Topic created on: June 22, 2010 12:29 CDT by dzzie .

ran across the following signature the other day wondering if anyone recgonizes it. Looks like a packer that supports a virtual machine and has an SDK where you can embed markers in your code to protect specific sections instead of the whole binary.

EB 08 56 4D 5F 53 54 41  52 54                   d.VM_START

themida has a very similar macro for this use but it didnt seem to recgonize the above signature (if it was an old one)

the current themida VM_START macro is defined as

__emit__ (0xEB, 0x10, 0x57, 0x4C, 0x20, 0x20, 0x0C, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x57, 0x4C, 0x20, 0x20);

Other markers found were

OC_END
VM_START
DY_DYEND
R1_START
ST_STEND
RD_RDEND

VmProtect SDK uses calls to a vmp dll exports to mark the code sections to protect.