Vmprotect Fix the Import table plugin

Shell version: vmprotect.ultimate.2.12.3

Sample: TKLobby.exe

Purpose: IAT Repair

Mrwrong

Title: Vmprotect fix Import Table plug-in

just interested, no other purpose. Where mistakes are made please be advised by the heroes !

Strictly speaking, the work of this article is only after running to VMP protected EXE OEP, repair the system long call and long JMP, there are some MOV reg, [iat_addr]. Plug-in implementation according to the original post: "Explore VMP 2.12.3 Import Table Repair"

Links: http://www.cnblogs.com/MrWrong/p/3640369.html

The original post has a bit of a bug in the details of the fix.

Plugin is not very good, so have an EXE program as an example, cut a few key figures.

With the EXE is JJ Tournament Hall: http://www.jj.cn

Under a current version of the latest Jjmatch-id4501562-childid-.exe

Hall Program name TKLobby.exe

Run Oep first. Oep for 0043F3AA.

Then right-click on the code window->vmpiatrepair-> to fix the IAT

Click to pop Up a window called dialog. Yes, the window name is actually called dialog, or a modal dialog box. (Too lazy, hard to do)

Fill in the data in the window. Note that it is 16-binary RVA, see figure.

Then click OK and the fix is complete.

After the fix, open the Log window and find the address information for each repaired call and JMP (the original long jmp and long call are fixed to short jmp and short call).

What happens next? Look at my "Explore vmp 2.12.3 Import Table Repair" said to do, do not repeat the talk.

Other versions of VMP you can also try to use the plug-in, you do not have to make a full look at your face (in fact I do not know which version of the sample is VMP, all because of good face). Also, the repair of DLLs is not supported at this time.

File Http://files.cnblogs.com/files/MrWrong/VMProtect%E4%BF%AE%E5%A4%8D%E5%AF%BC%E5%85%A5%E8%A1%A8%E7%9A%84%E6%8F %92%e4%bb%b6.zip

Baidu Cloud: Link: http://pan.baidu.com/s/1qWkNTt6 Password: iwk6 (Baidu Cloud inside has JJ game installation program)

Finally, special thanks to friends Keykernel help. One learns without a friend, and the know is solitary.

Vmprotect Fix the Import table plugin