菜单
VMProtect, VMP2, Themida, and CodeVirtualizer reversing workflow using Radare2/Ghidra facts and Back Engineering Labs research guidance.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | reverser-virtualized-protectors |
| description | VMProtect, VMP2, Themida, and CodeVirtualizer reversing workflow using Radare2/Ghidra facts and Back Engineering Labs research guidance. |
| metadata | {"subdomain":"reverse-engineering","when_to_use":"VMProtect VMP2 VMProtect2 Themida CodeVirtualizer virtualized protector devirtualization VMEnter VMEXIT VIP handler table","upstream_ref":"Back Engineering Labs vmp2, vmhook, and Static Devirtualization of Themida research"} |
Use this for VMProtect 2, VMP2 tooling questions, Themida, CodeVirtualizer, and other VM-based protectors. Do not promise automatic devirtualization. Most wins come from disciplined recovery of VM control-flow facts.
Back Engineering Labs' public VMP2/Themida work points to one durable rule: Avoid brittle VM-handler pattern matching. Handler layouts, opcode tables, and dispatch glue change too easily. Prefer incremental lifting and control-flow recovery with as little VM-specific logic as possible.
bin_identify and bin_packer first; record format, arch, entropy, and
protector strings.bin_r2_script or Ghidra to locate VMEnter stubs, handler-table
references, VM context/virtual stack sections, and suspicious indirect
dispatch loops.vmemu/vmprofiler/vmprofiler-cli
outputs as evidence, not ground truth. Re-check recovered paths in r2/Ghidra.Root pointer for the binary reversing lane. Covers triage, Radare2 fallback, string extraction, packer unpacking, virtualized protectors, symbol risk, ROP, Ghidra deep analysis, and firmware extraction.
Use to close the Offensive Vaccine loop on the defender side. The Detector agent produces Sigma / YARA rules from offensive operations; this catalog validates those rules against real memory dumps, event logs, and forensic artifacts using Volatility 3, plaso, and sigma-cli. Without this catalog, detection rules are theoretical.
Use when the target is an industrial control system or operational technology network running Modbus, BACnet, S7Comm/S7Comm Plus, DNP3, OPC-UA, or any PLC/HMI/SCADA stack. Engagements MUST set RoE flag industrial_safety_critical=true; this catalog gates every write-scope operation behind explicit operator confirmation regardless of HITL middleware.
Use when the engagement target is an Android (APK / AAB) or iOS (IPA) application. Covers static analysis (jadx, apktool, class-dump), dynamic instrumentation via Frida and Objection, SSL-pinning bypass, root/jailbreak detection bypass, deep-link / URL-scheme abuse, exported-component attacks, IPC redirection, WebView vulnerabilities, and biometric / Face ID / Touch ID bypass.
Use when the engagement requires passive reconnaissance only — no packets to the target's authoritative infrastructure. Splits off from the Recon agent so bug-bounty and pre-engagement work can run with outbound-only network policy. Maltego, Shodan, Censys, Hunter.io, breach-data lookups, GitHub code search, Wayback Machine archives, certificate transparency, BGP/ASN mapping.
Use when the engagement scope includes supply-chain attack simulation — typosquatted package publication, dependency confusion, GitHub Actions secret mining, internal mirror poisoning, OAuth-app impersonation, or vendor portal credential abuse.