2026-05-11 08:47:41 网络安全文章来源：ZONE.CI 全球网 0 阅读模式

文章总结： 文档分析了VMProtect3.8.1版本在源码泄露后实施的重大混淆策略升级，包括全指令变形、内存地址常数加密、Handler变形与融合等核心技术。这些改进显著提升了代码抗逆向分析能力，使传统基于指令特征匹配的分析方法失效，体现了软件保护技术的前沿发展。 综合评分： 85 文章分类： 逆向分析,二进制安全,安全开发,恶意软件,其他

cover_image

VMProtect 3.8.1 混淆策略大揭秘

阿强阿强

看雪学苑

2026年5月6日 17:59 上海

在小说阅读器读本章

去阅读

自从VMProtect 3.5.1 被爆出源码泄露开始直到最后的那一两个最重要的源文件也被公之于众之后，VMProtect 3.5.1算是在所有的逆向开发人员面前裸奔了。

有意思的是VMProtect并没有就此一蹶不振，反而绝地反击，它的实力和之前相比反而变得更强了，这是怎么回事呢？

这里面我们八卦一下，扒一扒他的版本，源码完全流出直到论坛上有大神分享编译的文章这时候是 2023年12月份左右，我们记住这个时间点，当我们全民都拥有源码的时候，其实VMProtect早已脱胎换骨了，我们来到他的官网https://vmpsoft.com/news/page/3/可以找到他的更新日志。我们可以看到这里增加好的选项，这些选项可不是简简单单的混淆，每一个拿出来都是王炸，毫不夸张的说如果3.8版本之后的VMProtect是一位浑身都是的肌肉的猛男。

那么3.8版本之前的VMProtect只能算是一个娇羞的小萝莉，我们可以看到3.8更新的时间点是2023年初，这里我们大家可以讨论一下VMProtect3.8的大更新是不是因为源码泄露而做出的紧急补救手段。因为VMProtect3.8发布的时间恰巧也是源码泄露的那段时间，当时我第一次得知VMProtect源码泄露的时候，还以为VMProtect就此跌落神坛，从此一蹶不振，没想到他居然放出大招，这次的大更新可以将其称之为新版VMProtect。

它不是像牙膏厂一样挤药膏似的更新，而是夸张到等同于重构了整个源码，增加了非常多的变态混淆策略，在很多地方都进行了非常大的改动。那么接下来我们将逐一分析他的逆天改动。

