VMProfiler  v1.8
vmprofiler is a c++ library which is used to statically analyze VMProtect 2 polymorphic virtual machines. This project is inherited in vmprofiler-qt, vmprofiler-cli, and vmemu.
Typedefs | Functions | Variables
vm::lifters Namespace Reference

Typedefs

using lifter_callback_t = std::function< void(vtil::basic_block *, vm::instrs::virt_instr_t *, vmp2::v3::code_block_t *) >
 
using lifter_t = std::pair< vm::handler::mnemonic_t, lifter_callback_t >
 

Functions

constexpr vtil::register_desc make_virtual_register (uint8_t context_offset, uint8_t size)
 

Variables

vm::lifters::lifter_t lregq
 
vm::lifters::lifter_t lregdw
 
vm::lifters::lifter_t addq
 
vm::lifters::lifter_t adddw
 
vm::lifters::lifter_t addw
 
vm::lifters::lifter_t sregq
 
vm::lifters::lifter_t sregdw
 
vm::lifters::lifter_t sregw
 
vm::lifters::lifter_t lconstq
 
vm::lifters::lifter_t lconstdw
 
vm::lifters::lifter_t lconstw
 
vm::lifters::lifter_t lconstbzxw
 
vm::lifters::lifter_t lconstbsxdw
 
vm::lifters::lifter_t lconstbsxq
 
vm::lifters::lifter_t lconstdwsxq
 
vm::lifters::lifter_t lconstwsxq
 
vm::lifters::lifter_t lconstwsxdw
 
vm::lifters::lifter_t nandq
 
vm::lifters::lifter_t nanddw
 
vm::lifters::lifter_t nandw
 
vm::lifters::lifter_t readq
 
vm::lifters::lifter_t readdw
 
vm::lifters::lifter_t readw
 
vm::lifters::lifter_t shrq
 
vm::lifters::lifter_t shrw
 
vm::lifters::lifter_t jmp
 
vm::lifters::lifter_t vmexit
 
vm::lifters::lifter_t pushvsp
 
vm::lifters::lifter_t lrflags
 
vm::lifters::lifter_t lvsp
 
std::vector< vm::lifters::lifter_t * > all
 

Typedef Documentation

◆ lifter_callback_t

using vm::lifters::lifter_callback_t = typedef std::function< void( vtil::basic_block *, vm::instrs::virt_instr_t *, vmp2::v3::code_block_t* ) >

◆ lifter_t

Function Documentation

◆ make_virtual_register()

constexpr vtil::register_desc vm::lifters::make_virtual_register ( uint8_t  context_offset,
uint8_t  size 
)
inlineconstexpr

Variable Documentation

◆ adddw

vm::lifters::lifter_t vm::lifters::adddw
Initial value:
= {
vm::handler::ADDDW, []( vtil::basic_block *blk, vm::instrs::virt_instr_t *vinstr, vmp2::v3::code_block_t* code_blk ) {
auto [ t0, t1 ] = blk->tmp( 32, 32 );
blk->pop( t0 );
blk->pop( t1 );
blk->add( t1, t0 );
blk->push( t1 );
blk->pushf();
} }
@ ADDDW
Definition: vmprofiles.hpp:51
Definition: vmp2.hpp:150
Definition: vmp2.hpp:217

◆ addq

vm::lifters::lifter_t vm::lifters::addq
Initial value:
= {
vm::handler::ADDQ, []( vtil::basic_block *blk, vm::instrs::virt_instr_t *vinstr, vmp2::v3::code_block_t* code_blk ) {
auto [ t0, t1 ] = blk->tmp( 64, 64 );
blk->pop( t0 );
blk->pop( t1 );
blk->add( t1, t0 );
blk->push( t1 );
blk->pushf();
} }
@ ADDQ
Definition: vmprofiles.hpp:50

◆ addw

vm::lifters::lifter_t vm::lifters::addw
Initial value:
= {
vm::handler::ADDW, []( vtil::basic_block *blk, vm::instrs::virt_instr_t *vinstr, vmp2::v3::code_block_t* code_blk ) {
auto [ t0, t1 ] = blk->tmp( 16, 16 );
blk->pop( t0 );
blk->pop( t1 );
blk->add( t1, t0 );
blk->push( t1 );
blk->pushf();
} }
@ ADDW
Definition: vmprofiles.hpp:52

