devirt.re
Create account
Menu

Devirt Research

Devirt Research explains how software protectors turn functions into bytecode for a private virtual machine, how devirtualization recovers that logic, and what the evidence can and cannot prove.

4 research areas · Updated

Research policyDated · Versioned · Limits stated

No customer binaries or identifying engagement details are published here.

What is devirtualization?

Devirtualization is the recovery of program logic that a protector has converted into bytecode for its own virtual machine. Protectors such as VMProtect and Themida replace selected native functions with that bytecode and a handler loop that interprets it, so a disassembler or decompiler sees the interpreter instead of the original logic.

Devirtualization recovers readable functions from that bytecode. The results can be delivered as an IDA database, pseudocode or LLVM IR. A Devirt result also states how much of that recovery is proven. It is not the original source code: names, comments and structure that the compiler discarded do not come back.

Start here: how to read a devirtualization result.

Before you rely on a result, learn how its coverage total is defined and how runtime-dependent functions and permanent limits are counted. How to read a devirtualization coverage figure walks through each evidence state.

Read the methodology note
Scope · 100 selected operationsTeaching sample

Nothing disappears from the denominator.

This teaching ledger contains 100 selected operations: 86 proven, 7 runtime-dependent, 2 unresolved, and 5 permanently bounded. Every unit is counted exactly once.

Synthetic, not a service benchmark. Solver SAT and timeout counts are separate outcomes, not extra coverage buckets.

Research areas

VMProtect

How VMProtect 2.x and 3.x turn native functions into bytecode for a private virtual machine, how the VM handlers work, and what recovery can and cannot prove about a protected function.

PublishedBrowse VMProtect research

Planned articles

  • What VMProtect devirtualization actually recovers
  • VMProtect 2.x vs 3.x for reverse engineering
  • VMProtect VM handlers explained

Have a VMProtect-protected program you are authorized to analyze?See VMProtect devirtualization

Themida

How Themida virtualizes code, how virtual machine profiles affect recovery.

PublishedBrowse Themida research

Planned articles

  • Themida VM profiles explained
  • Themida devirtualization: what changes across profiles
  • Code Virtualizer explained

Working with a Themida build?See Themida devirtualization

Devirtualization methods

Five families of devirtualization methods, what each can prove, and where each reaches its limits. The evidence states in a Devirt result are proven, runtime-dependent, unresolved and permanently bounded.

PublishedBrowse devirtualization methods research

PublishedHow to read a devirtualization coverage figure

PublishedRuntime-dependent, unresolved and bounded functions explained

Planned articles

  • Bytecode devirtualization explained
  • Lifting protected code to LLVM: what it does and does not prove
  • Symbolic execution in devirtualization

Want the whole path, from trace to delivered result?See how Devirt works

Binary analysis

Methods, evidence standards and measured case studies for protected executables, from finding the code that matters to a result another analyst can check.

PublishedBrowse binary analysis research

Planned articles

  • Taint analysis for protected binary research
  • An interoperability case study
  • A legacy recovery case study

Need a protected or ordinary binary analyzed?See binary reverse engineering

How we publish research.

Our publication policy requires a date and version for each research article. Where applicable, articles identify the protector version and sample used. They distinguish proven findings from runtime-dependent, unresolved or permanently bounded results. Failures are published too.

Planned articles describe intended topics; publication dates are not promised. News, guides and the product roadmap live on the blog.

Read the blog Create an account for assessment