-
Notifications
You must be signed in to change notification settings - Fork 940
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add detection support for newer versions of VMProtect. #734
Conversation
Let's run TeamCity tests. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thank you for the added support of newer versions of VMProtect! Could you please take a look at the failing tests? The code looks good, but there is something that prevents two tests from passing.
Let's run TeamCity tests. |
Since version 2.04, every protected file has a public signature (detected with a YARA rule) and the checksum of first 64 DWORDS in the last executable section is always constant despite the bytes in that part being different.
10619fa
to
ec1cc47
Compare
Let's run TeamCity tests. |
That macOS fail is caused by #702 (not by the present PR). However, the Linux build is unfortunately still failing. I will try to debug it. There is either another bug, or the build did not run with the fix, or there is something else going on. |
The build has run for ec1cc47, which is currently the latest commit in this PR. So, the build has run with the fix. |
I am able to reproduce the issue when using this Dockerfile. However, I was not yet able to determine the exact cause as when I start debugging the issue, the problems seem to go away. I will investigate it further. I just wanted to let you know about the progress. |
…mber(). It read bytes from the given offset as a number of the given type.
…e of SecSeg::getBytesAtOffsetAsNumber(). This makes the code a bit more readable as we do not have to retrieve and operate with the bytes (we just use SecSeg::getBytesAtOffsetAsNumber() for that).
Let's run TeamCity tests. |
Alright, so, even after about 6 hours of debugging, I was unable to determine the real cause. Here is a couple of notes:
I do not know how to debug this further. I believe this to be a compiler bug. I would really like to know this for sure, but I do not have the time nor will to debug it further. Nevertheless, I was able to modify the code so it is more readable and the Linux TC build no longer fails. @tamaroth: If the current code is OK from your point of view, we can merge the PR as all the tests pass now. |
Thank you for your thorough investigation. If it crashed only on a specific version and only when placed directly in the checksum computing loop, perhaps there was a bug in optimisation? Hard to tell. Again, thank you for your code review and updated code, it will be useful in the future. The code looks good to me! 👍 |
Since version 2.04, every protected file has a public signature (detected with a YARA rule) and
the checksum of the first 64 DWORDS in the last executable section is always constant despite the
bytes in that part being different.
In addition, the tests were added here