kungia09/vmp3-import-fix

Fix VMProtect3 IAT

VMProtect 3.x IAT Fix and Rebuild Import Table

This Program is a dynamic x86/x64 VMProtect 3. x import fixer（Tested on VMP3.3）. The main goal of this project was to build a correct and reliable tool to fix imports in x86/x64 applications.

Note: This tool can dump and rebuild import directory.

​ Fix the 32bit program please use the 32bit version, and vice versa.

Before

After

new IAT:

Compile

VS2019

Usage

**-Usage

-p: target process PID

-s:This tool first search call IAT address in sections,-s option specify ignore sections default [.vmp0,.vmp1,.vmp2]

-i: specify the section that is used to store IAT in memory, if you don't specify this option, this tool default will use VirtualAlloc to allocate memory that is used to store IAT content

-d: dump file and rebuild import table

Tips: VMProtect unpacking must be complete before running this tool,

Example:

when The target program reaches OEP

execute this tool

.\vmp3-import-fix.exe -p 31652

if you want to dump and rebuild import table

.\vmp3-import-fix.exe -p 31652 -d

if you want to dump, rebuild import table , and fix the new IAT in .vmp0 section

.\vmp3-import-fix.exe -p 31652 -d -i ".vmp0"

below is the result that has dumped and fixed import table for ida.vmp.exe

new IAT section in the last section

you can see the log file in log/logger.txt

VMProtect Encrypt IAT detail

VMProtect encrypts IAT through 3 modes

1. call ret or call int3 or call 0xXX
2. push call
3. pop call

Call Ret mode

original code:

.text:0040D87E 50                              push   eax       *; hFile*

.text:0040D87F FF 15 1C C1 45 00               call   ds:FlushFileBuffers

.text:0040D885 85 C0                            test   eax, eax

encdrypt IAT

0040D87E | 50                         | push eax                                                   |
0040D87F | E8 47890B00                | call test1_vmp.4C61CB                                      |
0040D884 | C3                         | ret                                                        |
0040D885 | 85C0                       | test eax,eax                                               |

at address 0x0040D87F,code call ds:FlushFileBuffers has changed to call test1_vmp.4C61CB ;ret

we follow encrypt IAT code,below codes analyze the process that VMProtect decrypts API Address

004C61CC | 55                         | push ebp                                                   |保存ebp
004C61CD | 0FCD                       | bswap ebp                                                  |
004C61CF | 66:8BE9                    | mov bp,cx                                                  |
004C61D2 | 66:BD F53D                 | mov bp,3DF5                                                |
004C61D6 | 8B6C24 04                  | mov ebp,dword ptr ss:[esp+4]                               |ebp=call返回地址
0048718D | 8D6D 01                    | lea ebp,dword ptr ss:[ebp+1]                               |ebp=call返回地址+1
0056A3E4 | 896C24 04                  | mov dword ptr ss:[esp+4],ebp                               |[esp+4]=call返回地址+1
0056A3E8 | 66:0F47EB                  | cmova bp,bx                                                |
0056A3EC | 0FBFED                     | movsx ebp,bp                                               |
0056A3EF | BD E6224000                | mov ebp,test1_vmp.4022E6                                   |
004B2DCA | 8BAD 432F0800              | mov ebp,dword ptr ss:[ebp+82F43]                           |
004BF11F | 8DAD C713DE73              | lea ebp,dword ptr ss:[ebp+73DE13C7]                        |
004F561B | 872C24                     | xchg dword ptr ss:[esp],ebp                                |恢复ebp，esp[0]=api地址
                                        ret                                                         |ret返回到Api

