Vm2Import

fix vmprotect import function used unicorn-engine.

it can repair functions such as call [module.function] or jmp [module.function] or reg(mov) [module.function] that are statically imported by the VM.

it is effective in vmp2 and vmp3.

Use

1. copy to x64dbg

x64dbg\release\x32\plugins\unicorn.dll

x64dbg\release\x32\plugins\Vm2Import.dp32

x64dbg\release\x64\plugins\unicorn.dll

x64dbg\release\x64\plugins\Vm2Import.dp64

2. select "VM_Start" call vmp0.xxxxxxxx, right click menu "Vm2Import"->"Fix Import Call Address"

3. repair.

original sample:

Thanks

• unicorn
• fmtlib