2 ms·

Thanks for sharing. I'm not a student of the RE art so just curious about what you just said -- by saying VM did you mean the whole SC8 is running some core cod

Thanks for sharing. I'm not a student of the RE art so just curious about what you just said -- by saying VM did you mean the whole SC8 is running some core code inside a VM (of course within the same executable)? I assume that the intermediate code is definitely not public so people like you have to RE all those stuffs too?

farmdve 3y ago
It's called an Obfuscation Virtual Machine running custom opcodes. These opcodes were decoded in a special way and a single x86 instruction like mov imm, reg would get translated in 20-30 instructions most of them junk, but they were not laid out contiguously, you would execute one junk instruction and then return to the dispatcher to get to the next one, if I remember correctly. This made the VM and tracing dog slow. Additionally it used a small 256 or 1024 byte scratch buffer for the virtual registers that held data. I've forgotten now how it was exactly. The entire VM used only jmp instructions which was how you would spot it.
- markus_zhang 3y ago
  Thanks. I got the idea. Looks like they really wanted to slow you guys down :D I wonder if modern AI could solve that for you. "Oh look, that huge block essentially just set some variable to 127".