第1点：全指令变形，但凡能够使用替代指令几乎都使用了，目前只有异或解密指令没有进行混淆。

其他所有指令都或多或少有一两种变体，大家也可以联想到他们变种的样子，这里我举几个例子。

伪代码解密：

00422864&nbsp;|&nbsp;xoral,byteptrss:[ebp+edx-0x7]//伪代码读取指令有四种变体
00422868&nbsp;|&nbsp;xoral,bl//无法变形，维持原样
0042286A&nbsp;|&nbsp;jmp123.vmp模版+部分.42BE65
0042BE65&nbsp;|&nbsp;adddwordptrss:[esp+edx*2+0x2],0xC8169CA3&nbsp; &nbsp; &nbsp;|
0042BE6D&nbsp;|&nbsp;incal
0042BE6F&nbsp;|&nbsp;xchgwordptrss:[esp+edx+0x1],dx&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|
0042BE74&nbsp;|&nbsp;movdwordptrss:[esp+edx*8-0x729D0],edx&nbsp; &nbsp; &nbsp; &nbsp; |
0042BE7B&nbsp;|&nbsp;shldwordptrss:[esp+edx-0xE53B],0x57&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; |
0042BE83&nbsp;|&nbsp;xoral,0xA6
0042BE85&nbsp;|&nbsp;leaedx,dwordptrds:[edx*2+0x2FBCE804]&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|
0042BE8C&nbsp;|&nbsp;incdl&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; |
0042BE8E&nbsp;|&nbsp;setedl&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|
0042BE91&nbsp;|&nbsp;decal
0042BE93&nbsp;|&nbsp;jmp123.vmp模版+部分.5088D5&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|
005088D5&nbsp;|&nbsp;call123.vmp模版+部分.5074A0&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; |
005074A0&nbsp;|&nbsp;negal
005074A2&nbsp;|&nbsp;popedx&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|
005074A3&nbsp;|&nbsp;addedx,0xFFF7AC3A&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; |
005074A9&nbsp;|&nbsp;jmpedx&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|
00483514&nbsp;|&nbsp;movedx,0x119DB08A
00483519&nbsp;|&nbsp;xchgbyteptrss:[esp+edx*4-0x4676C225],dl&nbsp; &nbsp; &nbsp; |
00483520&nbsp;|&nbsp;addal,0x9E
00483522&nbsp;|&nbsp;leaedx,dwordptrds:[edx+edx*4+0x11B81E34]
00483529&nbsp;|&nbsp;xaddwordptrss:[esp+edx-0x69CC901C],dx&nbsp; &nbsp; &nbsp; &nbsp; |
00483532&nbsp;|&nbsp;xorbl,al//无法变形，维持原样

伪代码读取指令的五种可能形式：

moveax，dwordptrss:[esi]//原始版本

xoreax,eax//新增前置eax清零指令，也可以是其他清零指令
addeax，dwordptrss:[esi]//变体1
xoreax，dwordptrss:[esi]//变体2
oreax，dwordptrss:[esi]//变体3
adceax，dwordptrss:[esi]//变体4

计算Handler地址：

004C9172&nbsp;|&nbsp;moveax,dwordptrss:[ebp-0x4]//读取伪代码
004C9176&nbsp;|&nbsp;jno123.vmp模版+部分.46E996
0046E996&nbsp;|&nbsp;movedx,0x581983A&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|
0046E99B&nbsp;|&nbsp;xoreax,ebx
0046E99D&nbsp;|&nbsp;roreax,0x1
0046E99F&nbsp;|&nbsp;addedx,edx&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|
0046E9A1&nbsp;|&nbsp;bswapeax
0046E9A3&nbsp;|&nbsp;pushedx&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; |
0046E9A4&nbsp;|&nbsp;shlbyteptrss:[esp+edx*8-0x5819839E],0x84&nbsp; &nbsp; &nbsp;|
0046E9AC&nbsp;|&nbsp;inceax
0046E9AD&nbsp;|&nbsp;jmp123.vmp模版+部分.490ABF&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|
00490ABF&nbsp;|&nbsp;orwordptrss:[esp+edx*8-0x581983A0],dx&nbsp; &nbsp; &nbsp; &nbsp; |
00490AC7&nbsp;|&nbsp;movsxecx,dx&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; |
00490ACA&nbsp;|&nbsp;roleax,0x2
00490ACD&nbsp;|&nbsp;shldwordptrss:[esp+edx-0xB033074],cl&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|
00490AD4&nbsp;|&nbsp;xorebx,eax//解密加数完成
00490AD6&nbsp;|&nbsp;orcl,byteptrss:[esp+edx-0xB033071]//增加前置cf标志清零指令，执行完cf = 0
00490ADD&nbsp;|&nbsp;adcedi,eax//add指令的变体

第2点：内存地址常数加密，一条包含内存操作数的指令，那么他的内存操作数通常有几种情况。

只有内存地址常数例如 mov eax,dword ptr ss:[0x123] 只有基址寄存器 mov dword ptr ss:[esp], 0x123 基址寄存器+索引寄存器+内存地址常数 mov dword ptr ss:[esp+edi+0x123], 0x123

