devirtualization 开源项目推荐（27 个）

can1357 /NoVmp

A static devirtualizer for VMProtect x64 3.x. powered by VTIL.

NaC-L /Mergen

Deobfuscation via optimization with usage of LLVM IR and parsing assembly.

wallds /NoVmpy

该项目在 GitHub 上没有填写描述

fjqisba /VmpHelper

an ida plugin used to decompile vmp

void-stack /VMAttack

Research on code virtualization in .NET [WIP]

notemrovsky /tiktok-reverse-engineering

逆向分析 TikTok 的 JavaScript 虚拟机——已映射 77 个操作码，字符串去混淆，字节码反汇编以及加密函数识别。教育用途的虚拟机分析工具包。

stuxnet147 /Themida-Research

Themida 3.x research

realasfngl /ChatGPT

My API wrapper for ChatGPT making it possible to use ChatGPT via API for free instead of paying for their API.

vtil-project /VTIL-BinaryNinja

Binary Ninja plugin for loading VTIL routines and lifting VTIL instructions to LLIL for analysis.

chramiq /de4vmp

vmp .net devirtualizer

sexyiam /VMPLift

map and lift the VM handlers so you can read them in IDA/Ghidra made for vmp 3.8-3.10

dawwinci /agile-net-devirtualizer

Generic devirtualizer for Agile.NET (SecureTeam/CodeVeil) VM-based method protection — reconstructs CIL by reverse-engineering the runtime DLL structurally, no hardcoded per-build opcode tables.

r3bb1t /vmp_analyzer

该项目在 GitHub 上没有填写描述

kyle-elliott /DVM

Symbolic Execution based on lifting amd64 to z3

wul7chaos /vmp-reverse-skill

Devirtualization pipeline for VMProtect-style binaries: dispatcher/handler slicing, two-generation P-code IR, LLM-context compression, Z3 equivalence verdicts

dawwinci /krypton-devirtualizer

Generic devirtualizer for .NET Reactor VM-based method protection — reconstructs CIL by reverse-engineering the runtime structurally, no hardcoded per-build opcode tables.

NoAddr /yaps

PUSHAN-style static devirtualizer for Tigress-like VM obfuscation, using VPC-sensitive CFG recovery over Ghidra SLEIGH p-code.

godfearingman /thresh

vmprotect devirtualiser

xqzme69 /Amice-Deobfuscator

Static LLVM IR devirtualizer and string decryptor for fuqiuluo/amice. Rust, C and C++. Zero execution.

Aetherx86 /VMP_DEVIRT

SMT symbolic execution and compiler-driven devirtualization suite targeting 64-bit VMProtect 3.x and Themida protected native binaries with clean LLVM IR lifting.