VMProfiler  v1.8
vmprofiler is a c++ library which is used to statically analyze VMProtect 2 polymorphic virtual machines. This project is inherited in vmprofiler-qt, vmprofiler-cli, and vmemu.
Variables
vm::handler::profile Namespace Reference

contains all profiles defined, as well as a vector of all of the defined profiles... More...

Variables

vm::handler::profile_t sregq
 
vm::handler::profile_t sregdw
 
vm::handler::profile_t sregw
 
vm::handler::profile_t lregq
 
vm::handler::profile_t lregdw
 
vm::handler::profile_t lconstq
 
vm::handler::profile_t lconstdw
 
vm::handler::profile_t lconstw
 
vm::handler::profile_t lconstbzxw
 
vm::handler::profile_t lconstbsxdw
 
vm::handler::profile_t lconstbsxq
 
vm::handler::profile_t lconstdwsxq
 
vm::handler::profile_t lconstwsxq
 
vm::handler::profile_t lconstwsxdw
 
vm::handler::profile_t addq
 
vm::handler::profile_t adddw
 
vm::handler::profile_t addw
 
vm::handler::profile_t shlq
 
vm::handler::profile_t shldw
 
vm::handler::profile_t shlddw
 
vm::handler::profile_t nandq
 
vm::handler::profile_t nanddw
 
vm::handler::profile_t nandw
 
vm::handler::profile_t nandb
 
vm::handler::profile_t writeq
 
vm::handler::profile_t writedw
 
vm::handler::profile_t writeb
 
vm::handler::profile_t readq
 
vm::handler::profile_t readdw
 
vm::handler::profile_t shrq
 
vm::handler::profile_t shrw
 
vm::handler::profile_t lrflags
 
vm::handler::profile_t call
 
vm::handler::profile_t pushvsp
 
vm::handler::profile_t mulq
 
vm::handler::profile_t divq
 
vm::handler::profile_t jmp
 
vm::handler::profile_t lvsp
 
vm::handler::profile_t vmexit
 
std::vector< vm::handler::profile_t * > all
 a vector of pointers to all defined vm handler profiles... More...
 
vm::handler::profile_t writew
 

Detailed Description

contains all profiles defined, as well as a vector of all of the defined profiles...

Variable Documentation

◆ adddw

vm::handler::profile_t vm::handler::profile::adddw
Initial value:
= {
"ADDDW",
NULL,
{ {
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_ADD && instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_MEMORY &&
instr.operands[ 0 ].mem.base == ZYDIS_REGISTER_RBP &&
instr.operands[ 0 ].mem.disp.value == 0x8 &&
instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[ 1 ].reg.value == ZYDIS_REGISTER_EAX;
},
[]( const zydis_decoded_instr_t &instr ) -> bool { return instr.mnemonic == ZYDIS_MNEMONIC_PUSHFQ; },
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_POP && instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_MEMORY &&
instr.operands[ 0 ].mem.base == ZYDIS_REGISTER_RBP;
} } } }
@ ADDDW
Definition: vmprofiles.hpp:51
ZydisDecodedInstruction zydis_decoded_instr_t
Definition: vmutils.hpp:18

◆ addq

vm::handler::profile_t vm::handler::profile::addq
Initial value:
= {
"ADDQ",
NULL,
{ {
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_ADD && instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_MEMORY &&
instr.operands[ 0 ].mem.base == ZYDIS_REGISTER_RBP &&
instr.operands[ 0 ].mem.disp.value == 0x8 &&
instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[ 1 ].reg.value == ZYDIS_REGISTER_RAX;
},
[]( const zydis_decoded_instr_t &instr ) -> bool { return instr.mnemonic == ZYDIS_MNEMONIC_PUSHFQ; },
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_POP && instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_MEMORY &&
instr.operands[ 0 ].mem.base == ZYDIS_REGISTER_RBP;
} } } }
@ ADDQ
Definition: vmprofiles.hpp:50