如果内存地址常数0也算进去，那么一条包含内存操作数的指令，他的内存操作数就都含有内存地址常数，那么这个内存地址常数就可以被用来加密了。

//这条指令此时伪代码寄存器是ebp，这时候的ecx是07400000，那么这里面的内存地址常数
//其实是-5,这个-5加上ebp就是当前伪代码的指针
00433C60 | movzx eax,byte ptr ds:[ecx+ebp-0x7400005]
00433C68 | ror ecx,0x77&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; |
00433C6B |&nbsp;not&nbsp;cx &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|
00433C6E |&nbsp;and&nbsp;cl,cl &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; |
00433C70 |&nbsp;xor&nbsp;al,bl

写到这里有些人可能觉得这样子有什么意义呢？除了让代码变得更加复杂难看点，其他还有什么作用呢？这个问题问的好，作者可不是这么想的，他的每一个地方的改动都是根据编写分析插件的思路来的，我猜测原作者团队里面应该有专门开发分析插件的部门，他的每一次更新都是会收集所有能够找到的分析资料进行修复，那么这些改动对于我们编写分析插件来说影响是相当大的，3.8之前还能使用指令文本特征进行匹配从而来识别Handler的方法这里已经完全失效了。

第3点：Handler的变形，这里面的Handler变形只存在于包含计算虚拟寄存器地址的Handler。

handler PushVR32：

004BF2B6&nbsp;|&nbsp;movzxeax,byteptrss:[ebp-0xB]//读取伪代码
004BF2BB&nbsp;|&nbsp;xoral,bl
004BF2BD&nbsp;|&nbsp;movecx,dwordptrss:[esp+0xC]
004BF2C1&nbsp;|&nbsp;addecx,0xFFFEE8B1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; |
004BF2C7&nbsp;|&nbsp;jmpecx&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|
0044D3C2&nbsp;|&nbsp;negal
0044D3C4&nbsp;|&nbsp;incal
0044D3C6&nbsp;|&nbsp;negal
0044D3C8&nbsp;|&nbsp;movedx,dwordptrss:[esp+0x2D]&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|
0044D3CC&nbsp;|&nbsp;notedx&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|
0044D3CE&nbsp;|&nbsp;incal
0044D3D0&nbsp;|&nbsp;movzxecx,dx
0044D3D3&nbsp;|&nbsp;xorbl,al//解密出偏移
0044D3D5&nbsp;|&nbsp;addecx,0xD3A68C98
0044D3DB&nbsp;|&nbsp;leaeax,dwordptrss:[esp+eax+0x3C]//算出虚拟寄存器地址
0044D3DF&nbsp;|&nbsp;oredx,edx&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; |
0044D3E1&nbsp;|&nbsp;xchgdwordptrss:[esp+0x1C],edx
0044D3E5&nbsp;|&nbsp;adcedx,0xFFFD3506&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; |
0044D3EB&nbsp;|&nbsp;jmpedx&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|
0042075C&nbsp;|&nbsp;movedx,dwordptrds:[eax]//取出虚拟寄存器的值
0042075E&nbsp;|&nbsp;movdwordptrds:[esi-0x1C],edx//值写入虚拟栈

变形后：

00420766&nbsp;|&nbsp;leaecx,dwordptrss:[esp+ecx-0x2C596EE3]//算出虚拟寄存器地址
0042076D&nbsp;|&nbsp;moveax,dwordptrds:[ecx]//取出虚拟寄存器的值
0042076F&nbsp;|&nbsp;movdwordptrds:[esi-0x20],eax//值写入虚拟栈

第4点：Handler的一级融合，这里面Handler与Handler之间本来是上一条Handler执行完在结尾跳到下一条handelr去执行，那么每条Handler中都有一个专门计算下一条handelr地址的代码块，这个代码块都有读取伪代码的操作，经过融合后，下一条用来计算handelr地址的伪代码被丢弃了，同时计算下一条handelr地址的代码块也没有了。

