VMCRC Bypass

#include<Windows.h>
#include"VMCRC.h"

//VMCRC v340.0 JMS
#define XOR_AL_PEDX     0x00610C00//CRC1
#define MOV_AX_PEAX     0x004AE56D//CRC2
#define MOV_EAX_PEAX    0x004AE50D//CRC3
#define MOV_AL_PEDX     0x0097EC6F//CRC4

DWORD MemoryDump = 0, Address_Start = 0, Address_End = 0;
void (_stdcall *GetDumpInfo)(LPDWORD MemoryDump, LPDWORD Address_Start, LPDWORD Address_End);

class CodeWriter{
private:
    DWORD Memory;

public:
    CodeWriter(DWORD Address);
    CodeWriter(DWORD Address, DWORD Size);
    void w1(BYTE b);
    void w2(WORD w);
    void w4(DWORD dw);
    void call(DWORD Address);
    void jmp(DWORD Address);
    void copy(DWORD Address, DWORD Size);
    void FullAccess();
};

class Test{
private:
    DWORD Address;
    DWORD Memory;
    DWORD AddressChecker;
    void CreateAddressChecker();
    void CreateCodeCave();
    void Hook();
    DWORD GetReturn(DWORD rAddress);

public:
    Test(DWORD HookAddress);
};

Test::Test(DWORD HookAddress){
    Address = HookAddress;
    Memory = (DWORD)VirtualAlloc(NULL, 256, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
    AddressChecker = Memory + 128;

    CreateAddressChecker();
    CreateCodeCave();
    Hook();
}

void Test::CreateAddressChecker(){
    CodeWriter cw(AddressChecker);
    //cw.w1(0x9C);//pushfd
    cw.w1(0x81);//cmp
    cw.w1(0xFA);//edx
    cw.w4(Address_Start);//Address1
    cw.w1(0x72);//jb
    cw.w1(0x14);
    cw.w1(0x81);//cmp
    cw.w1(0xFA);//edx
    cw.w4(Address_End);//Address2
    cw.w1(0x77);//ja
    cw.w1(0x0C);
    cw.w1(0x81);//sub
    cw.w1(0xEA);//edx
    cw.w4(Address_Start);//Address1
    cw.w1(0x81);//add
    cw.w1(0xC2);//edx
    cw.w4(MemoryDump);//Memory
    //cw.w1(0x9D);//popfd
    cw.w1(0xC3);//ret
}

void Test::CreateCodeCave(){
    CodeWriter cw(Memory);
    BYTE type = *(BYTE *)(Address);//1st byte
    DWORD CurrentAddress;
    DWORD FakeReturn;
    DWORD Return;

    int size1 = 0;//size of 1st opcode

    cw.w1(0x52);//push edx
    if(type == 0x66 || type == 0x8B){
        cw.w1(0x8B);//mov
        cw.w1(0xD0);//edx,eax
    }

    cw.call(AddressChecker);

    switch(type){
    case 0x32://xor al,[edx]
        cw.w1(0x32);//xor
        cw.w1(0x02);//al,[edx]
        size1 = 2;
        break;

    case 0x66://mov ax,[eax]
        cw.w1(0x66);//mov
        cw.w1(0x8B);//al
        cw.w1(0x02);//[eax]
        size1 = 3;
        break;

    case 0x8B://mov eax,[eax]
        cw.w1(0x8B);//mov eax
        cw.w1(0x02);//[edx]
        size1 = 2;
        break;

    case 0x8A://mov al,[edx]
        cw.w1(0x8A);//mov
        cw.w1(0x02);//al,[edx]
        size1 = 2;
        break;

    default:
        break;
    }

    cw.w1(0x5A);//pop edx

    int i;
    for(i=0; ; i++){
        if(*(BYTE *)(Address + i) == 0xE9){//jmp
            //if(GetReturn(Address) >= Address_Start && GetReturn(Address) <= Address_End){
                type = 0xE9;
                break;
            //}
        }
        else if(*(BYTE *)(Address + i) == 0xE8){//call
            //if(GetReturn(Address) >= Address_Start && GetReturn(Address) <= Address_End){
                type = 0xE8;
                break;
            //}
        }
    }

    CurrentAddress = Address + i;//this address
    Return = GetReturn(CurrentAddress);
    FakeReturn = CurrentAddress + 5;

    cw.copy(Address + size1, CurrentAddress - (Address + size1));//original code

    switch(type){
    case 0xE9://jmp
        cw.jmp(Return);
        break;

    case 0xE8://call
        cw.w1(0x68);//push
        cw.w4(FakeReturn);
        cw.jmp(Return);
        break;

    default:
        break;
    }
}

void Test::Hook(){
    CodeWriter cw(Address, 128);
    cw.jmp(Memory);
}

DWORD Test::GetReturn(DWORD rAddress){
    return *(DWORD *)(rAddress + 1) + rAddress + 5;
}

CodeWriter::CodeWriter(DWORD Address, DWORD Size){
    DWORD old;
    Memory = Address;
    VirtualProtect((LPVOID)Memory, Size, PAGE_EXECUTE_READWRITE, &old);
}

CodeWriter::CodeWriter(DWORD Address){
    Memory = Address;
}

void CodeWriter::w1(BYTE b){
    *(BYTE *)(Memory) = b;
    Memory++;
}

void CodeWriter::w2(WORD w){
    *(WORD *)(Memory) = w;
    Memory += 2;
}

void CodeWriter::w4(DWORD dw){
    *(DWORD *)(Memory) = dw;
    Memory += 4;
}

void CodeWriter::call(DWORD Address){
    w1(0xE8);//call
    w4(Address - Memory - 4);
}

void CodeWriter::jmp(DWORD Address){
    w1(0xE9);//jmp
    w4(Address - Memory - 4);
}

void CodeWriter::copy(DWORD Address, DWORD Size){
    memcpy((LPVOID)Memory, (LPVOID)Address, Size);
    Memory += Size;
}

void VMCRC(){
    HMODULE hBypass = GetModuleHandleA("Bypass.dll");
    GetDumpInfo = (void (_stdcall *)(LPDWORD, LPDWORD, LPDWORD))GetProcAddress(hBypass, "GetDumpInfo");//plese make export function yourself
    GetDumpInfo(&MemoryDump, &Address_Start, &Address_End);
    Address_End = 0x01000000;//if this includes dynamic value or like things, this bypass will cause crash
    Test t1(XOR_AL_PEDX);
    Test t2(MOV_AX_PEAX);
    Test t3(MOV_EAX_PEAX);
    Test t4(MOV_AL_PEDX);
}