加密软件VMProtect教程：使用脚本Core-PE文件

上篇文章《加密软件VMProtect教程：使用脚本Core （上）》向您介绍了脚本水印、许可证、文件、文件夹部分内容，接下来将继续向您介绍后半部分~

VMProtect是新一代软件保护实用程序。VMProtect支持德尔菲、Borland C Builder、Visual C/C++、Visual Basic（本机）、Virtual Pascal和XCode编译器。

同时，VMProtect有一个内置的反汇编程序，可以与Windows和Mac OS X可执行文件一起使用，并且还可以链接编译器创建的MAP文件，以快速选择要保护的代码片段。

为了轻松实现应用程序保护任务的自动化，VMProtect实现了内置脚本语言。VMProtect完全支持Windows系列的32/64位操作系统（从Windows 2000开始）和Mac OSX（从版本10.6开始）。重要的是，无论目标平台如何，VMProtect都支持所有范围的可执行文件，即Windows版本可以处理Mac OS X版本的文件，反之亦然。

VMProtect最新版下载（qun：766135708）https://www.evget.com/product/1859/download

PE文件

常量，以配合PE格式：

enum PEFormat {
// Directory Entries
IMAGE_DIRECTORY_ENTRY_EXPORT,
IMAGE_DIRECTORY_ENTRY_IMPORT,
IMAGE_DIRECTORY_ENTRY_RESOURCE,
IMAGE_DIRECTORY_ENTRY_EXCEPTION,
IMAGE_DIRECTORY_ENTRY_SECURITY,
IMAGE_DIRECTORY_ENTRY_BASERELOC,
IMAGE_DIRECTORY_ENTRY_DEBUG,
IMAGE_DIRECTORY_ENTRY_ARCHITECTURE,
IMAGE_DIRECTORY_ENTRY_TLS,
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG,
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT,
IMAGE_DIRECTORY_ENTRY_IAT,
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT,
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR,
// Section characteristics
IMAGE_SCN_CNT_CODE,
IMAGE_SCN_CNT_INITIALIZED_DATA,
IMAGE_SCN_CNT_UNINITIALIZED_DATA,
IMAGE_SCN_MEM_DISCARDABLE,
IMAGE_SCN_MEM_NOT_CACHED,
IMAGE_SCN_MEM_NOT_PAGED,
IMAGE_SCN_MEM_SHARED,
IMAGE_SCN_MEM_EXECUTE,
IMAGE_SCN_MEM_READ,
IMAGE_SCN_MEM_WRITE,
// Resource types
RT_CURSOR,
RT_BITMAP,
RT_ICON,
RT_MENU,
RT_DIALOG,
RT_STRING,
RT_FONTDIR,
RT_FONT,
RT_ACCELERATOR,
RT_RCDATA,
RT_MESSAGETABLE,
RT_GROUP_CURSOR,
RT_GROUP_ICON,
RT_VERSION,
RT_DLGINCLUDE,
RT_PLUGPLAY,
RT_VXD,
RT_ANICURSOR,
RT_ANIICON,
RT_HTML,
RT_MANIFEST,
RT_DLGINIT,
RT_TOOLBAR
};

一个处理PE文件的类：

class PEFile {
public:
string name(); // returns the filename
string format(); // returns the "PE" format name
uint64 size(); // returns the size of the file
int count(); // returns the number of architectures in the list
PEArchitecture item(int index); // returns an architecture with the given index
uint64 seek(uint64 offset); // sets a file position
uint64 tell(); // returns a file position
int write(string buffer); // records a buffer to the file
};

一个与PE架构一起工作的类：

class PEArchitecture {
public:
string name(); // returns the name of the architecture
PEFile file(); // returns the parent file
uint64 entryPoint(); // returns the starting address
uint64 imageBase(); // returns the base offset
OperandSize cpuAddressSize(); // returns bit count of the architecture
uint64 size(); // returns the size of the architecture
PESegments segments(); // returns the list of segments
PESections sections(); // returns the list of sections
PEDirectories directories(); // returns the list of directories
PEImports imports(); // returns the list of imported libraries
PEExports exports(); // returns the list of exported functions
PEResources resources(); // returns the list of resources
PEFixups fixups(); // returns the list of relocations (fixups);
MapFunctions mapFunctions(); // returns the list of functions available for protection
IntelFunctions functions(); // returns the list of protected functions
bool addressSeek(uint64 address); // sets a file position
uint64 seek(uint64 offset); // sets a file position
uint64 tell(); // returns a file position
int write(string buffer); // writes a buffer to a file
};

