devirt.re
Create account
Menu

How our reverse engineering service works

One file.
Follow the evidence.

Create an account, upload your file and review the scope before paid work begins. If manual work is needed, we handle the feasibility review and email you a quote.

The four steps

Illustrative teardown — synthetic protection layers, not a customer result.
  1. Open your workspace and verify your email. Your files and quotes stay together.

    Account → verified email → workspace
  2. Upload in your account and describe what you need to understand.

    Up to 500 MiB · file + analysis question
  3. If manual work is needed, we assess the file and email a quote. You approve before paid work starts.

    Scope · price · timing · your approval
  4. Download the agreed outputs and coverage evidence from your workspace.

    recovered.c · selected analysis outputs

See it end to end.

One protected file, from upload to readable, checked output.

00:00 / 00:00

Three different checks.
One accountable delivery.

Readable code is useful. These checks explain why you can rely on a result—and where you cannot.

Semantic proof

Can the recovered operation disagree?

The solver searches for a counterexample under the stated model. UNSAT supports equivalence within those assumptions. SAT identifies a disagreement; a timeout leaves the question unresolved.

UNSAT / SAT / timeout
Independent execution

Does the translated logic behave the same?

Recovered operations are lifted to LLVM IR, a common intermediate code form. Original observations, the lift, and native execution are compared within the selected inputs and roots.

Input → output match
Artifact audit

Did the evidence survive the handoff?

Requested artifacts are checked, coverage totals reconcile, and IDA output is saved and reopened. Named functions and typed calls remain linked to the analysis scope.

Save → reopen → check

Read the boundary.
Then read the percentage.

Your result’s coverage ledger declares what was counted, the exact build, and the assumptions. Every unit has a place in one of four coverage categories.

Proven
Verified within the declared model.
Runtime-dependent
A real input or environment still matters.
Unresolved
The available evidence did not settle an in-scope unit.
Permanently bounded
An explicit analysis limit remains.
Learn to read your ledger
Scope · 100 selected operationsTeaching sample

Nothing disappears from the denominator.

This teaching ledger contains 100 selected operations: 86 proven, 7 runtime-dependent, 2 unresolved, and 5 permanently bounded. Every unit is counted exactly once.

Synthetic, not a service benchmark. Solver SAT and timeout counts are separate outcomes, not extra coverage buckets.

Your binary stays your business.

Isolated analysis. No sharing between customers. No training on your upload. Your file is used only for the work you requested.

Read the data-handling policy
Input

Your uploaded file

Isolated processing

In scope
Output

Your result files

Not yet released

In scope
Audit

Processing record

Recording the work

In scope
Different data. Different clocks.

Input deletion follows delivery. This timeline shows the default 72-hour output window. Team outputs are kept for 30 days. Audit records have a separate 90-day window.

Policy illustration, not a live deletion certificate. Deletion is confirmed from provider receipts. Assessment inputs, unpaid jobs, and account/billing records have their own rules in the policy.

A complex or unfamiliar build?

Create an account first, then upload the file for free feasibility review. We email the estimated coverage, scope and quote. You decide before any paid work begins; no separate contact request is needed.

Create an account for assessment

What do you need to understand?

Bring a file and a question. Leave with the artifact, evidence, and boundaries that support your next step.

Create your workspace

Create an account, verify your email and upload your file. We review custom work and email your scope and quote.

Create account

Find the right plan