◆ addw

vm::handler::profile_t vm::handler::profile::addw
Initial value:
= {
"ADDW",
NULL,
{ {
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_ADD && instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_MEMORY &&
instr.operands[ 0 ].mem.base == ZYDIS_REGISTER_RBP &&
instr.operands[ 0 ].mem.disp.value == 0x8 &&
instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[ 1 ].reg.value == ZYDIS_REGISTER_AX;
},
[]( const zydis_decoded_instr_t &instr ) -> bool { return instr.mnemonic == ZYDIS_MNEMONIC_PUSHFQ; },
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_POP && instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_MEMORY &&
instr.operands[ 0 ].mem.base == ZYDIS_REGISTER_RBP;
} } } }
@ ADDW
Definition: vmprofiles.hpp:52

◆ all

std::vector< vm::handler::profile_t * > vm::handler::profile::all
inline
Initial value:
= {
&divq, &jmp, &lrflags, &vmexit, &call }
vm::handler::profile_t lconstw
Definition: lconst.cpp:50
vm::handler::profile_t writeb
Definition: write.cpp:125
vm::handler::profile_t lconstwsxq
Definition: lconst.cpp:171
vm::handler::profile_t nandb
Definition: nand.cpp:162
vm::handler::profile_t lvsp
Definition: lvsp.cpp:5
vm::handler::profile_t lconstdw
Definition: lconst.cpp:28
vm::handler::profile_t pushvsp
Definition: pushvsp.cpp:5
vm::handler::profile_t lconstbsxq
Definition: lconst.cpp:121
vm::handler::profile_t lregq
Definition: lreg.cpp:5
vm::handler::profile_t nandq
Definition: nand.cpp:5
vm::handler::profile_t sregdw
Definition: sreg.cpp:38
vm::handler::profile_t sregw
Definition: sreg.cpp:72
vm::handler::profile_t shrw
Definition: shr.cpp:64
vm::handler::profile_t lrflags
Definition: lflags.cpp:5
vm::handler::profile_t mulq
Definition: mul.cpp:5
vm::handler::profile_t nanddw
Definition: nand.cpp:68
vm::handler::profile_t adddw
Definition: add.cpp:28
vm::handler::profile_t writeq
Definition: write.cpp:5
vm::handler::profile_t shlddw
Definition: shld.cpp:5
vm::handler::profile_t jmp
Definition: jmp.cpp:5
vm::handler::profile_t readq
Definition: read.cpp:5
vm::handler::profile_t writedw
Definition: write.cpp:45
vm::handler::profile_t vmexit
Definition: vmexit.cpp:5
vm::handler::profile_t sregq
Definition: sreg.cpp:5
vm::handler::profile_t addq
Definition: add.cpp:5
vm::handler::profile_t readdw
Definition: read.cpp:27
vm::handler::profile_t lconstbzxw
Definition: lconst.cpp:72
vm::handler::profile_t shlq
Definition: shl.cpp:5
vm::handler::profile_t call
Definition: call.cpp:5
vm::handler::profile_t shldw
Definition: shl.cpp:64
vm::handler::profile_t lconstbsxdw
Definition: lconst.cpp:95
vm::handler::profile_t lconstq
Definition: lconst.cpp:5
vm::handler::profile_t nandw
Definition: nand.cpp:115
vm::handler::profile_t lregdw
Definition: lreg.cpp:39
vm::handler::profile_t lconstdwsxq
Definition: lconst.cpp:147
vm::handler::profile_t shrq
Definition: shr.cpp:5
vm::handler::profile_t addw
Definition: add.cpp:51
vm::handler::profile_t lconstwsxdw
Definition: lconst.cpp:197
vm::handler::profile_t divq
Definition: div.cpp:5

a vector of pointers to all defined vm handler profiles...

◆ call

vm::handler::profile_t vm::handler::profile::call
Initial value:
= {
"CALL",
NULL,
{ {
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_MOV &&
instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[ 0 ].reg.value == ZYDIS_REGISTER_RDX &&
instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_MEMORY &&
instr.operands[ 1 ].mem.base == ZYDIS_REGISTER_RBP;
},
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_ADD &&
instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[ 0 ].reg.value == ZYDIS_REGISTER_RBP &&
instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_IMMEDIATE &&
instr.operands[ 1 ].imm.value.u == 0x8;
},
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_CALL &&
instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[ 0 ].reg.value == ZYDIS_REGISTER_RDX;
} } } }
@ CALL
Definition: vmprofiles.hpp:19