那么两条Handler使用跳转指令或者直接连接变成一条Handler，那么后面的Handler同样可以这样子接上去，有点像人体蜈蚣。

//第一条handler PushVR32的变形
00479089&nbsp;|&nbsp;movdwordptrss:[esp+edx*2-0x2],edx
0047908D&nbsp;|&nbsp;subdwordptrss:[esp+edx*2+0x16],0x8B38041C&nbsp; &nbsp; |
00479095&nbsp;|&nbsp;movzxeax,byteptrss:[esp+edx+0xA]&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|
0047909A&nbsp;|&nbsp;leaecx,dwordptrss:[esp+edx+0x55]//算出虚拟寄存器地址
0047909E&nbsp;|&nbsp;moveax,dwordptrds:[ecx+edx-0x3]//取出虚拟寄存器的值
004790A2&nbsp;|&nbsp;shldx,0x68&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|
004790A6&nbsp;|&nbsp;movdwordptrds:[edi+edx*8-0x1808],eax//值写入虚拟栈
//第二条handler PushVR32的变形
004790AD&nbsp;|&nbsp;moveax,edx
004790AF&nbsp;|&nbsp;xaddbyteptrss:[esp+edx-0x2F9],dl&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|
004790B7&nbsp;|&nbsp;call123.vmp模版+部分.4B01CD&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; |
004B01CD&nbsp;|&nbsp;leaecx,dwordptrss:[esp+edx*4-0xB80]//算出虚拟寄存器地址
004B01D4&nbsp;|&nbsp;jo123.vmp模版+部分.520FD5&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; |
004B01DA&nbsp;|&nbsp;moveax,dwordptrds:[ecx+edx*8-0x1800]//取出虚拟寄存器的值
004B01E1&nbsp;|&nbsp;leaecx,dwordptrds:[edx+edx*2+0x6BAEF303]&nbsp; &nbsp; &nbsp;|
004B01E8&nbsp;|&nbsp;movdwordptrds:[edi+edx*4-0xC0C],eax//值写入虚拟栈
//第三条handler PushVR32的变形
004B01EF&nbsp;|&nbsp;leaecx,dwordptrds:[edx+edx-0x50DA8F6D]
004B01F6&nbsp;|&nbsp;ordl,byteptrss:[esp+edx-0x2FB]&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|
004B01FD&nbsp;|&nbsp;negedx&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|
004B01FF&nbsp;|&nbsp;leaeax,dwordptrss:[esp+0x44]//算出虚拟寄存器地址
004B0203&nbsp;|&nbsp;rordwordptrss:[esp+0xF],cl&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|
004B0207&nbsp;|&nbsp;popecx&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|
004B0208&nbsp;|&nbsp;addecx,0xFFFDC76A&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; |
004B020E&nbsp;|&nbsp;jmpecx&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|
00455826&nbsp;|&nbsp;popedx&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|
00455827&nbsp;|&nbsp;movedx,dwordptrds:[eax]//取出虚拟寄存器的值
00455829&nbsp;|&nbsp;call123.vmp模版+部分.44DAE9&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; |
0044DAE9&nbsp;|&nbsp;movdwordptrds:[edi-0x10],edx//值写入虚拟栈

第5点：Handler的二级融合，在一级融合的基础上还有二级融合，比如执行模拟加法运算的Handler组合。首先第一条Handler是从伪代码读取常数作为加数，第二条Handler是从伪代码读取常数作为被加数，第三条Handler是执行加法运算，以前的handler逻辑是第一条和第二条handler，从伪代码读取到加数和被加数都是放到虚拟栈中去。然后第三条加法handler从虚拟栈中获取两个加数和被加数再执行ADD指令，在这里他把值放到虚拟栈中的指令给丢弃了，直接绑定了对应的寄存器。

例如第一条Handler读取的值存放到eax，第二条Handler读取的值存放到ecx,第三条handelr直接执行add eax,ecx,算出的结果在eax，同样可以不放到虚拟栈中，参与第四条handler的运算。

