Devirt is an automated binary devirtualization service for authorized analysis, built for seven kinds of teams: reverse engineering consultancies, malware analysts, software owners, interoperability teams, vulnerability researchers, supply-chain security teams and trust and safety teams. Each one sends a protected binary it is authorized to analyze and gets back readable output, such as an IDA database or annotated pseudocode, with a coverage ledger that places every in-scope unit in one of four proof states.
Devirtualization here means recovering code that a protector such as VMProtect or Themida has turned into bytecode for its own virtual machine. It is not the C++ compiler optimization of the same name.
Outsourced devirtualization
VM-protected functions stall a client engagement, and recovering them by hand would cost more hours than the engagement can carry.
You receive: Recovered functions as an IDA database, pseudocode, LLVM IR or JSON, with a coverage ledger your report can cite.
Devirtualization for reverse engineering consultanciesProtected samples
A protected sample shows the decompiler a virtual machine instead of the payload's logic.
You receive: An IDA database or annotated pseudocode for the virtualized functions, with a ledger of what was checked.
Devirtualization for malware analystsLost source code
You own a protected binary, but its source code is lost and the program still has to be understood.
You receive: The program logic as annotated pseudocode and an IDA database. Not the original source files.
Devirtualization for software ownersFormats and protocols
A protected component hides the file format or protocol your product has to support.
You receive: Recovered interfaces and logic your engineers can work from, with established behavior separated from open questions.
Devirtualization for interoperability teamsAuthorized security audits
The code you are authorized to audit sits inside a protector's virtual machine, so the decompiler shows the interpreter instead.
You receive: The recovered functions as an IDA database or annotated pseudocode, with a ledger of what was proven.
Devirtualization for vulnerability researchersThird-party software risk
A vendor's binary protects its own code with a virtual machine, so a component scan cannot tell you what that code does.
You receive: The vendor code's behavior as a report and readable output, with established behavior separated from open questions.
Devirtualization for supply-chain security teamsUploaded file triage
An uploaded executable is packed or virtualized, so your first pass cannot say what it does.
You receive: What the file does, with risk indicators and stated analysis bounds, as evidence for your handling decision.
Devirtualization for trust and safety teamsCreate an account and upload your file with the question you need answered. We review feasibility and email your quote.
Create an account for assessmentEvery Devirt result carries the same coverage ledger, whichever team orders it. The ledger declares what was counted, the exact build and the assumptions, and places every in-scope unit in one of four states: proven, runtime-dependent, unresolved or permanently bounded.
A proof holds within its declared model and scope, and a solver counterexample or timeout is recorded, never counted as proof. How the checks work explains the three kinds of check behind every result.
Devirt accepts only files you own or are authorized to analyze. At signup and at every upload you attest to your authority to submit the binary, and Devirt can decline a job or ask you to clarify its scope or authorization.
Devirt does not remove DRM, bypass license checks or crack software. The acceptable use policy lists the uses Devirt accepts and the ones it prohibits.