Automated reverse engineering for protected or ordinary binaries, built for security teams, researchers, and interoperability engineers.
Software reverse engineering is the analysis of a compiled program to establish how it behaves when the source code is not available. Devirt covers the hardest form of it: binaries whose functions a commercial protector has virtualized, where an ordinary decompiler describes an interpreter instead of the original logic.
Family recognition is an intake decision, not a guarantee for every build. Custom behavior and multiple protection layers can require a separate assessment.
A binary does not need virtualization to enter the automated analysis path. Devirt can reverse ordinary compiled programs, map their behavior and interfaces, and surface risk indicators for your authorized review.
The delivery pairs readable output with a full ledger for the agreed scope. Proven, runtime-dependent, unresolved, and permanently bounded units remain distinguishable, including units that were never virtualized.
See how the checks workDevirt works on compiled software: native executables, JavaScript bundles, .NET assemblies, and binaries carrying no protection at all. What sets the service apart is recovery from commercial protectors that turn selected functions into bytecode for a virtual machine built into the file.
Security researchers and malware analysts who have to explain what a protected sample does, not only that it is protected.
Engineering teams maintaining or interoperating with software their organization owns, or licenses with a right to analyze, where the source code is gone.
Auditors who need a finding that survives review, with the evidence attached to it.
Virtualization replaces the instructions of a function with bytecode for an interpreter the protector embeds in the binary. A decompiler still works, but it describes the interpreter rather than the logic that was protected. Devirtualization recovers what the function computes.
Automated recovery covers eligible VMProtect, Themida, Code Virtualizer, Enigma Protector and Obsidium profiles. Enigma Protector and Obsidium jobs start with a free assessment. Loki-derived protections, including Obfuscator X and Griffin, are difficult cases that require a separate assessment for every binary and are not automated profiles.
Obfuscation leaves code native but hard to read, through substituted instructions, junk code and deliberately confusing control flow. Where recovering a protected function requires working through those layers, that work is part of the analysis rather than a separate product.
A request to deobfuscate a binary on its own, with no virtualized functions to recover, starts with a free assessment so the scope can be agreed first.
Results arrive in the formats an analyst already works in, so nothing has to be rebuilt in another tool: an IDA database, annotated pseudocode, a full reverse engineering report, LLVM IR, and API JSON.
Every delivery carries a coverage ledger for the agreed scope, so the result can be checked rather than taken on trust.
Readable output is not the same as proven output, and the ledger keeps the two apart. Each unit in scope is recorded as proven, runtime-dependent, unresolved or permanently bounded.
Proven means verification evidence inside a declared scope. Runtime-dependent means a real input or environment state is needed before the question can be settled. Unresolved means the unit was inspected and the evidence did not settle it. Permanently bounded means an explicit limit was agreed. Units are never dropped from the denominator to make a result look better.
Create an account and verify your email. Upload a binary you own or are authorized to analyze and describe the result you need. Eligible files follow the standard analysis path.
Custom or unsupported virtual machines and analyst-reviewed reports use the same account and upload workflow. We handle the free feasibility review and email a written scope and quote. You approve before paid work begins; no separate contact request is needed.
Devirt accepts only binaries you own or are authorized to analyze, and every submission is made on that basis. Requests to remove licensing, defeat DRM or enable cheating are refused.
Analysis is isolated, nothing is shared between customers, and uploads are never used for training. Your file is used only for the work you requested. You can request your own processing log, and Enterprise deletion certificates require confirmed deletion rather than a request to delete.
One recovered program. Different ways to work with it. Inspect a teaching example, switch formats, and follow the link back to its evidence.
; Authored teaching VM, not vendor bytecode
00 LOAD32 r0, input.size
01 PUSH r0
02 PUSH 0x10
03 UGE
04 STORE p0
05 LOAD32 r1, input.magic
06 PUSH r1
07 PUSH 0x44565254
08 EQ
09 LOAD p0
10 AND
11 RET
#include <stdbool.h>
#include <stdint.h>
bool validate_record(uint32_t size, uint32_t magic) {
const uint32_t header_size = 16u;
const uint32_t expected_magic = 0x44565254u;
if (size < header_size) {
return false;
}
return magic == expected_magic;
}
Drag the divider to reveal the difference. Or choose a view above. Keyboard: arrow keys, Home and End.
Check the declared size. Check the type marker. Accept only when both checks pass.
Readable code explains the behavior. The ledger explains how far you can rely on it.
Original teaching material, not customer output. The IDA view illustrates a database's contents; it is not a downloadable .i64. No measured proof or service benchmark is claimed by these examples.
Standard automated jobs have a 24-hour SLA; eligible express jobs have a one-hour SLA. Novel engagements use an accepted offer, a 72–168 hour window, and senior review before release.
Compare starting pricesIt depends on your jurisdiction, the license you hold and the authorization behind the request, and Devirt does not give legal advice. What Devirt can state is its own rule: it accepts only binaries you own or are authorized to analyze, and declines anything aimed at removing licensing, defeating DRM or enabling cheating.
No, and no service can. Names, comments and project structure do not survive compilation, and protection removes more on top of that. What you receive is recovered logic and program structure in a form your own tools can read, with the evidence for each conclusion.
The assessment is free, so the scope is proposed and likely recovery is estimated before you approve paid work. If a job then fails or misses its service level, used credits are returned and the per-job refund is requested automatically. Anything that could not be proven stays visible in the coverage ledger rather than being quietly dropped.
Isolated analysis. No sharing between customers. No training on your upload. Your file is used only for the work you requested.
Read the data-handling policyIsolated processing
Not yet released
Recording the work
Input deletion follows delivery. This timeline shows the default 72-hour output window. Team outputs are kept for 30 days. Audit records have a separate 90-day window.
Policy illustration, not a live deletion certificate. Deletion is confirmed from provider receipts. Assessment inputs, unpaid jobs, and account/billing records have their own rules in the policy.
Start in your account. If your upload needs manual work, we review it and email you a written scope and quote before paid work begins.
Create an account, verify your email and upload your file. We review custom work and email your scope and quote.