//PushVR8点变形
0043B239&nbsp;|&nbsp;leaedx,dwordptrss:[esp+0x50]//算出虚拟寄存器地址
0043B23D&nbsp;|&nbsp;movecx,0x489D36B2&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; |
0043B242&nbsp;|&nbsp;sarecx,0x45&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; |
0043B245&nbsp;|&nbsp;rorcl,0x67&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|
0043B248&nbsp;|&nbsp;movzxcx,byteptrds:[ecx+edx-0x244E96B]//取出虚拟寄存器的值存入cx
0043B251&nbsp;|&nbsp;jb123.vmp模版+部分.48BAC5&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; |
0043B257&nbsp;|&nbsp;moveax,0xFF9BE60E&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; |
0043B25C&nbsp;|&nbsp;movdx,cx//将cx的值转移到dx，这个其实也可以算作一个混淆大点
0043B25F&nbsp;|&nbsp;shleax,0xB1//到这来并没有将读取到的值存入到虚拟栈中去
//PopVR8
0043B262&nbsp;|&nbsp;movzxecx,byteptrss:[ebp-0x6]//读取伪代码
0043B267&nbsp;|&nbsp;popeax&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|
0043B268&nbsp;|&nbsp;addeax,0xD15B&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; |
0043B26D&nbsp;|&nbsp;jmpeax&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|
00499668&nbsp;|&nbsp;xorcl,bl
0049966A&nbsp;|&nbsp;moveax,0x822BE31F
0049966F&nbsp;|&nbsp;shlal,0xC6&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|
00499672&nbsp;|&nbsp;subax,0x923B&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|
00499676&nbsp;|&nbsp;xorcl,0x3E
00499679&nbsp;|&nbsp;notcl
0049967B&nbsp;|&nbsp;jmp123.vmp模版+部分.4570F0&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|
004570F0&nbsp;|&nbsp;pusheax&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; |
004570F1&nbsp;|&nbsp;addcl,0xA3
004570F4&nbsp;|&nbsp;xorax,ax&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|
004570F7&nbsp;|&nbsp;rorcl,0x1
004570F9&nbsp;|&nbsp;shleax,0x4D&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; |
004570FC&nbsp;|&nbsp;sareax,0xB7&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; |
004570FF&nbsp;|&nbsp;xorbl,cl//解密出偏移
00457101&nbsp;|&nbsp;negal&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; |
00457103&nbsp;|&nbsp;subax,0xEC15&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|
00457107&nbsp;|&nbsp;sbbeax,eax&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|
00457109&nbsp;|&nbsp;leaecx,dwordptrss:[esp+ecx+0x4]//算出虚拟寄存器地址
0045710D&nbsp;|&nbsp;roral,0xC1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|
00457110&nbsp;|&nbsp;movbyteptrds:[ecx],dl//将dl值写入虚拟寄存器中

第6点：寄存器的释放，我们知道 ebp,esi,edi这三个轮转寄存器都有各自的功能，在一个流程块快结束的时候，也就是快要执行虚拟机退出Handler的时候，当某一条Handler之后的handler不再读取伪代码指令或者计算下一条handler的地址的时候，其相应的寄存器会被释放。

比如说伪代码寄存器或者调度寄存器的值进行随意赋值或者将其用作加密内存地址常数的寄存器，这么做表面上看起来毫无意义，但是在我们开发插件的代码中就需要进行非常大的逻辑改动了。

