Devirt is an automated devirtualization service for reverse engineering consultancies whose client work is blocked by VM-protected functions. Your team uploads the authorized binary, and Devirt returns the recovered functions as an IDA database, annotated pseudocode, LLVM IR or API JSON, with a coverage ledger that shows which functions were proven. Standard automated jobs have a 24-hour SLA, so the recovery fits inside an engagement instead of becoming one.
Create an account first, then upload in your workspace. If your file needs manual review, we email a written quote before paid work begins. Upload a file of up to 500 MiB and see the scope and the total before you pay. Compare prices and plans.
A reverse engineering consultancy should outsource devirtualization when VM-protected functions stand between its analysts and the question a client is paying to answer, and recovering them by hand would cost more hours than the engagement can carry. Code virtualization rewrites selected functions as bytecode for a virtual machine that the protector adds to the binary, so a disassembler shows the interpreter instead of the program.
The engagement stays with your team. Devirt recovers the functions; your analysts decide what they mean and write the report the client reads. The comparison with manual reverse engineering sets out the trade-off between doing the recovery in-house and commissioning it, and the comparison with hiring a reverse-engineering consultant covers bringing in a specialist for the same work.
Devirt's automated path covers VMProtect 2.x and 3.x and Themida and Code Virtualizer. Loki-based virtual machines require a separate free assessment for every binary, including Obfuscator X and Griffin. Enigma Protector files start with a free assessment, and ordinary compiled binaries go through software reverse engineering services. Family recognition is an intake decision, not a guarantee for every build, so a custom VM or several protection layers can need a separate assessment.
Devirt delivers the output you select, together with the coverage ledger and a proof summary. Each format fits a different step in a consultancy's workflow.
| Format | What it contains | Use it to |
|---|---|---|
| IDA database (.i64) | Proven functions, named imports, typed API calls and the coverage ledger, saved and reopened as part of the output audit | Continue the investigation in your own IDA setup |
| Annotated pseudocode (.c) | Readable C with semantic naming and function-level commentary | Quote recovered logic in the client report |
| Full RE report (.pdf) | Architecture, behavior, identity surfaces and an executive summary | Brief readers who will not open a database |
| LLVM IR (.ll) | The lifted intermediate representation of the recovered code | Feed your own analysis tooling |
| API JSON (.json) | Structured findings and coverage | Automate intake, tracking and reporting |
Recurring work can go through the Devirt API: submit a file, follow the job and download the result, with an optional completion webhook. API access needs an API-enabled plan.
Every Devirt result carries a coverage ledger, so a consultancy can put a recovered function in front of a client and show what backs it. The ledger declares what was counted, the exact build and the assumptions, and places every in-scope unit in one of four states: proven, runtime-dependent, unresolved or permanently bounded.
A proof holds within its declared model and scope. A solver counterexample or timeout is recorded, never counted as proof, so a partial result names what it does not cover. How the checks work explains the three kinds of check, and reading a coverage ledger walks through each state.
Yes, when your client has authorized the analysis. At signup and at every upload you attest to your authority to submit the binary, and Devirt can decline a job or ask you to clarify its scope or authorization. Do not submit material your engagement does not allow you to transfer.
Devirt processes each upload in an isolated environment, only for the analysis you requested. Uploads are not shared between customers or used for training, and input deletion begins once processing finishes and the output is available. Released output stays downloadable for 72 hours by default or 30 days on Team. Confidentiality terms, deletion certificates and exclusivity can be agreed in a separate signed engagement, and the data-handling policy has the details.
Standard automated jobs have a 24-hour SLA from confirmed payment, and eligible jobs can run express with a one-hour SLA. A complex or unfamiliar build starts with a free assessment; an accepted engagement has a 72 to 168 hour delivery window after the deposit, with senior reverse-engineer validation before release.
A processing failure or a missed SLA returns the credits used and automatically requests a refund of the per-job payment, under the published service levels and refund rules. Units the analysis could not prove stay in the ledger as runtime-dependent, unresolved or permanently bounded, so nothing in scope drops out of the count.
You see the scope and the total before you pay, and complexity never adds an automatic surcharge. Published prices and plans; custom work is quoted after assessment are published, and a revised scope or price always needs your approval before it is charged.
Not seeing your use case here?Create an account for assessment