Skip to content

Commit cd72179

Browse files
authored
Update README.md
1 parent 1f40be3 commit cd72179

File tree

1 file changed

+43
-59
lines changed

1 file changed

+43
-59
lines changed

README.md

Lines changed: 43 additions & 59 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,6 @@
1818
```sh
1919
VMUnprotect.exe
2020
-f, --file Required. Path to file.
21-
--usetranspiler (Default: false) Use an older method that makes use of Transpiler (not recommended).
2221
--enableharmonylogs (Default: false) Disable or Enable logs from Harmony.
2322
--bypassantidebug (Default: false) Bypass VMProtect Anti Debug.
2423
--help Display this help screen.
@@ -38,69 +37,45 @@ Virtualization Tools | ✓
3837
Strip Debug Information | ✓
3938
Pack the Output File | ✓
4039

41-
# Usage can be found in ```MiddleMan```
42-
```csharp
43-
using HarmonyLib;
44-
using System.Diagnostics;
45-
using System.Reflection;
46-
using VMUnprotect.Core.Abstraction;
47-
using VMUnprotect.Core.Helpers;
48-
49-
namespace VMUnprotect.Core.MiddleMan {
50-
/// <summary>
51-
/// Works as Middle Man to make life easier
52-
/// </summary>
53-
public static class UnsafeInvokeMiddleMan {
54-
private static readonly ILogger ConsoleLogger = Engine.Logger;
55-
56-
/// <summary>
57-
/// A prefix is a method that is executed before the original method
58-
/// </summary>
59-
public static void Prefix(ref object __instance, ref object obj, ref object[] parameters, ref object[] arguments) {
60-
var virtualizedMethodName = new StackTrace().GetFrame(7).GetMethod();
61-
var method = (MethodBase) __instance;
62-
63-
ConsoleLogger.Print("VMP MethodName: {0} (MDToken {1:X4})", virtualizedMethodName.FullDescription(), virtualizedMethodName.MetadataToken.ToString());
64-
ConsoleLogger.Print("MethodName: {0}", method.Name);
65-
ConsoleLogger.Print("FullDescription: {0}", method.FullDescription());
66-
ConsoleLogger.Print("MethodType: {0}", method.GetType());
67-
68-
if (obj is not null)
69-
ConsoleLogger.Print("Obj: {0}", obj.GetType());
70-
71-
// Loop through parameters and log them
72-
for (var i = 0; i < parameters.Length; i++) {
73-
var parameter = parameters[i];
74-
ConsoleLogger.Print("Parameter ({1}) [{0}]: ({2})", i, parameter.GetType(), Formatter.FormatObject(parameter));
75-
}
76-
77-
var returnType = method is MethodInfo info ? info.ReturnType.FullName : "System.Object";
78-
ConsoleLogger.Print("MDToken: 0x{0:X4}", method.MetadataToken);
79-
ConsoleLogger.Print("Return Type: {0}", returnType ?? "null");
80-
}
81-
82-
/// <summary>
83-
/// A postfix is a method that is executed after the original method
84-
/// </summary>
85-
public static void Postfix(ref object __instance, ref object __result, ref object obj, ref object[] parameters, ref object[] arguments) {
86-
ConsoleLogger.Print("Returns: {0}", __result);
87-
}
88-
}
89-
}
90-
```
91-
9240
## Current Features
9341
- Tracing invokes in virtualized methods.
9442
- Manipulating parameters and return values.
9543
- Bypass NtQueryInformationProcess, IsLogging, get_IsAttached
9644

45+
## Usage can be found in VMUnprotect.Runtime.MiddleMan
46+
```csharp
47+
/// <summary>
48+
/// A prefix is a method that is executed before the original method
49+
/// </summary>
50+
public bool Prefix(ref object __result, ref object __instance, ref object obj, ref object[] parameters, ref object[] arguments) {
51+
var virtualizedMethodName = new StackTrace().GetFrame(7).GetMethod();
52+
var method = (MethodBase) __instance;
53+
Logger.Print("VMP MethodName: {0} (MDToken 0x{1:X4})", virtualizedMethodName.FullDescription(),
54+
virtualizedMethodName.MetadataToken.ToString());
55+
Logger.Print("MethodName: {0}", method.Name);
56+
Logger.Print("FullDescription: {0}", method.FullDescription());
57+
Logger.Print("MethodType: {0}", method.GetType());
58+
// ReSharper disable once ConditionIsAlwaysTrueOrFalse
59+
if (obj is not null)
60+
Logger.Print("Obj: {0}", Formatter.FormatObject(obj));
61+
// Loop through parameters and log them
62+
for (var i = 0; i < parameters.Length; i++) {
63+
var parameter = parameters[i];
64+
Logger.Print("Parameter ({1}) [{0}]: ({2})", i, parameter.GetType(), Formatter.FormatObject(parameter));
65+
}
66+
var returnType = method is MethodInfo info ? info.ReturnType.FullName : "System.Object";
67+
Logger.Print("MDToken: 0x{0:X4}", method.MetadataToken);
68+
Logger.Print("Return Type: {0}", returnType ?? "null");
69+
return true;
70+
}
9771

98-
## Todo
99-
- Change this to support more VM's
100-
- VMP Stack tracing
101-
- Bypass VMP Debugger Detection ✓
102-
- Bypass VMP CRC Check
103-
- Nice WPF GUI
72+
/// <summary>
73+
/// A postfix is a method that is executed after the original method
74+
/// </summary>
75+
public void Postfix(ref object __instance, ref object __result, ref object obj, ref object[] parameters, ref object[] arguments) {
76+
Logger.Print("Returns: {0}", __result);
77+
}
78+
```
10479

10580
# FAQ
10681
### What is code virtualization?
@@ -109,14 +84,23 @@ As VMProtect describes it on their's website. Code virtualization is the next st
10984
### Can it devirtualize VMP?
11085
No, isn't even meant for devirtualization.
11186

87+
Todo | Done
88+
---------------------------------|---------
89+
Change this to support more VM's | X
90+
VMP Stack tracing | X
91+
Bypass VMP Debugger Detection | ✓
92+
Bypass VMP CRC Check | X
93+
WPF GUI | X
94+
11295
# Credits
11396
* [Washi](https://github.com/Washi1337) Overall credits for the project and inspiration with UnsafeInvokeInternal, thanks <3
11497

11598
This tool uses the following (open source) software:
11699
* [dnlib](https://github.com/0xd4d/dnlib) by [0xd4d](https://github.com/0xd4d), licensed under the MIT license, for reading/writing assemblies.
117100
* [Harmony](https://github.com/pardeike/Harmony) by [Andreas Pardeike](https://github.com/pardeike), licensed under the MIT license
118101
* [Serilog](https://github.com/serilog/serilog) provides diagnostic logging to files, the console, and elsewhere. It is easy to set up, has a clean API.
119-
102+
* [commandline](https://github.com/commandlineparser/commandline) offers CLR applications a clean and concise API for manipulating command line arguments and related tasks
103+
* [Autofac](https://github.com/autofac/Autofac) Autofac is an IoC container for Microsoft .NET. It manages the dependencies between classes so that applications stay easy to change as they grow in size and complexity. This is achieved by treating regular .NET classes as components.
120104

121105
## Want to support this project?
122106
BTC: bc1q048wrqztka5x2syt9mtj68uuf73vqry60s38vf

0 commit comments

Comments
 (0)