\work\bin.ins
[+] 618 instructions loaded.
[*] Running load_ins_info(): 0.0100 seconds
----- STEP 3 -----
[*] Loading traces from D:\papers\pin\pin-3.2-81205-msvc-windows\source\tools\MyPinTool\py\work\bin.trace
[+] 14327 traces processed.
[*] Running load_trace(): 0.4880 seconds
----- STEP 4 -----
[*] Constructing execution graph ...
[+] Before consolidation: 600
[+] After consolidation: 20
[*] Execution graph constructed.
[*] Running consolidate_blocks(): 0.0100 seconds
----- STEP 5 -----
[+] Dispatcher found at 0x40435f.
[+] 14 handlers found.
----- STEP 6 -----
[*] Generating report ....
[*] Report generated.

In [1]: bm.blocks
Out[1]:
{4198400: <Block(0x401000 - 0x404347) INS(86) PREV(0) NEXT(1) EXEC(1) LOOP(0)>,
 4210979: <Block(0x404123 - 0x405381) INS(12) PREV(1) NEXT(1) EXEC(6) LOOP(0)>,
 4211239: <Block(0x404227 - 0x4043fa) INS(12) PREV(1) NEXT(1) EXEC(6) LOOP(0)>,
 4211529: <Block(0x404349 - 0x40435c) INS(9) PREV(2) NEXT(1) EXEC(2) LOOP(1)>,
 4211551: <Block(0x40435f - 0x404224) INS(41) PREV(9) NEXT(16) EXEC(173) LOOP(14)>,
 4211779: <Block(0x404443 - 0x4047a2) INS(43) PREV(1) NEXT(0) EXEC(1) LOOP(0)>,
 4212056: <Block(0x404558 - 0x405b64) INS(13) PREV(1) NEXT(1) EXEC(1) LOOP(0)>,
 4212179: <Block(0x4045d3 - 0x404846) INS(31) PREV(1) NEXT(1) EXEC(20) LOOP(0)>,
 4212365: <Block(0x40468d - 0x4051a7) INS(21) PREV(1) NEXT(1) EXEC(7) LOOP(0)>,
 4212466: <Block(0x4046f2 - 0x404a90) INS(41) PREV(1) NEXT(1) EXEC(1) LOOP(0)>,
 4213055: <Block(0x40493f - 0x405bef) INS(36) PREV(1) NEXT(1) EXEC(1) LOOP(0)>,
 4213547: <Block(0x404b2b - 0x40591e) INS(42) PREV(1) NEXT(1) EXEC(13) LOOP(0)>,
 4213612: <Block(0x404b6c - 0x40532d) INS(38) PREV(1) NEXT(1) EXEC(4) LOOP(0)>,
 4216384: <Block(0x405640 - 0x404b98) INS(14) PREV(1) NEXT(1) EXEC(1) LOOP(0)>,
 4216910: <Block(0x40584e - 0x4056c0) INS(41) PREV(1) NEXT(1) EXEC(66) LOOP(0)>,
 4216915: <Block(0x405853 - 0x405877) INS(15) PREV(1) NEXT(1) EXEC(1) LOOP(0)>,
 4216961: <Block(0x405881 - 0x40566f) INS(13) PREV(1) NEXT(1) EXEC(1) LOOP(0)>,
 4217003: <Block(0x4058ab - 0x404720) INS(38) PREV(1) NEXT(1) EXEC(43) LOOP(0)>,
 4217252: <Block(0x4059a4 - 0x405b77) INS(14) PREV(7) NEXT(1) EXEC(69) LOOP(0)>,
 4217620: <Block(0x405b14 - 0x405b0f) INS(40) PREV(1) NEXT(1) EXEC(1) LOOP(0)>}

In [2]: b = bm.blocks[4211551]

