Useful scripts

[Admin]

1. Replace markers with closest functions (MAP/PDB/debug symbols are required):

Code: Select all

local input = vmprotect:core():inputFile()
for i = 1, input:count() do
  local file = input:item(i)
  if file:functions() ~= nil then
    for f = 1, file:functions():count() do
      local func = file:functions():item(f)
      if func:type() == ObjectType.APIMarker and func:needCompile() then
        local closest = nil
        for m = 1, file:mapFunctions():count() do
          local map = file:mapFunctions():item(m)
          if map:type() == ObjectType.Code and map:address() < func:address() then
            if closest == nil or closest:address() < map:address() then
              closest = map
            end
          end
        end
    
        if closest then
          print(func:name() .. ' replaced with ' .. closest:name())
          func:setNeedCompile(false)
          file:functions():addByAddress(closest:address(), func:compilationType())
        end
      end
    end
  end
end

2. .NET: Disable renaming of methods with script

Just change CLASS_NAME to required class name like 'Test':

Code: Select all

function OnBeforeCompilation()
	local heap = vmprotect.core():outputArchitecture():streams()
	local methods = heap:table(TokenType.MethodDef)
	for i = 1, methods:count() do
		local method = methods:item(i)
		if method:declaringType():name() == CLASS_NAME then
			method:setRenameMode(RenameMode.None)
		end
	end
end

3. Exclude header from CRC checking (for PE only):

Code: Select all

function OnBeforeCompilation()
	local header = vmprotect.core():outputArchitecture():segments():header()
	if header ~= nil then
		header:setExcludedFromMemoryProtection(true)
	end
end