果然原作者还是自己会先把自家VMProtect给狂扁一顿：

//执行跳转到下一条Handler
0042E08C&nbsp;|&nbsp;jmpebp
//PushVR32
004DF21B&nbsp;|&nbsp;jmp123.vmp简单+最大保护.4E7299
004E7299&nbsp;|&nbsp;movecx,0xEC3505BA&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; |
004E729E&nbsp;|&nbsp;movzxeax,byteptrds:[esi-0x1]//读取伪代码
004E72A2&nbsp;|&nbsp;movsxebp,cl//调度寄存器ebp的值被释放
004E72A5&nbsp;|&nbsp;xoral,bl
004E72A7&nbsp;|&nbsp;roral,0x1
004E72A9&nbsp;|&nbsp;jmp123.vmp简单+最大保护.4F5E38&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|
004F5E38&nbsp;|&nbsp;movzxedx,cl&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; |
004F5E3B&nbsp;|&nbsp;addal,0x98
004F5E3D&nbsp;|&nbsp;movsxesi,dl//调度寄存器ebp的值被释放
004F5E40&nbsp;|&nbsp;pushedx&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; |
004F5E41&nbsp;|&nbsp;notwordptrss:[esp+edx*4-0x2E8]&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|
004F5E49&nbsp;|&nbsp;notal
004F5E4B&nbsp;|&nbsp;rolal,0x1
004F5E4D&nbsp;|&nbsp;decdl&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; |
004F5E4F&nbsp;|&nbsp;andecx,dwordptrss:[esp+edx*8-0x5C8]&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; |
004F5E56&nbsp;|&nbsp;jge123.vmp简单+最大保护.4AD5DC&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|
004AD5DC&nbsp;|&nbsp;decal
004AD5DE&nbsp;|&nbsp;xorbl,al//伪代码解密完成
004AD5E0&nbsp;|&nbsp;notcx&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; |
004AD5E3&nbsp;|&nbsp;rolwordptrss:[esp+ecx-0xFAFE],0xA7&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|
004AD5EC&nbsp;|&nbsp;leaeax,dwordptrss:[esp+eax+0x4]// 算出虚拟寄存器
004AD5F0&nbsp;|&nbsp;shldx,0xEE&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|
004AD5F4&nbsp;|&nbsp;sbbecx,0x39B0CEB2&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; |
004AD5FA&nbsp;|&nbsp;movedx,dwordptrds:[eax+edx*4-0x10000]//读取虚拟寄存器的值
004AD601&nbsp;|&nbsp;movdwordptrds:[edi-0x4],edx//值存入虚拟栈
//PushVR32的变形
004AD604&nbsp;|&nbsp;leaedx,dwordptrss:[esp+0x4C]// 算出虚拟寄存器
004AD608&nbsp;|&nbsp;movecx,dwordptrds:[edx]//读取虚拟寄存器的值
004AD60A&nbsp;|&nbsp;subesi,ebp&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|
004AD60C&nbsp;|&nbsp;movsxeax,byteptrss:[esp+esi*8]&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|
004AD610&nbsp;|&nbsp;pusheax&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; |
004AD611&nbsp;|&nbsp;movdwordptrds:[edi+esi-0x8],ecx//值存入虚拟栈
// VMExit 离开虚拟机
004AD615&nbsp;|&nbsp;movedx,ebp
004AD617&nbsp;|&nbsp;leaesp,dwordptrss:[esp+0x8]&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; |
004AD61B&nbsp;|&nbsp;leaesp,dwordptrds:[edi+esi-0x8]//虚拟栈指针还给esp
004AD61F&nbsp;|&nbsp;leaebx,dwordptrds:[eax-0x3B72475A]&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|
004AD625&nbsp;|&nbsp;popebp//恢复到真实ebp
004AD626&nbsp;|&nbsp;shrbl,0x41&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|
004AD629&nbsp;|&nbsp;popecx//恢复到真实ecx
004AD62A&nbsp;|&nbsp;setnpbl&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; |
004AD62D&nbsp;|&nbsp;shldl,0x47&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|
004AD630&nbsp;|&nbsp;notsi&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; |
004AD633&nbsp;|&nbsp;popfd//恢复到真实eflag
004AD634&nbsp;|&nbsp;bswapesi&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|
004AD636&nbsp;|&nbsp;popeax//恢复到真实eax
004AD637&nbsp;|&nbsp;popedi//恢复到真实edi
004AD638&nbsp;|&nbsp;popesi//恢复到真实esi
004AD639&nbsp;|&nbsp;popedx//恢复到真实edx
004AD63A&nbsp;|&nbsp;popebx//恢复到真实ebx
004AD63B&nbsp;|&nbsp;call123.vmp简单+最大保护.495550&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; |
00495550&nbsp;|&nbsp;leaesp,dwordptrss:[esp+0x4]&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; |
00495554&nbsp;|&nbsp;ret//离开虚拟机返回到真实指令

