Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

VM BinaryReader endianness different across samples. #4

Closed
puff opened this issue Dec 27, 2022 · 1 comment · Fixed by #9
Closed

VM BinaryReader endianness different across samples. #4

puff opened this issue Dec 27, 2022 · 1 comment · Fixed by #9
Labels
enhancement New feature or request

Comments

@puff
Copy link
Owner

puff commented Dec 27, 2022

Need to implement a way to parse the VMBinaryReader methods. This is because the endianness of the VM resource stream changes across samples, likely due to different Eazfuscator.NET versions being used.
The order of the OR operators doesn't matter, it's the index of the byte array for each OR operation that matters.

Also need this for the VMMemoryStream's special ReadInt32 for opcodes/operands.

Instead of parsing, the VMBinaryReader endianness could be implemented using emulation, possibly from the Echo library.

@puff puff added the enhancement New feature or request label Dec 27, 2022
@puff puff changed the title VM BinaryReader byte order different across samples. VM BinaryReader endianness different across samples. Jan 8, 2023
@puff
Copy link
Owner Author

puff commented Jan 26, 2023

Looking more likely to be different per Eazfuscator.NET version, rather than per sample.

@puff puff linked a pull request Apr 28, 2023 that will close this issue
@puff puff closed this as completed in #9 Apr 29, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant