devirt.re
Create account
Menu

Reverse engineering and devirtualization news

News and guides.
Follow the work.

Product news, practical guides and the public roadmap: what works now, what is in development, and how to get more from an analysis. Technical research lives in its own section.

Get new posts by email See how Devirt works
The blog mapNews · Guides · Roadmap

No customer binaries or identifying engagement details are published here.

What works now.
What earns its way in next.

On the product roadmap, a family or feature moves forward only after its processing boundary is testable. “Planned” is direction, not a promised release date.

Known-family processing

Available

Automated paths cover the profiles below. Exact build and output eligibility are still checked at intake; the coverage ledger states what the submitted file actually supports.

  • VMProtect 2.x / 3.x
  • Themida family

JavaScript VMs, .NET virtualizers, commercial packers, native-code virtualization, Enigma Protector and Obsidium start with a free assessment. Loki-derived protections, including Obfuscator X and Griffin, are not automated; every binary requires its own free assessment.

Inspect current family coverage

More families, promoted by evidence

Planned

Novel assessments form the candidate queue. Newly encountered packer builds and unfamiliar native VM architectures become named automated profiles only after replay, verification, and output-persistence gates pass. We do not advertise a family or date before that evidence exists. Loki, Obfuscator X and Griffin require a separate assessment for every binary.

Planned enrichment includes evidence-linked MITRE ATT&CK technique mapping, IOC and YARA exports, and additional executable formats. Later workspace work includes organization invitations, collaborative cases, role administration, and SSO. None of these are presented as available before their contracts pass.

Create an account for assessment

Coverage is a contract.
Not just a number.

A clean function is not proof of every possible behavior. Learn to read the denominator, runtime dependencies, and permanent limits before relying on an analysis.

Read the field note
  • Published methodology
  • From Devirt research
Scope · 100 selected operationsTeaching sample

Nothing disappears from the denominator.

This teaching ledger contains 100 selected operations: 86 proven, 7 runtime-dependent, 2 unresolved, and 5 permanently bounded. Every unit is counted exactly once.

Synthetic, not a service benchmark. Solver SAT and timeout counts are separate outcomes, not extra coverage buckets.

Published guides

Protected binary analysis: a practical workflow

Published

Six stages, from identifying the protection to documenting what the evidence proves.

Read the guide

Devirtualization vs deobfuscation vs unpacking

Published

What each job recovers from a protected binary, and what it leaves unsolved.

Read the guide

VMProtect unpacking vs devirtualization

Published

What an unpacker fixes in a VMProtect file, and what stays virtualized.

Read the guide

Planned guides

Inside a delivered IDA database

Planned

Follow a named function from recovered logic to its coverage record.

How to evaluate a devirtualization result before paying

Planned

Check the denominator, the proven count and the unresolved list before you rely on it.

Further plans

Architecture field guides

How different VM designs reshape control flow, state, and the evidence needed to recover their meaning.

Anonymized case studies

Engagement stories published only when permission and confidentiality allow. No private targets or unpublished customer artifacts.

News you can use. Research you can check.

The blog covers product news, the roadmap and practical guides. Measured results, protector internals and methods live in Devirt Research.

The roadmap is an editorial plan, not a delivery commitment. Topics and order may change as the product develops.

Browse the research section Have a file to assess? Create account