Which Devirt service should I choose if I do not know the protector?
Start with a free assessment. Devirt intake detects the VM family, and you receive a written offer before you pay anything. Accept it, or decline with no charge.
Devirtualization and analysis services.
Devirt turns protected and ordinary binaries into readable, checked analysis for teams authorized to inspect them. Pick a service by the protector you face or by the question you need answered.
What services does Devirt offer?
Devirt (devirt.re) is an automated binary devirtualization service for authorized security research. It offers 11 services, grouped by where you start. Protector devirtualization recovers code that a protector turned into bytecode for its own virtual machine. Analysis services work on ordinary and protected binaries alike and explain how a program behaves or how it is built.
Every Devirt service delivers readable output with a coverage ledger that separates proven, runtime-dependent, unresolved and bounded functions.
Which service fits your file?
The right starting point depends on what you already know about the file.
- You know the protector. Choose its devirtualization service. The recovered functions arrive in the output format you pick, together with the ledger.
- You know the question but not the protection. Choose an analysis service. Its report shows what it found, with the evidence behind it.
- You know neither, or the build is unusual. Request a free assessment. Intake detects the VM family, and a written offer sets out the scope, estimated coverage and delivery window before you decide.
The assessment costs nothing, and declining the offer costs nothing either.
What every Devirt service delivers
Each Devirt delivery matches the scope you agreed before the work started. Its ledger covers the whole of that scope, including functions that were never virtualized, so a reviewer can see what was checked and what still needs checking.
Results come in five formats:
- IDA database. Proven functions, named imports, typed API calls, and coverage ledger.
- Annotated pseudocode. Readable C with semantic naming and function-level commentary.
- Full RE report. Architecture, behavior, identity surfaces, and an executive summary.
- LLVM IR. Lifted intermediate representation for your toolchain.
- API JSON. Structured findings and coverage for automated workflows.
Devirt services: questions and answers
Who can use Devirt services?
Devirt services are for authorized analysis. You must own each binary or have authorization to analyze it, and you must use the results lawfully. Accepted uses include security research, malware analysis, interoperability checks, driver auditing and compliance verification. Devirt refuses DRM removal and game cracking.
Read the acceptable use policyWhat happens if part of a file cannot be recovered?
Devirt reports it. A function that cannot be proven stays marked as runtime-dependent, unresolved or bounded in the ledger, and solver counterexamples and timeouts are not counted as proof. If the work needs a wider scope, the revised scope and price need your approval first.
Does Devirt keep my file confidential?
Yes. Devirt analyzes each file in isolation, does not share it between customers and does not train on uploads. Your file is used only for the work you requested, and results stay available for download for 72 hours by default or 30 days on Team after release.
Read the data-handling policyHow long does a Devirt service take?
Standard automated Devirt jobs have a 24-hour SLA, and eligible express jobs have a one-hour SLA. Novel engagements run on an accepted offer, with a delivery window of 72 to 168 hours and senior review before release.
Not sure which service fits?
Create an account and upload your file and question. We review the scope and email a quote if manual work is needed.
Create your workspace
Create an account, verify your email and upload your file. We review custom work and email your scope and quote.