◆ all

std::vector< vm::lifters::lifter_t * > vm::lifters::all
inline

◆ jmp

vm::lifters::lifter_t vm::lifters::jmp
Initial value:
= {
[]( vtil::basic_block *blk, vm::instrs::virt_instr_t *vinstr, vmp2::v3::code_block_t *code_blk ) {
if ( code_blk->jcc.has_jcc )
{
blk->js( vtil::REG_FLAGS.select( 1, 11 ), code_blk->jcc.block_addr[ 0 ] - vinstr->trace_data.regs.r13,
code_blk->jcc.block_addr[ 1 ] - vinstr->trace_data.regs.r13 );
}
else
blk->jmp( vinstr->trace_data.vsp.qword[ 0 ] - vinstr->trace_data.regs.r13 );
} }
@ JMP
Definition: vmprofiles.hpp:20

◆ lconstbsxdw

vm::lifters::lifter_t vm::lifters::lconstbsxdw
Initial value:
= {
[]( vtil::basic_block *blk, vm::instrs::virt_instr_t *vinstr, vmp2::v3::code_block_t *code_blk ) {
blk->push( vtil::operand( vinstr->operand.imm.u, 32 ) );
} }
@ LCONSTBSXDW
Definition: vmprofiles.hpp:34

◆ lconstbsxq

vm::lifters::lifter_t vm::lifters::lconstbsxq
Initial value:
= {
[]( vtil::basic_block *blk, vm::instrs::virt_instr_t *vinstr, vmp2::v3::code_block_t *code_blk ) {
blk->push( vtil::operand( vinstr->operand.imm.u, 64 ) );
} }
@ LCONSTBSXQ
Definition: vmprofiles.hpp:33

◆ lconstbzxw

vm::lifters::lifter_t vm::lifters::lconstbzxw
Initial value:
= {
[]( vtil::basic_block *blk, vm::instrs::virt_instr_t *vinstr, vmp2::v3::code_block_t *code_blk ) {
blk->push( vtil::operand( vinstr->operand.imm.u, 16 ) );
} }
@ LCONSTBZXW
Definition: vmprofiles.hpp:32

◆ lconstdw

vm::lifters::lifter_t vm::lifters::lconstdw
Initial value:
= {
[]( vtil::basic_block *blk, vm::instrs::virt_instr_t *vinstr, vmp2::v3::code_block_t *code_blk ) {
blk->push( vtil::operand( vinstr->operand.imm.u, 32 ) );
} }
@ LCONSTDW
Definition: vmprofiles.hpp:38

◆ lconstdwsxq

vm::lifters::lifter_t vm::lifters::lconstdwsxq
Initial value:
= {
[]( vtil::basic_block *blk, vm::instrs::virt_instr_t *vinstr, vmp2::v3::code_block_t *code_blk ) {
blk->push( vtil::operand( vinstr->operand.imm.u, 64 ) );
} }
@ LCONSTDWSXQ
Definition: vmprofiles.hpp:35

◆ lconstq

vm::lifters::lifter_t vm::lifters::lconstq
Initial value:
= {
[]( vtil::basic_block *blk, vm::instrs::virt_instr_t *vinstr, vmp2::v3::code_block_t *code_blk ) {
blk->push( vtil::operand( vinstr->operand.imm.u, 64 ) );
} }
@ LCONSTQ
Definition: vmprofiles.hpp:31

◆ lconstw

vm::lifters::lifter_t vm::lifters::lconstw
Initial value:
= {
[]( vtil::basic_block *blk, vm::instrs::virt_instr_t *vinstr, vmp2::v3::code_block_t *code_blk ) {
blk->push( vtil::operand( vinstr->operand.imm.u, 16 ) );
} }
@ LCONSTW
Definition: vmprofiles.hpp:39

◆ lconstwsxdw

vm::lifters::lifter_t vm::lifters::lconstwsxdw
Initial value:
= {
[]( vtil::basic_block *blk, vm::instrs::virt_instr_t *vinstr, vmp2::v3::code_block_t *code_blk ) {
blk->push( vtil::operand( vinstr->operand.imm.u, 32 ) );
} }
@ LCONSTWSXDW
Definition: vmprofiles.hpp:37