Push Call mode

original code

.text:004099DF 56                                                           push    esi
.text:004099E0 8B 35 0C C0 45 00                                            mov     esi,ds:InitializeCriticalSection
.text:004099E6 FF 35 A4 41 41 00                                            push    lpCriticalSection ; lpCriticalSection

encrypt IAT call

004099DF | 56                         | push esi                                                   |
004099E0 | 53                         | push ebx                                                   |
004099E1 | E8 299B1600                | call test1_vmp.57350F                                      |
004099E6 | FF35 A4414100              | push dword ptr ds:[4141A4]                                 | 004141A4:"@kA"

code mov esi,ds:InitializeCriticalSection has changed to push ebx call test1_vmp.57350F

Thanks

unicorn

BlackBone

vmpfix

Scylla

zydis

spdlog

vmp3-import-fix's Issues

Unable to restore import table

• command

vmp3-import-fix-x64.exe -p 7196 -s .???0 -s .???1  -d

• sections
  

• log

[2022-08-20 11:29:38.240] [logger] [info] Debug logger setup done. 

[2022-08-20 11:29:38.632] [logger] [info] Target process id:7196
[2022-08-20 11:29:38.632] [logger] [info] ignore section name:.???0
[2022-08-20 11:29:38.632] [logger] [info] ignore section name:.???1
[2022-08-20 11:29:38.682] [logger] [info] using VirtualAlloc storage new IAT  
[2022-08-20 11:29:38.682] [logger] [info] [+]search pattern address in section .text
[2022-08-20 11:29:38.958] [logger] [info] [+]uc mem map memory range:0x140000000-0x148f74000

[2022-08-20 11:29:38.986] [logger] [info] [+]uc stack memory range:0x0-0x100000

[2022-08-20 11:29:39.010] [logger] [error] >>> Missing memory is being read at 651173444, data size = 1  
[2022-08-20 11:29:39.010] [logger] [error] [-]patternAddreess:0x14004f348,Failed on uc_emu_start() with error returned 10: Invalid instruction (UC_ERR_INSN_INVALID)

[2022-08-20 11:29:39.011] [logger] [error] >>> Missing memory is being read at 5554588000, data size = 4  
[2022-08-20 11:29:39.011] [logger] [error] [-]patternAddreess:0x140818d03,Failed on uc_emu_start() with error returned 6: Invalid memory read (UC_ERR_READ_UNMAPPED)

[2022-08-20 11:29:39.011] [logger] [error] [-]patternAddreess:0x140a323fb,Failed on uc_emu_start() with error returned 10: Invalid instruction (UC_ERR_INSN_INVALID)

[2022-08-20 11:29:39.012] [logger] [error] [-]patternAddreess:0x140ccd85a,Failed on uc_emu_start() with error returned 10: Invalid instruction (UC_ERR_INSN_INVALID)

[2022-08-20 11:29:39.012] [logger] [error] >>> Missing memory is being read at 11529215046089474140, data size = 1  
[2022-08-20 11:29:39.013] [logger] [error] [-]patternAddreess:0x140e27978,Failed on uc_emu_start() with error returned 6: Invalid memory read (UC_ERR_READ_UNMAPPED)

[2022-08-20 11:29:39.013] [logger] [error] [-]patternAddreess:0x140e4aa68,Failed on uc_emu_start() with error returned 10: Invalid instruction (UC_ERR_INSN_INVALID)

[2022-08-20 11:29:39.013] [logger] [error] >>> Missing memory is being read at 18446744073709551615, data size = 4  
[2022-08-20 11:29:39.014] [logger] [error] >>> Missing memory is being read at 18446744073709551612, data size = 3  
[2022-08-20 11:29:39.014] [logger] [error] Failed to write emulation code to memory, quit!,11:Invalid memory mapping (UC_ERR_MAP)

[2022-08-20 11:29:39.014] [logger] [error] [-]patternAddreess:0x140e4dbc8,Failed on uc_emu_start() with error returned 6: Invalid memory read (UC_ERR_READ_UNMAPPED)

[2022-08-20 11:29:39.014] [logger] [error] >>> Missing memory is being read at 6917529027662195074, data size = 1  
[2022-08-20 11:29:39.014] [logger] [error] Failed to write emulation code to memory, quit!,11:Invalid memory mapping (UC_ERR_MAP)

