STATIC DEVIRTUALIZATION OF TENCENT VM

Summary from the TLDR InfoSec newsletter

Back Engineering Labs published a technical devirtualization of Tencent's ACE anti-cheat VM obfuscation, detailing how the .tvm dispatcher preserves CET shadow-stack and SEH/unwind semantics via boxed native instructions, RDSSPQ/INCSSPQ balancing, and phantom unwind info, and how guided symbolic execution recompiles virtualized functions back to native code. The team reported 815 of 865 virtualized functions (94.2%) recovered across four ACE kernel drivers, offered a third party for independent validation, and flagged ranged for-loops as a known limitation causing infinite-loop mis-lifts.