◆ divq

vm::handler::profile_t vm::handler::profile::divq

◆ jmp

vm::handler::profile_t vm::handler::profile::jmp

◆ lconstbsxdw

vm::handler::profile_t vm::handler::profile::lconstbsxdw
Initial value:
= {
"LCONSTBSXDW",
8,
{ {
[]( const zydis_decoded_instr_t &instr ) -> bool { return instr.mnemonic == ZYDIS_MNEMONIC_CWDE; },
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_SUB &&
instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[ 0 ].reg.value == ZYDIS_REGISTER_RBP &&
instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_IMMEDIATE &&
instr.operands[ 1 ].imm.value.u == 0x4;
},
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_MOV && instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_MEMORY &&
instr.operands[ 0 ].mem.base == ZYDIS_REGISTER_RBP &&
instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[ 1 ].reg.value == ZYDIS_REGISTER_EAX;
} } },
@ LCONSTBSXDW
Definition: vmprofiles.hpp:34
@ sign_extend
Definition: vmprofiles.hpp:81

◆ lconstbsxq

vm::handler::profile_t vm::handler::profile::lconstbsxq
Initial value:
= {
"LCONSTBSXQ",
8,
{ {
[]( const zydis_decoded_instr_t &instr ) -> bool { return instr.mnemonic == ZYDIS_MNEMONIC_CDQE; },
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_SUB &&
instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[ 0 ].reg.value == ZYDIS_REGISTER_RBP &&
instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_IMMEDIATE &&
instr.operands[ 1 ].imm.value.u == 0x8;
},
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_MOV && instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_MEMORY &&
instr.operands[ 0 ].mem.base == ZYDIS_REGISTER_RBP &&
instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[ 1 ].reg.value == ZYDIS_REGISTER_RAX;
} } },
@ LCONSTBSXQ
Definition: vmprofiles.hpp:33

◆ lconstbzxw

vm::handler::profile_t vm::handler::profile::lconstbzxw
Initial value:
= {
"LCONSTBZXW",
8,
{ {
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_SUB &&
instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[ 0 ].reg.value == ZYDIS_REGISTER_RBP &&
instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_IMMEDIATE &&
instr.operands[ 1 ].imm.value.u == 0x2;
},
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_MOV && instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_MEMORY &&
instr.operands[ 0 ].mem.base == ZYDIS_REGISTER_RBP &&
instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[ 1 ].reg.value == ZYDIS_REGISTER_AX;
} } } }
@ LCONSTBZXW
Definition: vmprofiles.hpp:32

◆ lconstdw

vm::handler::profile_t vm::handler::profile::lconstdw
Initial value:
= {
"LCONSTDW",
32,
{ {
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_SUB &&
instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[ 0 ].reg.value == ZYDIS_REGISTER_RBP &&
instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_IMMEDIATE &&
instr.operands[ 1 ].imm.value.u == 0x4;
},
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_MOV && instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_MEMORY &&
instr.operands[ 0 ].mem.base == ZYDIS_REGISTER_RBP &&
instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[ 1 ].reg.value == ZYDIS_REGISTER_EAX;
} } } }
@ LCONSTDW
Definition: vmprofiles.hpp:38

◆ lconstdwsxq

vm::handler::profile_t vm::handler::profile::lconstdwsxq
Initial value:
= {
"LCONSTDWSXQ",
32,
{
[]( const zydis_decoded_instr_t &instr ) -> bool { return instr.mnemonic == ZYDIS_MNEMONIC_CDQE; },
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_SUB && instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[ 0 ].reg.value == ZYDIS_REGISTER_RBP &&
instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_IMMEDIATE && instr.operands[ 1 ].imm.value.u == 0x8;
},
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_MOV && instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_MEMORY &&
instr.operands[ 0 ].mem.base == ZYDIS_REGISTER_RBP &&
instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[ 1 ].reg.value == ZYDIS_REGISTER_RAX;
} },
@ LCONSTDWSXQ
Definition: vmprofiles.hpp:35