[2022-08-20 11:29:39.014] [logger] [error] [-]patternAddreess:0x140e4f6f0,Failed on uc_emu_start() with error returned 6: Invalid memory read (UC_ERR_READ_UNMAPPED)

[2022-08-20 11:29:39.015] [logger] [error] [-]patternAddreess:0x140ea5268,Failed on uc_emu_start() with error returned 7: Invalid memory write (UC_ERR_WRITE_UNMAPPED)

[2022-08-20 11:29:39.015] [logger] [error] >>> Missing memory is being read at 872742914, data size = 1  
[2022-08-20 11:29:39.016] [logger] [error] >>> Missing memory is being read at 18446744071763435281, data size = 1  
[2022-08-20 11:29:39.016] [logger] [error] [-]patternAddreess:0x141888487,Failed on uc_emu_start() with error returned 6: Invalid memory read (UC_ERR_READ_UNMAPPED)

[2022-08-20 11:29:39.017] [logger] [error] [-]patternAddreess:0x142042443,Failed on uc_emu_start() with error returned 7: Invalid memory write (UC_ERR_WRITE_UNMAPPED)

[2022-08-20 11:29:39.017] [logger] [error] [-]patternAddreess:0x142401ed3,Failed on uc_emu_start() with error returned 10: Invalid instruction (UC_ERR_INSN_INVALID)

[2022-08-20 11:29:39.017] [logger] [error] [-]patternAddreess:0x142b55f0e,Failed on uc_emu_start() with error returned 7: Invalid memory write (UC_ERR_WRITE_UNMAPPED)

[2022-08-20 11:29:39.018] [logger] [error] [-]patternAddreess:0x142fdc033,Failed on uc_emu_start() with error returned 10: Invalid instruction (UC_ERR_INSN_INVALID)

[2022-08-20 11:29:39.018] [logger] [error] >>> Missing memory is being read at 18446744072814963417, data size = 4  
[2022-08-20 11:29:39.019] [logger] [error] >>> Missing memory is being read at 18446744072814963416, data size = 1  
[2022-08-20 11:29:39.019] [logger] [error] Failed to write emulation code to memory, quit!,11:Invalid memory mapping (UC_ERR_MAP)

[2022-08-20 11:29:39.019] [logger] [error] >>> Missing memory is being read at 18446744072814963420, data size = 1  
[2022-08-20 11:29:39.019] [logger] [error] Failed to write emulation code to memory, quit!,11:Invalid memory mapping (UC_ERR_MAP)

[2022-08-20 11:29:39.019] [logger] [error] [-]patternAddreess:0x143001485,Failed on uc_emu_start() with error returned 6: Invalid memory read (UC_ERR_READ_UNMAPPED)

[2022-08-20 11:29:39.019] [logger] [error] [-]patternAddreess:0x14310823c,Failed on uc_emu_start() with error returned 10: Invalid instruction (UC_ERR_INSN_INVALID)

[2022-08-20 11:29:39.019] [logger] [error] >>> Missing memory is being read at 11529215046089526548, data size = 1  
[2022-08-20 11:29:39.019] [logger] [error] Failed to write emulation code to memory, quit!,11:Invalid memory mapping (UC_ERR_MAP)

[2022-08-20 11:29:39.019] [logger] [error] [-]patternAddreess:0x14317ed0b,Failed on uc_emu_start() with error returned 6: Invalid memory read (UC_ERR_READ_UNMAPPED)

[2022-08-20 11:29:39.019] [logger] [error] >>> Missing memory is being read at 4359354731, data size = 2  
[2022-08-20 11:29:39.020] [logger] [error] >>> Missing memory is being read at 4359354730, data size = 1  
[2022-08-20 11:29:39.020] [logger] [error] Failed to write emulation code to memory, quit!,11:Invalid memory mapping (UC_ERR_MAP)

