Recover readable logic from code that Enigma Protector runs inside its virtual machine, with the proof state of every function on record. Start with a free assessment.
Enigma Protector devirtualization is the recovery of readable program logic from code that Enigma Protector runs inside its own virtual machine. Devirt maps the virtualized code back to functions you can inspect in your own tools, and records whether each function is proven, runtime-dependent, unresolved or permanently bounded.
Family recognition is an intake decision, not a guarantee for every build. Custom behavior and multiple protection layers can require a separate assessment.
A binary does not need virtualization to be in scope. Devirt can reverse ordinary compiled programs, map their behavior and interfaces, and surface risk indicators for your authorized review.
The delivery pairs readable output with a full ledger for the agreed scope. Proven, runtime-dependent, unresolved, and permanently bounded units remain distinguishable, including units that were never virtualized.
See how the checks workEnigma Protector is a commercial protector for Windows executables, 32-bit and 64-bit, and for .NET files. Its virtual machine converts selected parts of native code into PCODE, an instruction language only Enigma Protector reads, and runs that PCODE on an internal virtual processor.
A developer chooses what to virtualize with VM markers in the source code, a MAP or PDB file, or Enigma Protector's own function selection. The rest of the program can stay native or be obfuscated and mutated, so one protected file can mix several methods.
Every Enigma Protector binary starts with a free assessment. We confirm eligibility for the exact build, configuration and architecture, estimate coverage and send a written quote before paid work begins.
Enigma Protector is not in checkout yet, so every Enigma Protector job starts with the free assessment, and nothing is charged unless you accept the written offer. Accepted work is billed per result on the same price list as VMProtect, or covered by a subscription. The pricing page lists current prices.
An Enigma Protector result arrives in the output you choose: an IDA database, annotated pseudocode, a full reverse engineering report, LLVM IR or structured API JSON. Every result carries its coverage ledger, a proof summary and the remaining limits, and IDA output is checked after it is saved and reopened.
Devirt reports every unit of an Enigma Protector result in one of four coverage categories, and the four counts add up to the total, so no function drops out of the record.
Eligible operations receive formal checks. A solver searches for any input on which the recovered code and the original disagree, and the lifted LLVM representation and independently compiled native execution are compared with the original observations. Counterexamples and timeouts stay visible; they are not counted as proof.
Enigma Protector, VMProtect and Themida all translate selected code into bytecode for a private virtual machine, but each varies that machine differently. Enigma Protector offers two architectures, and its Modern RISC machine generates a new instruction set each time a file is protected. VMProtect can use several different virtual machines inside one application. Themida offers seven named virtual machine profiles.
For analysis, a Modern RISC build has to be understood on its own terms, because another protected file carries a different instruction set. That is why every Devirt result names the exact build it covers.
Devirt analyzes Enigma Protector files for owners and authorized analysts: security and vulnerability research, malware analysis, interoperability and compatibility verification, and compliance work. You must own or have authorization to analyze every file you upload, and a supported protector family does not establish permission to analyze a particular binary.
Devirt does not remove DRM, crack games or bypass license checks, including in software protected with Enigma Protector, and it declines any request with that aim.
One recovered program. Different ways to work with it. Inspect a teaching example, switch formats, and follow the link back to its evidence.
; Authored teaching VM, not vendor bytecode
00 LOAD32 r0, input.size
01 PUSH r0
02 PUSH 0x10
03 UGE
04 STORE p0
05 LOAD32 r1, input.magic
06 PUSH r1
07 PUSH 0x44565254
08 EQ
09 LOAD p0
10 AND
11 RET
#include <stdbool.h>
#include <stdint.h>
bool validate_record(uint32_t size, uint32_t magic) {
const uint32_t header_size = 16u;
const uint32_t expected_magic = 0x44565254u;
if (size < header_size) {
return false;
}
return magic == expected_magic;
}
Drag the divider to reveal the difference. Or choose a view above. Keyboard: arrow keys, Home and End.
Check the declared size. Check the type marker. Accept only when both checks pass.
Readable code explains the behavior. The ledger explains how far you can rely on it.
Original teaching material, not customer output. The IDA view illustrates a database's contents; it is not a downloadable .i64. No measured proof or service benchmark is claimed by these examples.
Every Enigma Protector job starts with the free assessment: Devirt reviews the build, estimates coverage and sends a written offer, and nothing is charged unless you accept it.
Start a free assessmentNo. Enigma Virtual Box is a free tool from the same developers that bundles an application's files and registry entries into one executable and serves them from memory. Its developers state that it does not provide sufficient protection for the files it bundles. Devirt works on code that Enigma Protector has virtualized.
Enigma Protector's virtual machine does not apply to .NET files, so a .NET file holds no Enigma-virtualized code to recover. .NET virtualizers start with a free assessment, and so does any file whose protection you are unsure of.
Only with the owner's authorization. Every upload requires you to confirm that you own the binary or are authorized to analyze it, and Devirt may ask you to clarify the scope or the authorization before starting.
Functions that cannot be proven stay in the ledger as runtime-dependent, unresolved or permanently bounded; they are never hidden. The free assessment estimates coverage before any paid work, nothing is charged unless you accept the written offer, and any revised scope and price need your approval.
Yes. Analysis runs in isolation, files are not shared between customers, uploads are not used for training, and your file is used only for the work you requested. Released output is retained for 72 hours by default or 30 days on Team.
Isolated analysis. No sharing between customers. No training on your upload. Your file is used only for the work you requested.
Read the data-handling policyIsolated processing
Not yet released
Recording the work
Input deletion follows delivery. This timeline shows the default 72-hour output window. Team outputs are kept for 30 days. Audit records have a separate 90-day window.
Policy illustration, not a live deletion certificate. Deletion is confirmed from provider receipts. Assessment inputs, unpaid jobs, and account/billing records have their own rules in the policy.
Start in your account. If your upload needs manual work, we review it and email you a written scope and quote before paid work begins.
Create an account, verify your email and upload your file. We review custom work and email your scope and quote.