-----------------------------------------------
VMProtect 1.7 - 1.8 OEP & Unpack Helper 1.0.txt  <-- old one
-----------------------------------------------
VMProtect 1.7 - 2.0 OEP & Unpack Helper 1.2.txt  <-- update2
-----------------------------------------------
PE Header & File Information Script 1.0.txt      <-- file info helper
-----------------------------------------------

Hello,

so today I show you how to unpack the VMProtect Ultimate 2.01 MainExecutable.

I have update my script to VMProtect 2.0
I added a API Tracer to get still the needed iatpatch.txt file.
-------------------------

I show you hwo to use the updated script with a VMP 2.0 version.I also will show 
you how to rebuild the OEP bytes in this case.For this you can also use my other
new script called "PE Header & File Information Script 1.0",with this script you 
will get all needed infos about your target on one view in the Olly LOG window.I
also added a OEP start compiler appendix whith some exsamples where you can see 
how the OEP should look.
-------------------------

Now letīs start.
-------------------------

Dumped file + OEP Rebuild + Basic AntiDump are fixed now and the file is working
so far.Now lets have a look on the APIs.So you know alraedy there are 2 ways to
get the APIs from my other tutorial VMP 1.7 - 1.8 there you can see how to get the
APIs before the OEP {fast way} & afteror at the OEP via just tracing {slower way}.
So in this VMP 2.0 version we will use the tracing method which is still working 
also in this version.For this you can my new updated script to get all APIs.The script
creates again a Trace file which you have later to rename to iatpatch.txt and after 
we got this file you can A] use the iatpatch.txt file + Nooby.dll or just use the
iatpatch.txt file to create a IAT INLINE section.Now I show you how to do this with mys
script and your working dump file.
Note: So the tracing way can take a longer time on slower PCs so for this case I have
added some extra checks.The script will craete also a extra file with the last API Trace
address which can also read by my script so that you will always start on the last address
to save time.Now just follow.
-------------------------
Ok the API get / rebuild into a new IAT INLINE section are finished now.Now we will test
our dump file again in a other OS in this case I use again win2000.

How you can see our dump file VMProtect_Dump_A_2 with our IAT INLINE section is now also
working with other OS.The new needed DWORDs will calculated and moved to the right address
in our dump.For more detailed informations about this process you can watch my other movie
tutorials about Unpacking VMProtect 1.7 - 1.8


  LCF-AT 

-------------------------
VMProtect Unpack Hints.

- Find OEP / rebuild OEP if needed
- Dump file
- Do not close your Olly till you are sure that the dump is working!
- Test Dump / if dump not run...or....File Corrupted!.....<-- Message
-- * Reason
     - Check your OEP Rebuild
     - AntiDump / Check Stack & Register / Add AntiDump section or write a short InlinePatch
     - AccessViolation / Add needed section/s
     - Check PE / Restore the original PE in your unpacked file
     - CRCs / check Name,size etc...
     - VMProtect section DWORD / Byte check / If yes find it and fill with 0 <--- save

Test your unpacked file on a other OS
- Dump not run
-- * Reason
     - Target used normal system APIs / Check codesection & Added EXTRA section/s to find the APIs
     - Fix this APIs manually / Add the needed imports
     - Run your file in Olly / disable the AccessViolation and see where it breaks / Look stack
-------------------------