[2022-08-20 11:29:39.020] [logger] [error] >>> Missing memory is being read at 4359354732, data size = 1  
[2022-08-20 11:29:39.020] [logger] [error] Failed to write emulation code to memory, quit!,11:Invalid memory mapping (UC_ERR_MAP)

[2022-08-20 11:29:39.020] [logger] [error] [-]patternAddreess:0x14320438e,Failed on uc_emu_start() with error returned 6: Invalid memory read (UC_ERR_READ_UNMAPPED)

[2022-08-20 11:29:39.020] [logger] [error] >>> Missing memory is being read at 5525361048, data size = 4  
[2022-08-20 11:29:39.021] [logger] [error] [-]patternAddreess:0x1432ccc9c,Failed on uc_emu_start() with error returned 6: Invalid memory read (UC_ERR_READ_UNMAPPED)

[2022-08-20 11:29:39.021] [logger] [error] >>> Missing memory is being read at 18446744072067649461, data size = 2  
[2022-08-20 11:29:39.022] [logger] [error] >>> Missing memory is being read at 18446744072067649460, data size = 1  
[2022-08-20 11:29:39.022] [logger] [error] Failed to write emulation code to memory, quit!,11:Invalid memory mapping (UC_ERR_MAP)

[2022-08-20 11:29:39.022] [logger] [error] >>> Missing memory is being read at 18446744072067649462, data size = 1  
[2022-08-20 11:29:39.022] [logger] [error] Failed to write emulation code to memory, quit!,11:Invalid memory mapping (UC_ERR_MAP)

[2022-08-20 11:29:39.022] [logger] [error] >>> Missing memory is being read at 18446744072067649465, data size = 2  
[2022-08-20 11:29:39.022] [logger] [error] Failed to write emulation code to memory, quit!,11:Invalid memory mapping (UC_ERR_MAP)

[2022-08-20 11:29:39.022] [logger] [error] >>> Missing memory is being read at 18446744072067649469, data size = 2  
[2022-08-20 11:29:39.022] [logger] [error] Failed to write emulation code to memory, quit!,11:Invalid memory mapping (UC_ERR_MAP)

[2022-08-20 11:29:39.022] [logger] [error] >>> Missing memory is being read at 18446744072067649489, data size = 8  
[2022-08-20 11:29:39.022] [logger] [error] Failed to write emulation code to memory, quit!,11:Invalid memory mapping (UC_ERR_MAP)

[2022-08-20 11:29:39.022] [logger] [error] >>> Missing memory is being read at 18446744072067649497, data size = 2  
[2022-08-20 11:29:39.022] [logger] [error] Failed to write emulation code to memory, quit!,11:Invalid memory mapping (UC_ERR_MAP)

[2022-08-20 11:29:39.022] [logger] [error] >>> Missing memory is being read at 18446744072067649499, data size = 8  
[2022-08-20 11:29:39.022] [logger] [error] Failed to write emulation code to memory, quit!,11:Invalid memory mapping (UC_ERR_MAP)

[2022-08-20 11:29:39.022] [logger] [error] >>> Missing memory is being read at 18446744072067649507, data size = 2  
[2022-08-20 11:29:39.022] [logger] [error] Failed to write emulation code to memory, quit!,11:Invalid memory mapping (UC_ERR_MAP)

[2022-08-20 11:29:39.022] [logger] [error] >>> Missing memory is being read at 18446744072067649509, data size = 8  
[2022-08-20 11:29:39.022] [logger] [error] Failed to write emulation code to memory, quit!,11:Invalid memory mapping (UC_ERR_MAP)

[2022-08-20 11:29:39.022] [logger] [error] >>> Missing memory is being read at 18446744072067649517, data size = 2  
[2022-08-20 11:29:39.022] [logger] [error] Failed to write emulation code to memory, quit!,11:Invalid memory mapping (UC_ERR_MAP)