◆ lconstq

vm::handler::profile_t vm::handler::profile::lconstq
Initial value:
= {
"LCONSTQ",
64,
{ {
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_SUB &&
instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[ 0 ].reg.value == ZYDIS_REGISTER_RBP &&
instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_IMMEDIATE &&
instr.operands[ 1 ].imm.value.u == 0x8;
},
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_MOV && instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_MEMORY &&
instr.operands[ 0 ].mem.base == ZYDIS_REGISTER_RBP &&
instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[ 1 ].reg.value == ZYDIS_REGISTER_RAX;
} } } }
@ LCONSTQ
Definition: vmprofiles.hpp:31

◆ lconstw

vm::handler::profile_t vm::handler::profile::lconstw
Initial value:
= {
"LCONSTW",
16,
{ {
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_SUB &&
instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[ 0 ].reg.value == ZYDIS_REGISTER_RBP &&
instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_IMMEDIATE &&
instr.operands[ 1 ].imm.value.u == 0x2;
},
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_MOV && instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_MEMORY &&
instr.operands[ 0 ].mem.base == ZYDIS_REGISTER_RBP &&
instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[ 1 ].reg.value == ZYDIS_REGISTER_AX;
} } } }
@ LCONSTW
Definition: vmprofiles.hpp:39

◆ lconstwsxdw

vm::handler::profile_t vm::handler::profile::lconstwsxdw
Initial value:
= {
"LCONSTWSXDW",
16,
{ {
[]( const zydis_decoded_instr_t &instr ) -> bool { return instr.mnemonic == ZYDIS_MNEMONIC_CWDE; },
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_SUB &&
instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[ 0 ].reg.value == ZYDIS_REGISTER_RBP &&
instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_IMMEDIATE &&
instr.operands[ 1 ].imm.value.u == 0x4;
},
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_MOV && instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_MEMORY &&
instr.operands[ 0 ].mem.base == ZYDIS_REGISTER_RBP &&
instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[ 1 ].reg.value == ZYDIS_REGISTER_EAX;
} } },
@ LCONSTWSXDW
Definition: vmprofiles.hpp:37

◆ lconstwsxq

vm::handler::profile_t vm::handler::profile::lconstwsxq
Initial value:
= {
"LCONSTWSXQ",
16,
{ {
[]( const zydis_decoded_instr_t &instr ) -> bool { return instr.mnemonic == ZYDIS_MNEMONIC_CDQE; },
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_SUB &&
instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[ 0 ].reg.value == ZYDIS_REGISTER_RBP &&
instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_IMMEDIATE &&
instr.operands[ 1 ].imm.value.u == 0x8;
},
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_MOV && instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_MEMORY &&
instr.operands[ 0 ].mem.base == ZYDIS_REGISTER_RBP &&
instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[ 1 ].reg.value == ZYDIS_REGISTER_RAX;
} } },
@ LCONSTWSXQ
Definition: vmprofiles.hpp:36

◆ lregdw

vm::handler::profile_t vm::handler::profile::lregdw

◆ lregq

vm::handler::profile_t vm::handler::profile::lregq

◆ lrflags

vm::handler::profile_t vm::handler::profile::lrflags
Initial value:
= {
"LRFLAGS",
NULL,
{ {
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_PUSH && instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_MEMORY &&
instr.operands[ 0 ].mem.base == ZYDIS_REGISTER_RBP;
},
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_ADD &&
instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[ 0 ].reg.value == ZYDIS_REGISTER_RBP &&
instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_IMMEDIATE &&
instr.operands[ 1 ].imm.value.u == 0x8;
},
[]( const zydis_decoded_instr_t &instr ) -> bool { return instr.mnemonic == ZYDIS_MNEMONIC_POPFQ; } } } }
@ LRFLAGS
Definition: vmprofiles.hpp:15

◆ lvsp

vm::handler::profile_t vm::handler::profile::lvsp
Initial value:
= {
"LVSP",
NULL,
{ { []( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_MOV && instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[ 0 ].reg.value == ZYDIS_REGISTER_RBP &&
instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_MEMORY &&
instr.operands[ 1 ].mem.base == ZYDIS_REGISTER_RBP;
} } } }
@ LVSP
Definition: vmprofiles.hpp:22