第7点：轮转寄存器和解密寄存器的偷换，这是我在分析万用门handler的时候发现的，万用门handler算是虚拟机中比较敏感的handler了，这类handler通常都是找jcc爆破的关键handler，所以说作者在这方面应该是加固加固再加固的。

怎么换呢？这里面先将虚拟栈寄存器ebp的值给eax,那么eax这时候就是ebp的分身了。这样子，我们在判断某一条指令是不是读取虚拟栈内存的时候是不是就变得困难了，这里面可能还包括伪代码寄存器也会这样做，目前我还没发现。

//PushVStack 这是虚拟栈寄存器存入虚拟栈的Handler
004F61DF&nbsp;|&nbsp;movecx,esi//当前虚拟栈寄存器是esi值给ecx
004F61E1&nbsp;|&nbsp;rordl,0xC5&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|
004F61E4&nbsp;|&nbsp;jae123.vmp模版+部分.556582&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|
004F61EA&nbsp;|&nbsp;movdwordptrds:[esi+eax*4-0x8AA4860],ecx//ecx值存入虚拟栈
//Dispatcher 计算下一条Handler地址
004F61F1&nbsp;|&nbsp;oral,ah
004F61F3&nbsp;|&nbsp;moveax,dwordptrss:[ebp+eax*2-0x4552532]//读取伪代码
004F61FA&nbsp;|&nbsp;pushedx&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; |
004F61FB&nbsp;|&nbsp;leaedx,dwordptrds:[edx+edx+0x4A284788]&nbsp; &nbsp; &nbsp; &nbsp;|
004F6202&nbsp;|&nbsp;leaebp,dwordptrss:[ebp+edx-0x4A2848FC]
004F6209&nbsp;|&nbsp;movsxecx,dl&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; |
004F620C&nbsp;|&nbsp;jne123.vmp模版+部分.431ABA&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|
00431ABA&nbsp;|&nbsp;xoreax,ebx
00431ABC&nbsp;|&nbsp;subeax,0x91B19C05
00431AC1&nbsp;|&nbsp;call123.vmp模版+部分.4A467A&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; |
004A467A&nbsp;|&nbsp;adddx,cx&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|
004A467D&nbsp;|&nbsp;noteax
004A467F&nbsp;|&nbsp;movdwordptrss:[esp+edx-0x4A2848F0],ecx&nbsp; &nbsp; &nbsp; &nbsp;|
004A4686&nbsp;|&nbsp;xoreax,0x4122C6BE
004A468B&nbsp;|&nbsp;xorcl,0x27&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|
004A468E&nbsp;|&nbsp;subedx,0xF40FEF8C&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; |
004A4694&nbsp;|&nbsp;deceax
004A4695&nbsp;|&nbsp;call123.vmp模版+部分.43DAFA&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; |
0043DAFA&nbsp;|&nbsp;shlecx,0x96&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; |
0043DAFD&nbsp;|&nbsp;oredx,edx&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; |
0043DAFF&nbsp;|&nbsp;xorebx,eax//伪代码解密完成
0043DB01&nbsp;|&nbsp;addedi,eax//edi是调度寄存器，计算下一条Handler地址
//Nor32 这是一个万用门Handler
0043DB03&nbsp;|&nbsp;pushecx
0043DB04&nbsp;|&nbsp;subcx,wordptrss:[esp+edx-0x56185964]&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|
0043DB0C&nbsp;|&nbsp;incdx&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; |
0043DB0F&nbsp;|&nbsp;moveax,dwordptrds:[esi+edx-0x56185969]//从虚拟栈取出前面压入的虚拟栈指针
0043DB16&nbsp;|&nbsp;popecx&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|
0043DB17&nbsp;|&nbsp;movedx,dwordptrss:[eax+edx-0x56185965]//这条指令相当于从虚拟栈中读取参数1
0043DB1F&nbsp;|&nbsp;jo123.vmp模版+部分.449C0D&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; |
0043DB25&nbsp;|&nbsp;inccl&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; |
0043DB27&nbsp;|&nbsp;moveax,edx//将参数1从eax转移到edx
0043DB29&nbsp;|&nbsp;popecx&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|
0043DB2A&nbsp;|&nbsp;adcecx,0x2C648&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|
0043DB30&nbsp;|&nbsp;jmpecx&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|
004D0CE2&nbsp;|&nbsp;jmp123.vmp模版+部分.4F19A1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|
004F19A1&nbsp;|&nbsp;movedx,dwordptrds:[esi]//从虚拟栈中读取参数2
004F19A4&nbsp;|&nbsp;movecx,0xD886303E
004F19A9&nbsp;|&nbsp;noteax//取反参数1
004F19AB&nbsp;|&nbsp;deccx&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; |
004F19AE&nbsp;|&nbsp;rorcl,0x27&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|
004F19B1&nbsp;|&nbsp;notedx//取反参数2
004F19B3&nbsp;|&nbsp;shlbyteptrss:[esp+0x2],0x42&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; |
004F19B8&nbsp;|&nbsp;orecx,ecx//执行或运算
004F19BA&nbsp;|&nbsp;andeax,edx&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|
004F19BC&nbsp;|&nbsp;movdwordptrds:[esi],eax//结果存放到虚拟栈

