Marker issues

Issues related to VMProtect
Post Reply
roxaz
Posts: 1
Joined: Mon Sep 14, 2009 6:44 pm

Marker issues

Post by roxaz »

I test VMProtect on x64 dll, so i have to use marker call. Thing is that VMProtect reports that there are 4 unpaired markers, and it does not display any marked functions in the list of functions to virtualize. So not a single marked function is virtualized. Is demo version supposed not to handle marked functions or whats wrong? By the way i checked my dll in disassembler - i have matching count of calls to virtualization start and end callbacks.
Top
Admin
Site Admin
Posts: 2586
Joined: Mon Aug 21, 2006 8:19 pm
Location: Russia, E-burg
Contact:
Contact Admin

Post by Admin »

The cause of this situation - the code optimization. In the result you have some VMProtectEnd on one VMProtectBegin.
Top
ssack
Posts: 10
Joined: Sun Jun 28, 2009 1:33 am

Post by ssack »

Admin wrote:The cause of this situation - the code optimization. In the result you have some VMProtectEnd on one VMProtectBegin.
how to solve?
Top
Admin
Site Admin
Posts: 2586
Joined: Mon Aug 21, 2006 8:19 pm
Location: Russia, E-burg
Contact:
Contact Admin

Post by Admin »

Use MACRO markers instead API markers.
Top
ssack
Posts: 10
Joined: Sun Jun 28, 2009 1:33 am

Post by ssack »

new makers no macro define
Top
Admin
Site Admin
Posts: 2586
Joined: Mon Aug 21, 2006 8:19 pm
Location: Russia, E-burg
Contact:
Contact Admin

Post by Admin »

You can use markers from previous version:

Code: Select all

	#define VMProtectBegin \
		__asm _emit 0xEB \
		__asm _emit 0x10 \
		__asm _emit 0x56 \
		__asm _emit 0x4D \
		__asm _emit 0x50 \
		__asm _emit 0x72 \
		__asm _emit 0x6F \
		__asm _emit 0x74 \
		__asm _emit 0x65 \
		__asm _emit 0x63 \
		__asm _emit 0x74 \
		__asm _emit 0x20 \
		__asm _emit 0x62 \
		__asm _emit 0x65 \
		__asm _emit 0x67 \
		__asm _emit 0x69 \
		__asm _emit 0x6E \
		__asm _emit 0x00 \

	#define VMProtectBeginVirtualization \
		__asm _emit 0xEB \
		__asm _emit 0x10 \
		__asm _emit 0x56 \
		__asm _emit 0x4D \
		__asm _emit 0x50 \
		__asm _emit 0x72 \
		__asm _emit 0x6F \
		__asm _emit 0x74 \
		__asm _emit 0x65 \
		__asm _emit 0x63 \
		__asm _emit 0x74 \
		__asm _emit 0x20 \
		__asm _emit 0x62 \
		__asm _emit 0x65 \
		__asm _emit 0x67 \
		__asm _emit 0x69 \
		__asm _emit 0x6E \
		__asm _emit 0x01 \

	#define VMProtectBeginMutation \
		__asm _emit 0xEB \
		__asm _emit 0x10 \
		__asm _emit 0x56 \
		__asm _emit 0x4D \
		__asm _emit 0x50 \
		__asm _emit 0x72 \
		__asm _emit 0x6F \
		__asm _emit 0x74 \
		__asm _emit 0x65 \
		__asm _emit 0x63 \
		__asm _emit 0x74 \
		__asm _emit 0x20 \
		__asm _emit 0x62 \
		__asm _emit 0x65 \
		__asm _emit 0x67 \
		__asm _emit 0x69 \
		__asm _emit 0x6E \
		__asm _emit 0x02 \

	#define VMProtectBeginUltra \
		__asm _emit 0xEB \
		__asm _emit 0x10 \
		__asm _emit 0x56 \
		__asm _emit 0x4D \
		__asm _emit 0x50 \
		__asm _emit 0x72 \
		__asm _emit 0x6F \
		__asm _emit 0x74 \
		__asm _emit 0x65 \
		__asm _emit 0x63 \
		__asm _emit 0x74 \
		__asm _emit 0x20 \
		__asm _emit 0x62 \
		__asm _emit 0x65 \
		__asm _emit 0x67 \
		__asm _emit 0x69 \
		__asm _emit 0x6E \
		__asm _emit 0x03 \

	#define VMProtectEnd \
		__asm _emit 0xEB \
		__asm _emit 0x0E \
		__asm _emit 0x56 \
		__asm _emit 0x4D \
		__asm _emit 0x50 \
		__asm _emit 0x72 \
		__asm _emit 0x6F \
		__asm _emit 0x74 \
		__asm _emit 0x65 \
		__asm _emit 0x63 \
		__asm _emit 0x74 \
		__asm _emit 0x20 \
		__asm _emit 0x65 \
		__asm _emit 0x6E \
		__asm _emit 0x64 \
		__asm _emit 0x00 \
Top
gnjp
Posts: 2
Joined: Thu Jan 28, 2010 9:47 am

Re: Marker issues

Post by gnjp »

I had this problem too, turning optimization of using pragma fixed it:

in MSVC++

#pragma optimize( "g", off )

// code

#pragma optimize( "g", on )
Top
sjsteve33171
Posts: 2
Joined: Fri Dec 17, 2010 11:36 am

Re: Marker issues

Post by sjsteve33171 »

Thanks to both of you it fixed my error of unmatched pairs.

One other way is to edit the properties of the project, expand C++, select Optimization and disable it from the top option. After that select Code Generation and disable the Buffer Security Check.

Everything works after that.
Top
Post Reply

Return to “Technical questions”