I have been working on some unpackers, and I noticed that at their end, they mostly use this:mov edx, [ebp+oep]call edx ; now, you're at the OEP of the original binaryOr this:mov ecx, [ebp+oep]jmp ecxOr this:mov eax, [ebp+oep]push eaxretKnowing that, with a quick hook on absolute jumps/calls you'd unpack stuff in literally seconds. Apart from that, some software uses cpuid and rdstc to identify you, while protecting the assembly heavily with a lot of obfuscation. Put an instruction breakpoint on either, and you just bypassed everything faster than your eye blinks!Is what I'm saying possible, without severe performance hits? I am aware of tracing, but that's really really slow so it's not an option.Edit: I am aware of the existence of hypervisors, I just have no idea if they fit my situation, and if so, I wouldn't know how to apply those techniques to work, so any pointers, even if Google keywords, would be great.
Is it possible to hook CPU instructions without severe performance impact?
assembly;breakpoint