Skip to content

Commit 5f1ad9a

Browse files
void-stackvoid-stack
committed
Files push.
0 parents  commit 5f1ad9a

File tree

8 files changed

+125
-0
lines changed

8 files changed

+125
-0
lines changed

‎.gitignore‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
bin/
2+
obj/
3+
/packages/
4+
riderModule.iml
5+
/_ReSharper.Caches/

‎VMUnprotect.Dumper/Program.cs‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
// See https://aka.ms/new-console-template for more information
2+
using AsmResolver.IO;
3+
using AsmResolver.PE.File;
4+
using System;
5+
using System.IO;
6+
using System.Reflection;
7+
using System.Runtime.CompilerServices;
8+
using System.Runtime.InteropServices;
9+
10+
const string asciiArt = @"
11+
_________ __
12+
\_ ___ \ ____________/ |_ ____ ___ ___
13+
/ \ \/ / _ \_ __ \ __\/ __ \\ \/ /
14+
\ \___( <_> ) | \/| | \ ___/ > <
15+
\______ /\____/|__| |__| \___ >__/\_ \
16+
\/ \/ \/
17+
VMUnprotect.Dumper
18+
https://github.com/void-stack
19+
Credits: wwh1004, MrToms
20+
";
21+
22+
Console.Title = "VMUnprotect.Dumper";
23+
Console.WriteLine(asciiArt);
24+
25+
if (args.Length > 0 && File.Exists(args[0])) {
26+
var target = args[0];
27+
var output = $"{Path.GetFileNameWithoutExtension(target)}-decrypted.exe";
28+
var assembly = Assembly.LoadFile(target);
29+
var moduleHandle = assembly.ManifestModule.ModuleHandle;
30+
31+
Console.WriteLine("[+] Decrypting methods");
32+
RuntimeHelpers.RunModuleConstructor(moduleHandle);
33+
var hInstanceFixed = Marshal.GetHINSTANCE(assembly.ManifestModule);
34+
35+
Console.WriteLine("[+] Reading decrypted module");
36+
var decryptedPeFile = PEFile.FromModuleBaseAddress(hInstanceFixed);
37+
38+
foreach (var section in decryptedPeFile.Sections)
39+
Console.WriteLine("[+] Sections: " + section.Name);
40+
41+
Console.WriteLine("[+] Writing file");
42+
using (var fs = File.Create(output)) {
43+
decryptedPeFile.Write(new BinaryStreamWriter(fs));
44+
}
45+
46+
Console.WriteLine("[+] Decrypted all methods!");
47+
}
48+
else
49+
Console.WriteLine("File either doesn't exist or you didn't provide it (VMProtect.Dumper File.exe)");
50+
51+
Console.ReadKey();

‎VMUnprotect.Dumper/README.md‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
<p align="center">
2+
<img width="256" heigth="256" src="docs\vmup.png">
3+
<h1 align="center">VMUnprotect.Dumper</h1>
4+
<p align="center">
5+
<strong>VMUnprotect.Dumper</strong> is a project engaged in hunting tampered <a href="https://vmpsoft.com">VMProtect</a> assemblies. It makes use of <a href="https://github.com/pardeike/Harmony">AsmResolver</a> to dynamically untamper <strong>VMP</strong> protected assembly. Works on <a href="https://vmpsoft.com/20210919/vmprotect-3-5-1/">VMProtect 3.5.1</a> (Latest) and few versions back.
6+
</p>
7+
</p>
8+
<p align="center">
9+
<img src="https://forthebadge.com/images/badges/built-with-love.svg" alt="appveyor-ci" />
10+
<img src="https://forthebadge.com/images/badges/made-with-c-sharp.svg" alt="appveyor-ci" />
11+
</p>
12+
</p>
13+
14+
</br></br>
15+
# Before and after usage of VMUnprotect.Dumper
16+
<img src="docs/protected.png" width="49%" height="390px" style="display:inline;">
17+
<div style="display:inline;width:5px;"></div>
18+
<img src="docs/decrypted.png" width="49%" height="390px" style="display:inline;">
19+
20+
21+
# Usage
22+
```sh
23+
VMUnprotect.Dumper.exe example.vmp.exe
24+
```
25+
26+
27+
28+
# Credits
29+
* [wwh1004](https://github.com/wwh1004) - Idea.
30+
* [(Discord) MrToms#1244]() - Resources
31+
32+
This tool uses the following (open source) software:
33+
* [AsmResolver](https://github.com/Washi1337/AsmResolver) by [Washi](https://github.com/Washi1337), licensed under the MIT license, for reading/writing assemblies.
34+
35+
## Want to support this project?
36+
BTC: bc1q048wrqztka5x2syt9mtj68uuf73vqry60s38vf

‎VMUnprotect.Dumper/VMUnprotect.Dumper.csproj‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
<Project Sdk="Microsoft.NET.Sdk">
2+
3+
<PropertyGroup>
4+
<OutputType>Exe</OutputType>
5+
<TargetFramework>netcoreapp3.1</TargetFramework>
6+
<ImplicitUsings>enable</ImplicitUsings>
7+
<Nullable>enable</Nullable>
8+
<LangVersion>10</LangVersion>
9+
</PropertyGroup>
10+
11+
<ItemGroup>
12+
<PackageReference Include="AsmResolver" Version="4.8.0" />
13+
<PackageReference Include="AsmResolver.DotNet" Version="4.8.0" />
14+
<PackageReference Include="AsmResolver.PE" Version="4.8.0" />
15+
</ItemGroup>
16+
17+
</Project>

‎VMUnprotect.Dumper/docs/decrypted.png‎

41.7 KB
Loading

‎VMUnprotect.Dumper/docs/protected.png‎

64.8 KB
Loading

‎VMUnprotect.Dumper/docs/vmup.png‎

49.3 KB
Loading

‎VMUnprotect.sln‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
2+
Microsoft Visual Studio Solution File, Format Version 12.00
3+
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "VMUnprotect.Dumper", "VMUnprotect.Dumper\VMUnprotect.Dumper.csproj", "{7E00C6C0-731D-4E9F-BDDE-BC805A525A0E}"
4+
EndProject
5+
Global
6+
GlobalSection(SolutionConfigurationPlatforms) = preSolution
7+
Debug|Any CPU = Debug|Any CPU
8+
Release|Any CPU = Release|Any CPU
9+
EndGlobalSection
10+
GlobalSection(ProjectConfigurationPlatforms) = postSolution
11+
{7E00C6C0-731D-4E9F-BDDE-BC805A525A0E}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
12+
{7E00C6C0-731D-4E9F-BDDE-BC805A525A0E}.Debug|Any CPU.Build.0 = Debug|Any CPU
13+
{7E00C6C0-731D-4E9F-BDDE-BC805A525A0E}.Release|Any CPU.ActiveCfg = Release|Any CPU
14+
{7E00C6C0-731D-4E9F-BDDE-BC805A525A0E}.Release|Any CPU.Build.0 = Release|Any CPU
15+
EndGlobalSection
16+
EndGlobal

0 commit comments

Comments
 (0)