Loki-based protections are difficult to analyze. Every binary, including Obfuscator X and Griffin builds, starts with a free assessment and a written offer before paid work.
Loki VM devirtualization is the recovery of readable program logic from code protected by Loki-based virtual machine obfuscation. Loki is an academic obfuscator presented at USENIX Security 2022 and designed to resist automated deobfuscation such as symbolic execution, taint analysis and program synthesis. Loki-derived binaries, including Obfuscator X and Griffin, are difficult cases and are not automated services at Devirt. Every binary requires its own free assessment before a scope, price and delivery window can be offered. Any accepted analysis reports its protected functions as proven, runtime-dependent, unresolved or permanently bounded.
Family recognition is an intake decision, not a guarantee for every build. Custom behavior and multiple protection layers can require a separate assessment.
Virtualization replaces ordinary instructions with a custom interpreter. Devirt recovers meaningful operations and program structure so you can investigate behavior in your own tools.
The delivery pairs readable output with a full ledger for the agreed scope. Proven, runtime-dependent, unresolved, and permanently bounded units remain distinguishable, including units that were never virtualized.
See how the checks workLoki is a code obfuscator from academic research: "Loki: Hardening Code Obfuscation Against Automated Attacks" by Schloegel, Blazytko, Contag, Aschermann, Basler, Holz and Abbasi, presented at USENIX Security 2022. Its public repository describes it as an academic prototype built to show new techniques for hardening virtual machine handlers.
Loki protects code the way other virtualizing protectors do, by translating it into instructions for its own virtual machine, and then hardens its handlers with formally verified expressions of arbitrary complexity. The authors report that recent research on simplifying mixed boolean-arithmetic expressions fails to simplify them, and that Loki cuts the success rate of program synthesis attacks to 19 percent in their evaluation.
Loki VM devirtualization is for teams that need to read Loki-protected code they are allowed to analyze: malware analysts and incident responders, security researchers working within an authorized scope, software owners checking the logic of their own protected builds, and interoperability engineers verifying compatibility.
Loki, Obfuscator X and Griffin are assessed individually. Every Loki-derived binary requires a separate feasibility review, including known variants and new builds of a previously assessed program. Family recognition or a previous successful engagement does not make another binary eligible for automated processing.
Create an account, upload the authorized binary for a free assessment and describe the question you need answered. We review that exact file and email a feasibility report, estimated coverage, proposed deliverables, price and timeline. You accept the written offer before any paid analysis begins. If recovery is feasible, the agreed work reconstructs the virtual machine and handler semantics and checks eligible operations before anything is called proven.
Loki was designed to resist the known automated deobfuscation attacks, so a Loki result states plainly which functions were proven and which were not, rather than presenting readable output as recovered logic.
The free assessment returns a feasibility report and a written offer. Any paid deliverables depend on what that binary supports and what you agree in the offer. Available formats can include the following, each with the coverage ledger and a proof summary; IDA output is checked after it is saved and reopened.
Devirt counts the protected functions in scope before recovery starts and reports every one of them in one of four proof states, so a function that was not proven cannot drop out of the result. A counterexample or a timeout never counts as proof.
Devirt accepts only files you own or are authorized to analyze, and a supported VM family does not by itself establish permission to analyze a particular binary. The acceptable use policy prohibits unlawful circumvention and redistribution without rights.
Each file is analyzed in isolation, is never shared between customers and is not used for training. Confidentiality, EU requirements and exclusivity can be agreed before transfer.
One recovered program. Different ways to work with it. Inspect a teaching example, switch formats, and follow the link back to its evidence.
; Authored teaching VM, not vendor bytecode
00 LOAD32 r0, input.size
01 PUSH r0
02 PUSH 0x10
03 UGE
04 STORE p0
05 LOAD32 r1, input.magic
06 PUSH r1
07 PUSH 0x44565254
08 EQ
09 LOAD p0
10 AND
11 RET
#include <stdbool.h>
#include <stdint.h>
bool validate_record(uint32_t size, uint32_t magic) {
const uint32_t header_size = 16u;
const uint32_t expected_magic = 0x44565254u;
if (size < header_size) {
return false;
}
return magic == expected_magic;
}
Drag the divider to reveal the difference. Or choose a view above. Keyboard: arrow keys, Home and End.
Check the declared size. Check the type marker. Accept only when both checks pass.
Readable code explains the behavior. The ledger explains how far you can rely on it.
Original teaching material, not customer output. The IDA view illustrates a database's contents; it is not a downloadable .i64. No measured proof or service benchmark is claimed by these examples.
Loki, Obfuscator X and Griffin require a free assessment for every binary. We email a file-specific scope, price and timeline before you decide. These are not automated profiles, and a previous assessment does not cover a different binary.
Start a free assessmentDevirt accepts Loki-derived binaries, including Obfuscator X and Griffin, for a free assessment. None is offered as an automated profile. Every binary needs its own review, including known derivatives, novel variants and new builds of a previously assessed program. Recovery is offered only where that assessment supports it.
The function stays in the result. Every protected function counted before recovery ends up proven, runtime-dependent, unresolved or permanently bounded, so you can see what the evidence covers and what it does not.
Every Loki-derived binary starts with a free assessment. We email a written offer with the scope, price, deliverables and timeline for that file. Paid work begins only after you accept; automated per-result pricing and subscription allowances do not qualify these binaries.
The assessment sets a delivery window for that exact binary. Loki-derived protections are difficult cases, so the standard automated and express delivery targets do not apply. The accepted offer states the timeline and review requirements before paid work begins.
Devirt accepts a file only when you own it or are authorized to analyze it, for purposes such as security research, malware analysis, interoperability and compliance verification. The rules differ between jurisdictions and licenses, so confirm your own basis before uploading.
Isolated analysis. No sharing between customers. No training on your upload. Your file is used only for the work you requested.
Read the data-handling policyIsolated processing
Not yet released
Recording the work
Input deletion follows delivery. This timeline shows the default 72-hour output window. Team outputs are kept for 30 days. Audit records have a separate 90-day window.
Policy illustration, not a live deletion certificate. Deletion is confirmed from provider receipts. Assessment inputs, unpaid jobs, and account/billing records have their own rules in the policy.
Start in your account. If your upload needs manual work, we review it and email you a written scope and quote before paid work begins.
Create an account, verify your email and upload your file. We review custom work and email your scope and quote.