Stack trace translation

VMProtect
1

Hi,

We like to collect stack traces from user crashes. I’ve got the trace in the form of the program counter addresses for each stack frame.
I can get the symbols using dbghelp.dll and the pdb in the usual manner before protecting.

Is there a tool to translate those back to what they were before protecting, so I can get the symbols etc?

I’ve seen the MiniDumpFixer.exe, but I’d rather not start collecting minidumps unless I absoluely have to.

2

VMProtect changes EIP of virtualized/compiled commands, so it’s impossible to translate new EIPs to old addresses

3

Just curious, is it still same in vmprotect? or we can get the backtrace from the protected binary somehow?

What are the recommended ways to generate a backtrace for crash in protected binary?

4

i capture patterns and use ida to search