Devirtualization for vulnerability researchers

Devirt is an automated devirtualization service for security and vulnerability researchers auditing protected software within an authorized scope, such as a bug bounty program's rules, a contract or the vendor's permission. Upload the binary, and Devirt returns the functions a protector virtualized as an IDA database or annotated pseudocode, with a coverage ledger that marks which ones were proven. Standard automated jobs have a 24-hour SLA.

Start an analysis Request a free assessment

Create an account first, then upload in your workspace. If your file needs manual review, we email a written quote before paid work begins. Upload a file of up to 500 MiB and see the scope and the total before you pay. Compare prices for a single protected file.

For authorized analysis · Updated 25 September 2026

Why does code virtualization get in the way of a security audit?

Code virtualization gets in the way of a security audit because a protector such as VMProtect or Themida rewrites the functions it covers as bytecode for its own virtual machine. A decompiler then shows the dispatcher and handlers of that virtual machine instead of the code under review, so the parsing, network and file-handling logic you need to audit stays unreadable.

Diagram: a virtualized function's VM entry, dispatcher, handlers, virtual context and VM exit, with the dispatcher selecting a handler for each instruction. — Code virtualization replaces a function with bytecode and an interpreter: the dispatcher fetches each virtual instruction and selects the handler that implements it, which is what a decompiler shows instead of the original logic. Illustration, not a measured result.

Devirt recovers those functions. The automated path covers VMProtect 2.x and 3.x and Themida and Code Virtualizer. Loki-based virtual machines require a separate free assessment for every binary, including Obfuscator X and Griffin. Enigma Protector and Obsidium files start with a free assessment, and code that is only packed or obfuscated goes through protected binary analysis.

What counts as an authorized scope?

An authorized scope is the written permission behind your research, such as a bug bounty or vulnerability disclosure program's rules, a contract with the software's owner or the vendor's own permission. Security and vulnerability research within an authorized scope is an accepted use under Devirt's acceptable use policy, and at signup and at every upload you attest to your authority to submit the binary.

Program rules differ and change, so check that the current rules cover the product and the kind of analysis you plan before you upload. Devirt does not give legal advice; for anything the rules do not settle, ask counsel or the vendor.

Devirt recovers and explains code for your audit. It does not develop exploits or test live systems, and the acceptable use policy prohibits unauthorized intrusion and deploying or improving malware.

What does a security researcher receive?

Devirt delivers the output you select, together with the coverage ledger and a proof summary. Each format fits a step in an audit.

Devirt output formats for security research
Format	What it contains	Use it to
IDA database (.i64)	Proven functions, named imports, typed API calls and the coverage ledger	Trace inputs through the recovered code in your own IDA setup
Annotated pseudocode (.c)	Readable C with semantic naming and function-level commentary	Review the recovered logic and quote it in a report
LLVM IR (.ll)	The lifted intermediate representation of the recovered code	Run your own analysis on the recovered semantics
Full RE report (.pdf)	Architecture, behavior, identity surfaces and an executive summary	Brief the vendor or the program owner
API JSON (.json)	Structured findings and coverage	Feed your own tooling

How does the evidence work?

Every Devirt result carries a coverage ledger, so a finding can point to recovered code that was checked, not only to code that decompiles. The ledger places every in-scope unit in one of four states: proven, runtime-dependent, unresolved or permanently bounded.

A proof holds within its declared model and scope. A function whose behavior depends on a real input or environment is marked runtime-dependent, which shows where a dynamic test still has to settle the question. How the proof stage works explains the three kinds of check.

Diagram: in-scope functions counted, then each placed in one of four states: proven, runtime-dependent, unresolved or permanently bounded. — Every in-scope function in a Devirt result ends in exactly one of four states, and the four states always add up to the functions counted. Illustration, not a measured result.

Questions vulnerability researchers ask

Is an unpublished finding kept confidential?

Devirt processes each upload in an isolated environment, only for the analysis you requested. Uploads are not shared between customers or used for training, and input deletion begins once processing finishes and the output is available. Released output is kept for 72 hours by default or 30 days on Team, the data-handling policy lists every retention period, and confidentiality terms can be agreed in a separate signed engagement.

Which protectors does Devirt cover?

The automated path covers VMProtect 2.x and 3.x and Themida and Code Virtualizer. Loki-based virtual machines require a separate free assessment for every binary, including Obfuscator X and Griffin. Files protected with Enigma Protector, Obsidium, a .NET virtualizer or a commercial packer start with a free assessment. Recognition is an intake decision, not a guarantee for every build, and custom behavior or several protection layers can require a separate assessment. The supported protectors list shows where each family starts.

How long does a job take?

Standard automated jobs have a 24-hour SLA from confirmed payment, and eligible jobs can run express with a one-hour SLA. An accepted novel engagement has a 72 to 168 hour delivery window after the deposit, with senior reverse-engineer validation before release.

What does it cost?

You see the scope and the total before you pay, and complexity never adds an automatic surcharge. Published prices and plans; custom work is quoted after assessment are published, and a revised scope or price always needs your approval before it is charged.