这是indexloc提供的服务,不要输入任何密码
Skip to content

VMProtect'd PE leads to "TLS Directory size is not the expected size" #404

@25pwn

Description

@25pwn

I've tried rev.ng on quite a few vmprotect samples, and it errors out on almost all of them. Of a subset of 31 samples, only 4 could be lifted; the others could not be lifted with the same error. Example revng --analyze lift --progress-plain output:

Starting revng-artifact (2)
  Starting Run analyses lists (2)
    Starting Analysis list revng-initial-auto-analysis (4)
      Starting Analysis execution (3)
        Starting Produce steps required up to initial (1)
          Starting Run step (3)
            Clone and filter input containers
            Starting Step initial (1)
              Merging back
            Ending Step initial
            Run the step
            Extract the requested targets
          Ending Run step
          initial
        Ending Produce steps required up to initial
        Produce step initial
        Starting Import binary (2)
          Import main binary
        Ending Import binary
        Run analysis
      Ending Analysis execution
      import-binary
    Ending Analysis list revng-initial-auto-analysis
TLS Directory size (72) is not the expected size (40).

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions