Recover readable logic from code that the Obsidium protector runs on its own virtual CPU, with the proof state of every function on record. Start with a free assessment.
Obsidium devirtualization is the recovery of readable program logic from code that the Obsidium software protector has converted into bytecode for its virtual CPU. Devirt maps the virtualized code back to functions you can inspect in your own tools, and records whether each function is proven, runtime-dependent, unresolved or permanently bounded.
Family recognition is an intake decision, not a guarantee for every build. Custom behavior and multiple protection layers can require a separate assessment.
A binary does not need virtualization to be in scope. Devirt can reverse ordinary compiled programs, map their behavior and interfaces, and surface risk indicators for your authorized review.
The delivery pairs readable output with a full ledger for the agreed scope. Proven, runtime-dependent, unresolved, and permanently bounded units remain distinguishable, including units that were never virtualized.
See how the checks workObsidium is a software protection and licensing system for 32-bit and 64-bit Windows applications and games. Its code virtualization converts selected parts of an application's native machine code into functionally equivalent bytecode for a virtual CPU, which interprets that bytecode while the program runs.
Virtualization is one Obsidium layer among several. Obsidium also encrypts and compresses code and data, can keep individual parts of the code encrypted until they execute, hides string constants, adds counter-measures against disassembling, debugging, dumping and patching, and can encrypt code so that only a valid license decrypts it.
Every Obsidium binary starts with a free assessment. We confirm eligibility for the exact build, configuration and architecture, estimate coverage and send a written quote before paid work begins.
Obsidium is not in checkout yet, so every Obsidium job starts with the free assessment, and nothing is charged unless you accept the written offer. Accepted work is billed per result on the same price list as VMProtect, or covered by a subscription. The pricing page lists current prices.
An Obsidium result arrives in the output you choose: an IDA database, annotated pseudocode, a full reverse engineering report, LLVM IR or structured API JSON. Every result carries its coverage ledger, a proof summary and the remaining limits, and IDA output is checked after it is saved and reopened.
Devirt reports every unit of an Obsidium result in one of four coverage categories, and the four counts add up to the total, so no function drops out of the record.
Eligible operations receive formal checks. A solver searches for any input on which the recovered code and the original disagree, and the lifted LLVM representation and independently compiled native execution are compared with the original observations. Counterexamples and timeouts stay visible; they are not counted as proof.
Obsidium, VMProtect and Themida all translate selected code into bytecode for a private virtual machine, but they draw the line between virtualized and native code differently. Obsidium pairs virtualization with run-time code encryption, and a 2026 research paper describes its virtual CPU as a decode-dispatch loop that leaves functions which may throw exceptions outside the virtual machine. VMProtect can use several different virtual machines inside one application. Themida offers seven named virtual machine profiles.
For analysis, the split matters. An Obsidium function that is only encrypted becomes ordinary native code once it is decrypted, while a virtualized function stays bytecode. The Devirt ledger keeps every unit in scope distinguishable, including units that were never virtualized.
Devirt analyzes Obsidium files for owners and authorized analysts: security and vulnerability research, malware analysis, interoperability and compatibility verification, and compliance work. You must own or have authorization to analyze every file you upload, and a supported protector family does not establish permission to analyze a particular binary.
Obsidium protects commercial applications and games against cracking and piracy. Devirt does not crack software or games, bypass license checks or remove copy protection, and it declines any request with that aim.
One recovered program. Different ways to work with it. Inspect a teaching example, switch formats, and follow the link back to its evidence.
; Authored teaching VM, not vendor bytecode
00 LOAD32 r0, input.size
01 PUSH r0
02 PUSH 0x10
03 UGE
04 STORE p0
05 LOAD32 r1, input.magic
06 PUSH r1
07 PUSH 0x44565254
08 EQ
09 LOAD p0
10 AND
11 RET
#include <stdbool.h>
#include <stdint.h>
bool validate_record(uint32_t size, uint32_t magic) {
const uint32_t header_size = 16u;
const uint32_t expected_magic = 0x44565254u;
if (size < header_size) {
return false;
}
return magic == expected_magic;
}
Drag the divider to reveal the difference. Or choose a view above. Keyboard: arrow keys, Home and End.
Check the declared size. Check the type marker. Accept only when both checks pass.
Readable code explains the behavior. The ledger explains how far you can rely on it.
Original teaching material, not customer output. The IDA view illustrates a database's contents; it is not a downloadable .i64. No measured proof or service benchmark is claimed by these examples.
Every Obsidium job starts with the free assessment: Devirt reviews the build, estimates coverage and sends a written offer, and nothing is charged unless you accept it.
Start a free assessmentObsidium protects both 32-bit and 64-bit Windows programs, native and .NET. Send your file for a free assessment to confirm whether its exact build, architecture and file type are in scope before any paid work.
Only with the owner's authorization. Every upload requires you to confirm that you own the binary or are authorized to analyze it, and Devirt may ask you to clarify the scope or the authorization before starting.
Functions that cannot be proven stay in the ledger as runtime-dependent, unresolved or permanently bounded; they are never hidden. The free assessment estimates coverage before any paid work, nothing is charged unless you accept the written offer, and any revised scope and price need your approval.
Yes. Analysis runs in isolation, files are not shared between customers, uploads are not used for training, and your file is used only for the work you requested. Released output is retained for 72 hours by default or 30 days on Team.
Isolated analysis. No sharing between customers. No training on your upload. Your file is used only for the work you requested.
Read the data-handling policyIsolated processing
Not yet released
Recording the work
Input deletion follows delivery. This timeline shows the default 72-hour output window. Team outputs are kept for 30 days. Audit records have a separate 90-day window.
Policy illustration, not a live deletion certificate. Deletion is confirmed from provider receipts. Assessment inputs, unpaid jobs, and account/billing records have their own rules in the policy.
Start in your account. If your upload needs manual work, we review it and email you a written scope and quote before paid work begins.
Create an account, verify your email and upload your file. We review custom work and email your scope and quote.