◆ lconstwsxq

vm::lifters::lifter_t vm::lifters::lconstwsxq
Initial value:
= {
[]( vtil::basic_block *blk, vm::instrs::virt_instr_t *vinstr, vmp2::v3::code_block_t *code_blk ) {
blk->push( vtil::operand( vinstr->operand.imm.u, 64 ) );
} }
@ LCONSTWSXQ
Definition: vmprofiles.hpp:36

◆ lregdw

vm::lifters::lifter_t vm::lifters::lregdw
Initial value:
= {
[]( vtil::basic_block *blk, vm::instrs::virt_instr_t *vinstr, vmp2::v3::code_block_t *code_blk ) {
blk->push( make_virtual_register( vinstr->operand.imm.u, 4 ) );
} }
@ LREGDW
Definition: vmprofiles.hpp:29
constexpr vtil::register_desc make_virtual_register(uint8_t context_offset, uint8_t size)
Definition: vmlifters.hpp:12

◆ lregq

vm::lifters::lifter_t vm::lifters::lregq
Initial value:
= {
[]( vtil::basic_block *blk, vm::instrs::virt_instr_t *vinstr, vmp2::v3::code_block_t *code_blk ) {
blk->push( make_virtual_register( vinstr->operand.imm.u, 8 ) );
} }
@ LREGQ
Definition: vmprofiles.hpp:28

◆ lrflags

vm::lifters::lifter_t vm::lifters::lrflags
Initial value:
= {
vm::handler::LRFLAGS, []( vtil::basic_block *blk, vm::instrs::virt_instr_t *vinstr,
vmp2::v3::code_block_t *code_blk ) { blk->push( vtil::REG_FLAGS ); } }
@ LRFLAGS
Definition: vmprofiles.hpp:15

◆ lvsp

vm::lifters::lifter_t vm::lifters::lvsp
Initial value:
= {
vm::handler::LVSP, []( vtil::basic_block *blk, vm::instrs::virt_instr_t *vinstr,
vmp2::v3::code_block_t *code_blk ) { blk->pop( vtil::REG_SP ); } }
@ LVSP
Definition: vmprofiles.hpp:22

◆ nanddw

vm::lifters::lifter_t vm::lifters::nanddw
Initial value:
= {
[]( vtil::basic_block *blk, vm::instrs::virt_instr_t *vinstr, vmp2::v3::code_block_t *code_blk ) {
auto [ t1, t2 ] = blk->tmp( 32, 32 );
blk->pop( t1 );
blk->pop( t2 );
blk->bnot( t1 );
blk->bnot( t2 );
blk->band( t1, t2 );
blk->push( t1 );
blk->pushf();
} }
@ NANDDW
Definition: vmprofiles.hpp:66

◆ nandq

vm::lifters::lifter_t vm::lifters::nandq
Initial value:
= {
[]( vtil::basic_block *blk, vm::instrs::virt_instr_t *vinstr, vmp2::v3::code_block_t *code_blk ) {
auto [ t1, t2 ] = blk->tmp( 64, 64 );
blk->pop( t1 );
blk->pop( t2 );
blk->bnot( t1 );
blk->bnot( t2 );
blk->band( t1, t2 );
blk->push( t1 );
blk->pushf();
} }
@ NANDQ
Definition: vmprofiles.hpp:65

◆ nandw

vm::lifters::lifter_t vm::lifters::nandw
Initial value:
= {
[]( vtil::basic_block *blk, vm::instrs::virt_instr_t *vinstr, vmp2::v3::code_block_t *code_blk ) {
auto [ t1, t2 ] = blk->tmp( 16, 16 );
blk->pop( t1 );
blk->pop( t2 );
blk->bnot( t1 );
blk->bnot( t2 );
blk->band( t1, t2 );
blk->push( t1 );
blk->pushf();
} }
@ NANDW
Definition: vmprofiles.hpp:67

◆ pushvsp

vm::lifters::lifter_t vm::lifters::pushvsp
Initial value:
= {
vm::handler::PUSHVSP, []( vtil::basic_block *blk, vm::instrs::virt_instr_t *vinstr,
vmp2::v3::code_block_t *code_blk ) { blk->push( vtil::REG_SP ); } }
@ PUSHVSP
Definition: vmprofiles.hpp:16