In [3]: print b
Block(0x40435f - 0x404224) SIZE(127) INS(41) EXEC(173) LOOP(14)
Prev (9):
        0x405640,0x405853,0x404123,0x4059a4,0x404349,0x40468d,0x40584e,0x4045d3,0x404558
Next (16):
        0x405640,0x405881,0x405853,0x404b2b,0x404227,0x4058ab,0x404b6c,0x40468d,0x40584e,0x404558,0x4046f2,0x404123,0x405b14,0x4045d3,0x404443,0x40493f
Instructions:
        0x40435f        lea edx, ptr [edx*8-0x7525bb7f]
        0x404366        mov al, byte ptr [esi-0x1]
        0x404369        inc dl
        0x40436b        setns dh
        0x40436e        dec esi
        0x40436f        sub edx, 0x9ec1cfd2
        0x404375        cmp dl, 0xea
        0x404378        rcl dl, 0x7
        0x40437b        sub al, bl
        0x40437d        dec dl
        0x40437f        push esi
        0x404380        call 0x4041ce
        0x4041ce        pop edx
        0x4041cf        dec al
        0x4041d1        rcl dh, cl
        0x4041d3        sar edx, cl
        0x4041d5        or dl, ch
        0x4041d7        xor al, 0xcd
        0x4041d9        lea edx, ptr [ebx*8-0xcbcbf63]
        0x4041e0        sar dx, cl
        0x4041e3        rcr edx, 0x10
        0x4041e6        rol dx, cl
        0x4041e9        sub al, 0x23
        0x4041eb        shl dl, cl
        0x4041ed        bsr dx, dx
        0x4041f1        bt bx, 0x9
        0x4041f6        sub bl, al
        0x4041f8        rcl dh, 0x4
        0x4041fb        movzx eax, al
        0x4041fe        pushad
        0x4041ff        mov edx, dword ptr [eax*4+0x404cf8]
        0x404206        cmc
        0x404207        sub edx, 0x1aadee33
        0x40420d        mov byte ptr [esp+0x8], 0x28
        0x404212        pushad
        0x404213        mov dword ptr [esp+0x40], edx
        0x404217        pushfd
        0x404218        mov byte ptr [esp+0x4], ch
        0x40421c        push dword ptr [esp+0x8]
        0x404220        push dword ptr [esp+0x48]
        0x404224        ret 0x4c


In [4]: bm.handlers
Out[4]:
{4210979: <Handler_404123>,
 4211239: <Handler_404227>,
 4212056: <Handler_404558>,
 4212179: <Handler_4045d3>,
 4212365: <Handler_40468d>,
 4212466: <Handler_4046f2>,
 4213055: <Handler_40493f>,
 4213547: <Handler_404b2b>,
 4213612: <Handler_404b6c>,
 4216384: <Handler_405640>,
 4216910: <Handler_40584e>,
 4216915: <Handler_405853>,
 4217003: <Handler_4058ab>,
 4217620: <Handler_405b14>}


In [6]: h = bm.handlers[0x404227]

In [7]: print h
Handler_404227(0x404227) 1 blocks
        <Block(0x404227 - 0x4043fa) INS(12) PREV(1) NEXT(1) EXEC(6) LOOP(0)>

In [9]: print h.ins_str_with_trace
0x404227        test cl, dl     ; edx->0x27     ecx->0x15
0x404229        lahf    ; eax<-0x6
0x40422a        mov eax, ebp    ; ebp->0x19ff6c eax<-0x19ff6c
0x40422c        pushfd  ; esp->0x19fe8c esp<-0x19fe88   [0x19fe88]<-0x206
0x40422d        push 0x25f38222 ; esp->0x19fe88 esp<-0x19fe84   [0x19fe84]<-0x25f38222
0x404232        sub ebp, 0x4    ; ebp->0x19ff6c ebp<-0x19ff68
0x404235        jmp 0x4043f1    ;
0x4043f1        pushfd  ; esp->0x19fe84 esp<-0x19fe80   [0x19fe80]<-0x202
0x4043f2        mov dword ptr [ebp], eax        ; eax->0x19ff6c ebp->0x19ff68   [0x19ff68]<-0x19ff6c
0x4043f5        pushfd  ; esp->0x19fe80 esp<-0x19fe7c   [0x19fe7c]<-0x202
0x4043f6        lea esp, ptr [esp+0x10] ; esp->0x19fe7c esp<-0x19fe8c
0x4043fa        jmp 0x4059a4    ;

In [16]: print h.to_expr()
        EBP = EBP_init + 0xFFFFFFFC;
        @32[EBP_init + 0xFFFFFFFC] = EBP_init;


In [17]: print h.to_c()
        EBP = (EBP_init) + (0xfffffffc);
        *(uint32_t *)((EBP_init) + (0xfffffffc)) = EBP_init;

lmy375 / pinvmp

PinVMP

配置

命令行使用

交互使用

About

Languages