◆ mulq

vm::handler::profile_t vm::handler::profile::mulq

◆ nandb

vm::handler::profile_t vm::handler::profile::nandb

◆ nanddw

vm::handler::profile_t vm::handler::profile::nanddw

◆ nandq

vm::handler::profile_t vm::handler::profile::nandq

◆ nandw

vm::handler::profile_t vm::handler::profile::nandw

◆ pushvsp

vm::handler::profile_t vm::handler::profile::pushvsp
Initial value:
= {
"PUSHVSP",
NULL,
{ {
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_MOV &&
instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[ 0 ].reg.value == ZYDIS_REGISTER_RAX &&
instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[ 1 ].reg.value == ZYDIS_REGISTER_RBP;
},
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_SUB &&
instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[ 0 ].reg.value == ZYDIS_REGISTER_RBP &&
instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_IMMEDIATE &&
instr.operands[ 1 ].imm.value.u == 0x8;
},
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_MOV && instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_MEMORY &&
instr.operands[ 0 ].mem.base == ZYDIS_REGISTER_RBP &&
instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[ 1 ].reg.value == ZYDIS_REGISTER_RAX;
} } } }
@ PUSHVSP
Definition: vmprofiles.hpp:16

◆ readdw

vm::handler::profile_t vm::handler::profile::readdw
Initial value:
= {
"READDW",
NULL,
{ {
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_ADD &&
instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[ 0 ].reg.value == ZYDIS_REGISTER_RBP &&
instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_IMMEDIATE &&
instr.operands[ 1 ].imm.value.u == 0x4;
},
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_MOV &&
instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[ 0 ].reg.value == ZYDIS_REGISTER_EAX &&
instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_MEMORY &&
instr.operands[ 1 ].mem.base == ZYDIS_REGISTER_RAX;
},
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_MOV && instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_MEMORY &&
instr.operands[ 0 ].mem.base == ZYDIS_REGISTER_RBP &&
instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[ 1 ].reg.value == ZYDIS_REGISTER_EAX;
} } } }
@ READDW
Definition: vmprofiles.hpp:42

◆ readq

vm::handler::profile_t vm::handler::profile::readq
Initial value:
= {
"READQ",
NULL,
{ {
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_MOV &&
instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[ 0 ].reg.value == ZYDIS_REGISTER_RAX &&
instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_MEMORY &&
instr.operands[ 1 ].mem.base == ZYDIS_REGISTER_RAX;
},
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_MOV && instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_MEMORY &&
instr.operands[ 0 ].mem.base == ZYDIS_REGISTER_RBP &&
instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[ 1 ].reg.value == ZYDIS_REGISTER_RAX;
} } } }
@ READQ
Definition: vmprofiles.hpp:41

◆ shlddw

vm::handler::profile_t vm::handler::profile::shlddw

◆ shldw

vm::handler::profile_t vm::handler::profile::shldw

◆ shlq

vm::handler::profile_t vm::handler::profile::shlq

◆ shrq

vm::handler::profile_t vm::handler::profile::shrq

◆ shrw

vm::handler::profile_t vm::handler::profile::shrw

◆ sregdw

vm::handler::profile_t vm::handler::profile::sregdw

◆ sregq

vm::handler::profile_t vm::handler::profile::sregq

◆ sregw

vm::handler::profile_t vm::handler::profile::sregw

◆ vmexit

vm::handler::profile_t vm::handler::profile::vmexit
Initial value:
= {
"VMEXIT",
NULL,
{ {
[]( const zydis_decoded_instr_t &instr ) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_MOV &&
instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[ 0 ].reg.value == ZYDIS_REGISTER_RSP &&
instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[ 1 ].reg.value == ZYDIS_REGISTER_RBP;
},
[]( const zydis_decoded_instr_t &instr ) -> bool { return instr.mnemonic == ZYDIS_MNEMONIC_RET; } } } }
@ VMEXIT
Definition: vmprofiles.hpp:21

◆ writeb

vm::handler::profile_t vm::handler::profile::writeb

◆ writedw

vm::handler::profile_t vm::handler::profile::writedw

◆ writeq

vm::handler::profile_t vm::handler::profile::writeq

◆ writew

vm::handler::profile_t vm::handler::profile::writew