[2022-08-20 11:29:39.022] [logger] [error] >>> Missing memory is being read at 18446744072067649519, data size = 8  
[2022-08-20 11:29:39.022] [logger] [error] Failed to write emulation code to memory, quit!,11:Invalid memory mapping (UC_ERR_MAP)

[2022-08-20 11:29:39.022] [logger] [error] >>> Missing memory is being read at 18446744072067649527, data size = 2  
[2022-08-20 11:29:39.022] [logger] [error] Failed to write emulation code to memory, quit!,11:Invalid memory mapping (UC_ERR_MAP)

[2022-08-20 11:29:39.022] [logger] [error] >>> Missing memory is being read at 18446744072067649529, data size = 8  
[2022-08-20 11:29:39.022] [logger] [error] Failed to write emulation code to memory, quit!,11:Invalid memory mapping (UC_ERR_MAP)

[2022-08-20 11:29:39.022] [logger] [error] >>> Missing memory is being read at 18446744072067649537, data size = 2  
[2022-08-20 11:29:39.022] [logger] [error] Failed to write emulation code to memory, quit!,11:Invalid memory mapping (UC_ERR_MAP)

[2022-08-20 11:29:39.022] [logger] [error] >>> Missing memory is being read at 18446744072067649539, data size = 8  
[2022-08-20 11:29:39.022] [logger] [error] Failed to write emulation code to memory, quit!,11:Invalid memory mapping (UC_ERR_MAP)

[2022-08-20 11:29:39.022] [logger] [error] >>> Missing memory is being read at 18446744072067649547, data size = 2  
[2022-08-20 11:29:39.022] [logger] [error] Failed to write emulation code to memory, quit!,11:Invalid memory mapping (UC_ERR_MAP)

[2022-08-20 11:29:39.022] [logger] [error] >>> Missing memory is being read at 18446744072067649549, data size = 8  
[2022-08-20 11:29:39.022] [logger] [error] Failed to write emulation code to memory, quit!,11:Invalid memory mapping (UC_ERR_MAP)

[2022-08-20 11:29:39.022] [logger] [error] >>> Missing memory is being read at 18446744072067649557, data size = 2  
[2022-08-20 11:29:39.022] [logger] [error] Failed to write emulation code to memory, quit!,11:Invalid memory mapping (UC_ERR_MAP)

[2022-08-20 11:29:39.022] [logger] [error] >>> Missing memory is being read at 18446744072067649559, data size = 8  
[2022-08-20 11:29:39.022] [logger] [error] Failed to write emulation code to memory, quit!,11:Invalid memory mapping (UC_ERR_MAP)

[2022-08-20 11:29:39.022] [logger] [error] >>> Missing memory is being read at 18446744072067649567, data size = 2  
[2022-08-20 11:29:39.022] [logger] [error] Failed to write emulation code to memory, quit!,11:Invalid memory mapping (UC_ERR_MAP)

[2022-08-20 11:29:39.022] [logger] [error] [-]patternAddreess:0x1435fcc40,Failed on uc_emu_start() with error returned 6: Invalid memory read (UC_ERR_READ_UNMAPPED)

[2022-08-20 11:29:39.022] [logger] [error] [-]patternAddreess:0x14368635a,Failed on uc_emu_start() with error returned 10: Invalid instruction (UC_ERR_INSN_INVALID)

[2022-08-20 11:29:39.022] [logger] [error] >>> Missing memory is being read at 6036033053, data size = 1  
[2022-08-20 11:29:39.023] [logger] [error] [-]patternAddreess:0x143b5c63a,Failed on uc_emu_start() with error returned 6: Invalid memory read (UC_ERR_READ_UNMAPPED)

[2022-08-20 11:29:39.025] [logger] [error] [-]patternAddreess:0x143c19bec,Failed on uc_emu_start() with error returned 10: Invalid instruction (UC_ERR_INSN_INVALID)

[2022-08-20 11:29:39.025] [logger] [error] [-]patternAddreess:0x143ed3294,Failed on uc_emu_start() with error returned 10: Invalid instruction (UC_ERR_INSN_INVALID)

