Plugin for integration with VTIL (Virtual-machine Translation Intermediate Language)

[XVilka]

VTIL

VTIL Project, standing for Virtual-machine Translation Intermediate Language, is a set of tools designed around an optimizing compiler to be used for binary de-obfuscation and de-virtualization.

The main difference between VTIL and other optimizing compilers such as LLVM is that it has an extremely versatile IL that makes it trivial to lift from any architecture including stack machines. Since it is built for translation, VTIL does not abstract away the native ISA and keeps the concept of the stack, physical registers, and the non-SSA architecture of a general-purpose CPU as is. Native instructions can be emitted in the middle of the IL stream and the physical registers can be addressed from VTIL instructions freely.

VTIL also makes it trivial to emit code back into the native format at any virtual address requested without being constrained to a specific file format.

Radare2/Cutter

VTIL shown to be successful for deobfuscating VMProtect and similar code protectors. It might be beneficial to provide the integration with radare2

• https://github.com/vtil-project/VTIL-Core
• https://github.com/vtil-project/VTIL-NativeLifters
• https://github.com/vtil-project/VTIL-Python

There is existing plugin for Binary Ninja, might be useful to see it as an example: https://github.com/vtil-project/VTIL-BinaryNinja

Example

From the "Devirtualization Intro" article:

#include <vtil/vtil>

int main()
{
	// https://0xnobody.github.io/devirtualization-intro/

	constexpr auto block_vip = 0x1234;
	constexpr auto reg_size = 64;
	constexpr auto reg_offs = 0;

	// block_vip is just something to identify the block.
	// you can use the relative or absolute VIP of the block's first instruction.
	//
	auto block = vtil::basic_block::begin(block_vip);

	// the following instruction defines a register. In VTIL, we can define as many registers as we want.
	//
	// - vtil::register_virtual means that the register is virtual ie. it is only existent in the VM context
	// - we get the register id via reg_offs / 8, as in our example VM all registers are 8-byte aligned. This
	// won't always be the case.
	// - 64 specifies the register's size. For our example, the register is always 64 bits.
	// - next, we get the bit offst by getting the modulus of our register offset
	//
	vtil::register_desc reg(vtil::register_virtual, 64, reg_size, (reg_offs % 8) * 8);

	// quite self explanatory :^)
	// note that in VTIL, we can chain these calls for that super clean look!
	//
	block->push(reg);

	// And finally let's use dump our precious little routine:
	vtil::debug::dump(block->owner);
}

Articles

• https://secret.club/2020/07/06/bottleye.html