一个用于处理PE架构的片段列表的类：

class PESegments {
public:
PESegment item(int index); // returns a segment with the given index
int count(); // returns the number of segments in the list
PESegment itemByAddress(uint64 address); // returns the segment at the given address
};

一个与PE架构段合作的类：

class PESegment {
public:
uint64 address(); // returns the address of the segment
string name(); // returns the name of the segment
uint64 size(); // returns the size of the segment
int physicalOffset(); // returns the file position (offset) of the segment
int physicalSize(); // returns the file size of the segment
int flags(); // returns flags of the segment
bool excludedFromPacking(); // returns the "Excluded from packing" property
void setName(string name); // sets the name of the segment
};

一个用于处理PE架构部分列表的类：

class PESections {
public:
PESection item(int index); // returns a section with the given index
int count(); // returns the number of sections in the list
PESection itemByAddress(uint64 address); // returns a section at the given address
};

一个与PE架构部分合作的类：

class PESection {
public:
uint64 address(); // returns the address of the section
string name(); // returns the name of the section
uint64 size(); // returns the size of the section
int offset(); // returns the file positions of the section
PESegme
nt segment(); // returns the parent segment
};

一个处理PE架构目录的类：

class PEDirectories {
public:
PEDirectory item(int index); // returns a directory with the given index
int count(); // returns the number of directories in the list
PEDirectory itemByType(int type); // returns a directory of the given type
};

一个与PE架构目录协同工作的类：

class PEDirectory {
public:
uint64 address(); // returns the address of the directory
string name(); // returns the name of the directory
uint64 size(); // returns the size of the directory
int type(); // returns the type of the directory
void setAddress(uint64 address); // sets the address of the directory
void setSize(int size); // sets the size of the directory
void clear(); // clears the address and the size of the directory
};

一个用于处理PE架构的导入库列表的类：

class PEImports {
public:
PEImport item(int index); // returns a library with the given index
int count(); // returns the number of libraries in the list
PEImport itemByName(string name); // returns a library with the given name
};

一个与PE架构的导入库一起工作的类：

class PEImport {
public:
string name(); // returns the name of the library
PEImportFunction item(int index); // returns an imported function with the given index
int count(); // returns the number of imported functions
void setName(string name); // sets the name of the library
};

一个与PE架构的导入函数一起工作的类：

class PEImportFunction {
public:
uint64 address(); // returns a memory address where the imported function address is stored
string name(); // returns the name of the imported function
}

一个用于处理PE架构的导出函数列表的类：

class PEExports {
public:
string name(); // returns the name of the library
PEExport item(int index); // returns an exported function with the given index
int count(); // returns the number of exported functions in the list
void clear(); // clears the list
PEExport itemByAddress(uint64 address); // returns an exported function at the given address
PEExport itemByName(string name); // returns an exported function with the given name
};

一个与PE架构导出的函数相匹配的类：

class PEExport {
public:
uint64 address(); // returns the address of the exported function
string name(); // returns the name of the exported function
int ordinal(); // returns the ordinal of the exported function
string forwardedName(); // returns the name of the function the exported function forwards to
void destroy(); // destroys the exported function
};

一个处理PE架构资源列表的类：

class PEResources {
public:
PEResource item(int index); // returns a resources with the given index
int count(); // returns the number of resources in the list
void clear(); // clears the list
PEResource itemByType(int type); // returns a resource of the given type
PEResource itemByName(string name); // returns a resource with the given name
};

一个与PE架构资源一起工作的类：

class PEResource {
public:
PEResource item(int index); // returns a resource with the given index
int count(); // returns the number of resources in the list
void clear(); // clears the list
uint64 address(); // returns the address of the resource
int size(); // returns the size of the resource
string name(); // returns the name of the resource
int type(); // returns the type of the resource
bool isDirectory(); // returns the "Directory" property
void destroy(); // destroys the resource
PEResource itemByName(string name); // returns a resource with the given name
bool excludedFromPacking(); // returns the "Excluded from packing" property
};

一个用于处理PE架构修复（重新定位）列表的类：

class PEFixups {
public:
PEFixup item(int index); // returns an element with the given index
int count(); // returns the number of elements in the list
PEFixup itemByAddress(uint64 address); // returns an element at the given address
};

一个与PE架构修复（重定位）有关的类：

class PEFixup {
public:
uint64 address(); // returns the address of the element
};

获取完整>>>vmprotect 中文支持手册