Devirt is an automated devirtualization service for supply-chain security teams that have to know what a vendor's protected binary does before they deploy it. Software composition analysis lists a binary's components; Devirt recovers what the vendor's own protected code does and returns it as a full report, annotated pseudocode or an IDA database, with a coverage ledger of what was proven. A protection the automated path does not cover starts with a free assessment, and standard automated jobs have a 24-hour SLA.
Create an account first, then upload in your workspace. If your file needs manual review, we email a written quote before paid work begins. Declining the assessment offer costs nothing. Compare the price list for each family.
Software composition analysis identifies the open-source and third-party components in a binary and checks them for known vulnerabilities and license issues; its limitation is that it does not explain what a vendor's own code does. When a vendor protects that code with a virtualizing protector such as VMProtect or Themida, a decompiler shows the protector's interpreter instead of that code, so the behavior you are about to deploy stays unread.
Devirt recovers that behavior. The difference between the two jobs is set out under protected binary analysis, and ordinary compiled components go through software reverse engineering services.
Devirt delivers the output you select, together with the coverage ledger and a proof summary. In a third-party software risk review, each format serves a different reader.
| Format | What it contains | Use it to |
|---|---|---|
| Full RE report (.pdf) | Architecture, behavior, identity surfaces and an executive summary | Give the risk owner a decision document |
| Annotated pseudocode (.c) | Readable C with semantic naming and function-level commentary | Let engineers review what the vendor code does |
| IDA database (.i64) | Proven functions, named imports, typed API calls and the coverage ledger | Let a reverse engineer follow up on a finding |
| API JSON (.json) | Structured findings and coverage | Record the result in your risk or asset tooling |
Plans with version comparisons also report what changed in functions, behavior and proof coverage between two authorized versions of the same binary, so a vendor update can be checked against the version you reviewed. Compare the plans that include version comparisons.
Every Devirt result carries a coverage ledger, so a risk decision can rest on proven behavior and name what is still open. The ledger places every in-scope unit in one of four states: proven, runtime-dependent, unresolved or permanently bounded.
Behavior that depends on a real input or environment stays marked as runtime-dependent, and a unit the analysis could not settle stays in the count instead of being dropped. What the checks cover explains what counts as proof.
No. Software composition analysis tools produce component lists; Devirt recovers what a binary's own code does and returns it as an IDA database, annotated pseudocode, a full RE report, LLVM IR or API JSON. For a protected vendor binary, the two answer different questions.
Devirt processes each upload in an isolated environment, only for the analysis you requested. Uploads are not shared between customers or used for training, and input deletion begins once processing finishes and the output is available. Confidentiality terms, deletion certificates and exclusivity can be agreed in a separate signed engagement.
Start with a free assessment. The assessment explains what was observed and what is likely recoverable, and the written offer states the scope, estimated coverage and delivery window before any work is charged.
The assessment is free, and declining its offer costs nothing. Prices for each analysis are published, and a revised scope or price always needs your approval before it is charged.
Not seeing your use case here?Create an account for assessment