Recover readable, checked program logic from Themida-protected code you are authorized to analyze, across all seven Themida virtual machine profiles.
Themida devirtualization is the recovery of program logic from code that Oreans Themida has converted into bytecode for one of its own virtual machines. Devirt recovers that logic from files you are authorized to analyze and delivers it as an IDA database, annotated pseudocode, LLVM IR, a full report or API JSON, with a coverage ledger that separates proven functions from everything that is not proven.
Family recognition is an intake decision, not a guarantee for every build. Custom behavior and multiple protection layers can require a separate assessment.
Virtualization replaces ordinary instructions with a custom interpreter. Devirt recovers meaningful operations and program structure so you can investigate behavior in your own tools.
The delivery pairs readable output with a full ledger for the agreed scope. Proven, runtime-dependent, unresolved, and permanently bounded units remain distinguishable, including units that were never virtualized.
See how the checks workThemida names its virtual machine architectures after animals, and Devirt supports all seven: FISH, TIGER, LION, DOLPHIN, PUMA, EAGLE and SHARK. A protected file can use more than one of them.
Oreans documents lighter machines such as FISH and TIGER for code that must stay fast and heavier ones such as PUMA and SHARK for code that needs to be highly protected. Each protected file carries its own instance of a machine, with its own handlers and opcode table, so an opcode table taken from one file does not carry over to the next.
Themida and VMProtect both replace selected functions with bytecode for a private virtual machine, but the machines are built differently. Published research on Themida notes that its virtual machine context and virtual stack live inside the protected binary rather than on the native stack, which is what allows Themida to nest one virtual machine inside another.
The Themida architectures also differ from each other: Oreans compares the difference between TIGER and LION to the difference between an x86 and an ARM processor.
Themida devirtualization serves people who need to know what protected code does and who are authorized to find out: malware analysts facing Themida-packed samples, security teams reviewing software before they deploy it, engineers who need an interface documented for interoperability, and companies recovering logic from their own protected builds.
Every submission requires authorization to analyze the file. Devirt refuses DRM removal and game cracking, and it can decline a job and ask for the scope or the authorization to be clarified.
A Themida result uses the same output formats as every Devirt result. You choose the ones you need, and every delivery includes the coverage ledger and the proof summary for the agreed scope.
A synthetic teaching sample on the site shows what an assessment and a ledger look like. It is illustrative and is not a customer result.
A Themida result counts every function in scope and places it in one of four states: proven, runtime-dependent, unresolved or permanently bounded. The four states add up to the declared total, so functions that were not proven stay visible instead of dropping out of the count.
For eligible operations, a solver searches for a counterexample: UNSAT supports equivalence within the stated model, SAT identifies a disagreement, and a timeout leaves the question unresolved. Neither a counterexample nor a timeout counts as proof.
Themida devirtualization is available on subscription plans only, not as a one-off purchase. Code Virtualizer, the standalone virtualizer from Oreans, is analyzed per result. The pricing page lists the current plans.
Recognizing Themida at intake is an eligibility decision, not a guarantee for every build. Custom behavior or several protection layers can require a free assessment before any work is priced.
When a function cannot be proven, the result says so. It stays in the ledger as runtime-dependent, unresolved or permanently bounded, so you can decide whether the evidence answers your question or a wider engagement is needed.
One recovered program. Different ways to work with it. Inspect a teaching example, switch formats, and follow the link back to its evidence.
; Authored teaching VM, not vendor bytecode
00 LOAD32 r0, input.size
01 PUSH r0
02 PUSH 0x10
03 UGE
04 STORE p0
05 LOAD32 r1, input.magic
06 PUSH r1
07 PUSH 0x44565254
08 EQ
09 LOAD p0
10 AND
11 RET
#include <stdbool.h>
#include <stdint.h>
bool validate_record(uint32_t size, uint32_t magic) {
const uint32_t header_size = 16u;
const uint32_t expected_magic = 0x44565254u;
if (size < header_size) {
return false;
}
return magic == expected_magic;
}
Drag the divider to reveal the difference. Or choose a view above. Keyboard: arrow keys, Home and End.
Check the declared size. Check the type marker. Accept only when both checks pass.
Readable code explains the behavior. The ledger explains how far you can rely on it.
Original teaching material, not customer output. The IDA view illustrates a database's contents; it is not a downloadable .i64. No measured proof or service benchmark is claimed by these examples.
Themida is analyzed on subscription plans only. Standard automated jobs have a 24-hour SLA; eligible express jobs have a one-hour SLA. Novel engagements use an accepted offer, a 72–168 hour window, and senior review before release.
Compare subscription plansNo. Unpacking removes the file-level encryption and compression that Themida wraps around a program, but code that Themida virtualized remains bytecode for its virtual machine after unpacking. Recovering that code is devirtualization.
Devirt analyzes only files you own or are authorized to analyze, for purposes such as security research, malware analysis and interoperability. Unauthorized intrusion, unlawful circumvention and redistribution without rights are prohibited under the acceptable use policy.
Devirt supports all seven Themida virtual machine profiles: FISH, TIGER, LION, DOLPHIN, PUMA, EAGLE and SHARK. A protected file can use more than one of them.
Your file is analyzed in an isolated environment and used only for the work you requested. Nothing is shared between customers and nothing is used for training. Input is deleted after completion and delivery, and released output stays available for 72 hours by default or 30 days on Team.
They stay in the coverage ledger as runtime-dependent, unresolved or permanently bounded instead of disappearing from the result. You see exactly which functions were proven and which were not.
Isolated analysis. No sharing between customers. No training on your upload. Your file is used only for the work you requested.
Read the data-handling policyIsolated processing
Not yet released
Recording the work
Input deletion follows delivery. This timeline shows the default 72-hour output window. Team outputs are kept for 30 days. Audit records have a separate 90-day window.
Policy illustration, not a live deletion certificate. Deletion is confirmed from provider receipts. Assessment inputs, unpaid jobs, and account/billing records have their own rules in the policy.
Start in your account. If your upload needs manual work, we review it and email you a written scope and quote before paid work begins.
Create an account, verify your email and upload your file. We review custom work and email your scope and quote.