[2022-08-20 11:29:39.025] [logger] [error] [-]patternAddreess:0x1444fa1a0,Failed on uc_emu_start() with error returned 21: Unhandled CPU exception (UC_ERR_EXCEPTION)

[2022-08-20 11:29:39.026] [logger] [error] [-]patternAddreess:0x144675742,Failed on uc_emu_start() with error returned 10: Invalid instruction (UC_ERR_INSN_INVALID)

[2022-08-20 11:29:39.026] [logger] [error] >>> Missing memory is being read at 18446744073709551567, data size = 4  
[2022-08-20 11:29:39.026] [logger] [error] Failed to write emulation code to memory, quit!,11:Invalid memory mapping (UC_ERR_MAP)

[2022-08-20 11:29:39.026] [logger] [error] [-]patternAddreess:0x1447e282c,Failed on uc_emu_start() with error returned 6: Invalid memory read (UC_ERR_READ_UNMAPPED)

[2022-08-20 11:29:39.026] [logger] [error] [-]patternAddreess:0x1449bf8d7,Failed on uc_emu_start() with error returned 10: Invalid instruction (UC_ERR_INSN_INVALID)

[2022-08-20 11:29:39.029] [logger] [error] [-]patternAddreess:0x144aa1c4f,Failed on uc_emu_start() with error returned 7: Invalid memory write (UC_ERR_WRITE_UNMAPPED)

[2022-08-20 11:29:39.029] [logger] [info] complex pattern address not found
[2022-08-20 11:29:39.029] [logger] [info] [+]fix import dll num:0
[2022-08-20 11:29:39.029] [logger] [info] start dump and build import section
[2022-08-20 11:29:39.080] [logger] [info] section num 9
[2022-08-20 11:29:39.080] [logger] [info] name:.text,section name , virtual address :0x1000,virtual size :0x4c5b558
[2022-08-20 11:29:39.080] [logger] [info] name:.rdata,section name , virtual address :0x4c5d000,virtual size :0x150eb94
[2022-08-20 11:29:39.080] [logger] [info] name:.data,section name , virtual address :0x616c000,virtual size :0x8d4c78
[2022-08-20 11:29:39.080] [logger] [info] name:.pdata,section name , virtual address :0x6a41000,virtual size :0x415a94
[2022-08-20 11:29:39.080] [logger] [info] name:.msvcjmc�,section name , virtual address :0x6e57000,virtual size :0x8
[2022-08-20 11:29:39.080] [logger] [info] name:_RDATA,section name , virtual address :0x6e58000,virtual size :0xa730
[2022-08-20 11:29:39.080] [logger] [info] name:.???0,section name , virtual address :0x6e63000,virtual size :0xfa36a
[2022-08-20 11:29:39.080] [logger] [info] name:.???1,section name , virtual address :0x6f5e000,virtual size :0x1ff9644
[2022-08-20 11:29:39.080] [logger] [info] name:.rsrc,section name , virtual address :0x8f58000,virtual size :0x1a9b8
[2022-08-20 11:29:40.076] [logger] [info] Write fix dump file sucess:d:\zxsj\game\zhuxianclient\binaries\win64\zhuxianclient-win64-shipping_fix_dump.exe
[2022-08-20 11:29:40.080] [logger] [info] Fix IAT Finished

It is recommended to add the option to specify the module name, and sometimes dump dll is required

如何用这个修复DLL的IAT

如何用这个修复DLL的IAT

How to solve this warning

in WIN64, offset between call VirtualAlloc return Address and pattern address that is larger than 4GB,we can't patch IAT in memory,please set a section storage new IAT

Program not running after import fixing

Program will open for a split 2 seconds
then will close....

Failed to find module "" in process

D:\sharing>vmp3-import-fix-x64.exe -p 8216
Failed to find module "" in process

how to fix this error, thanks