Devirt recovers readable logic from protected binaries, including legacy software, that their owners can no longer rebuild from source. For software you own, Devirt returns annotated pseudocode and an IDA database for the functions in scope, including functions a protector virtualized, with a coverage ledger that marks which ones were proven. That is the program's logic, not the original source files, and a free assessment tells you what is likely recoverable before you pay for any work.
Create an account first, then upload in your workspace. If your file needs manual review, we email a written quote before paid work begins. Declining the assessment offer costs nothing. Compare what an analysis costs.
No tool can recover the original source code of a compiled program. Compilers discard comments while translating the source, and the names of functions and variables are mapped to the compiled code in separate symbol files, such as PDB files. Without those files, most original names are gone. The program's logic can be recovered: what each function computes, which calls it makes and how data moves through it.
Protection makes that logic harder to reach. A protector such as VMProtect or Themida can turn a function into bytecode for its own virtual machine, which a decompiler cannot read, and Devirt recovers those functions too. The blog explains how devirtualization differs from deobfuscation and unpacking.
Devirt recovers a readable description of the program, not a copy of the project it was built from.
| Part | Recovered | Not recovered |
|---|---|---|
| Logic | What each function computes and how control flows through it | The original source text |
| Names | Semantic names chosen during analysis, named imports and typed API calls | Original function and variable names kept in debug symbol files |
| Comments | Function-level commentary written during analysis | The developers' original comments |
| Structure | Recovered functions and their call boundaries | Project files, build scripts and the original file layout |
| Certainty | A proof state for every in-scope unit | Behavior the evidence did not settle |
A function whose behavior depends on a real input is marked as runtime-dependent rather than being guessed. The research on runtime-dependent, unresolved and bounded functions explains why.
Every Devirt customer attests to their authority to submit each binary. At signup and at every upload you confirm that you own the file or are authorized to analyze it, and Devirt can decline a job or ask you to clarify its scope or authorization.
Owning the program does not settle every right in it. Third-party components and license terms can still restrict analysis, and you remain responsible for the licenses and permissions involved, so check them before you upload.
Every Devirt result carries a coverage ledger that answers a software owner's practical question: which parts of the recovered logic can you rely on? The ledger places every in-scope unit in one of four states: proven, runtime-dependent, unresolved or permanently bounded.
A proof holds within its declared model and scope, and anything the evidence did not settle stays in the count. How a recovered function is checked covers the three kinds of check behind a result.
You do not need to know. Choose auto-detect at upload, or start with a free assessment, which explains what was observed, what is likely recoverable and what an engagement would deliver. You decide on a written offer before paying for any work.
Annotated pseudocode (.c) is the readable view of the recovered logic, with semantic naming and function-level commentary. An IDA database (.i64) lets a reverse engineer continue the work, and a full RE report (.pdf) adds architecture, behavior and an executive summary for readers who will not open code.
Devirt still accepts it. Automated software reverse engineering also takes ordinary compiled programs, and the delivery still includes a ledger for the agreed scope, with its unresolved and runtime-dependent units.
Devirt processes each upload in an isolated environment, only for the analysis you requested. Uploads are not shared between customers or used for training, and input deletion begins once processing finishes and the output is available. Released output stays downloadable for 72 hours by default or 30 days on Team.
The assessment is free, and declining its offer costs nothing. Per-analysis prices are published, and a revised scope or price always needs your approval before it is charged.
Not seeing your use case here?Create an account for assessment