以上就是 VMProtect 3.8.1 核心混淆策略的全拆解，高版本 VMP 的全指令变形、Handler 多级融合、内存常数加密等机制，看似彻底阻断逆向分析，实则有完整的破解思路与落地方法。

如果想把文章里的理论变成可实战的逆向能力，彻底搞定高版本 VMP 逆向、Handler 抗变形识别、x32/x64 调试器插件开发，欢迎关注课程：《VMProtect 分析与调试器插件开发》从 VMP 底层架构到插件实战开发，全程带你啃下高版本 VMP 逆向硬骨头。

VMProtect分析与调试器插件开发-999元

#

看雪ID：阿强

https://bbs.kanxue.com/user-home-1004848.htm

*本文为看雪论坛优秀文章，由阿强原创，转载请注明来自看雪社区

往期推荐

Ptrace注入代码在不同平台的区别（ARM64、x86-64、MIPS64）

浅谈梯度分析与样本对抗：以vlm和ddddocr为例

ANDROID 黑科技 : 保活机制深度逆向

更好理解：CVE-2021-1732漏洞分析报告与利用

LLVM Pass编写及去除 —— 控制流平坦化

球分享

球点赞

球在看

点击阅读原文查看更多

免责声明：

本文所载程序、技术方法仅面向合法合规的安全研究与教学场景，旨在提升网络安全防护能力，具有明确的技术研究属性。

任何单位或个人未经授权，将本文内容用于攻击、破坏等非法用途的，由此引发的全部法律责任、民事赔偿及连带责任，均由行为人独立承担，本站不承担任何连带责任。

本站内容均为技术交流与知识分享目的发布，若存在版权侵权或其他异议，请通过邮件联系处理，具体联系方式可点击页面上方的联系我。

本文转载自：看雪学苑阿强阿强《VMProtect 3.8.1 混淆策略大揭秘》