◆ readdw

vm::lifters::lifter_t vm::lifters::readdw
Initial value:
= {
[]( vtil::basic_block *blk, vm::instrs::virt_instr_t *vinstr, vmp2::v3::code_block_t *code_blk ) {
auto [ t0, t1 ] = blk->tmp( 64, 32 );
blk->pop( t0 );
blk->ldd( t1, t0, vtil::make_imm( 0ull ) );
blk->push( t1 );
} }
@ READDW
Definition: vmprofiles.hpp:42

◆ readq

vm::lifters::lifter_t vm::lifters::readq
Initial value:
= {
[]( vtil::basic_block *blk, vm::instrs::virt_instr_t *vinstr, vmp2::v3::code_block_t *code_blk ) {
auto [ t0, t1 ] = blk->tmp( 64, 64 );
blk->pop( t0 );
blk->ldd( t1, t0, vtil::make_imm( 0ull ) );
blk->push( t1 );
} }
@ READQ
Definition: vmprofiles.hpp:41

◆ readw

vm::lifters::lifter_t vm::lifters::readw
Initial value:
= {
[]( vtil::basic_block *blk, vm::instrs::virt_instr_t *vinstr, vmp2::v3::code_block_t *code_blk ) {
auto [ t0, t1 ] = blk->tmp( 64, 16 );
blk->pop( t0 );
blk->ldd( t1, t0, vtil::make_imm( 0ull ) );
blk->push( t1 );
} }
@ READW
Definition: vmprofiles.hpp:43

◆ shrq

vm::lifters::lifter_t vm::lifters::shrq
Initial value:
= {
[]( vtil::basic_block *blk, vm::instrs::virt_instr_t *vinstr, vmp2::v3::code_block_t *code_blk ) {
auto [ t0, t1 ] = blk->tmp( 64, 8 );
blk->pop( t0 );
blk->pop( t1 );
blk->bshr( t0, t1 );
blk->push( t0 );
blk->pushf();
} }
@ SHRQ
Definition: vmprofiles.hpp:62

◆ shrw

vm::lifters::lifter_t vm::lifters::shrw
Initial value:
= {
[]( vtil::basic_block *blk, vm::instrs::virt_instr_t *vinstr, vmp2::v3::code_block_t *code_blk ) {
auto [ t0, t1 ] = blk->tmp( 16, 8 );
blk->pop( t0 );
blk->pop( t1 );
blk->bshr( t0, t1 );
blk->push( t0 );
blk->pushf();
} }
@ SHRW
Definition: vmprofiles.hpp:63

◆ sregdw

vm::lifters::lifter_t vm::lifters::sregdw
Initial value:
= {
[]( vtil::basic_block *blk, vm::instrs::virt_instr_t *vinstr, vmp2::v3::code_block_t *code_blk ) {
blk->pop( make_virtual_register( vinstr->operand.imm.u, 4 ) );
} }
@ SREGDW
Definition: vmprofiles.hpp:25

◆ sregq

vm::lifters::lifter_t vm::lifters::sregq
Initial value:
= {
[]( vtil::basic_block *blk, vm::instrs::virt_instr_t *vinstr, vmp2::v3::code_block_t *code_blk ) {
blk->pop( make_virtual_register( vinstr->operand.imm.u, 8 ) );
} }
@ SREGQ
Definition: vmprofiles.hpp:24

◆ sregw

vm::lifters::lifter_t vm::lifters::sregw
Initial value:
= {
[]( vtil::basic_block *blk, vm::instrs::virt_instr_t *vinstr, vmp2::v3::code_block_t *code_blk ) {
blk->pop( make_virtual_register( vinstr->operand.imm.u, 2 ) );
} }
@ SREGW
Definition: vmprofiles.hpp:26

◆ vmexit

vm::lifters::lifter_t vm::lifters::vmexit
Initial value:
= {
[]( vtil::basic_block *blk, vm::instrs::virt_instr_t *vinstr, vmp2::v3::code_block_t *code_blk ) {
blk->vexit( vtil::make_imm( vinstr->trace_data.vsp.qword[ 0x13 ] - vinstr->trace_data.regs.r13 ) );
} }
@ VMEXIT
Definition: vmprofiles.hpp:21