A tutorial walking through the process of devirtualising programmes protected by VMProtect 3 https://github.com/1111joe1111/tuts/tree/master/vm_protect_3 #vmprotect #reverse #ida #dukeBarman

VMProtect 2 - Detailed Analysis of the Virtual Machine Architecture

https://back.engineering/17/05/2021/

#reverse #vm #debug #vmprotect #antidebug #analysis #KosBeg

Tickling VMProtect with LLVM https://forum.reverse4you.org/t/tickling-vmprotect-with-llvm/16980 #reverse #vmprotect #llmv #tutorial #darw1n

An experimental dynamic approach to devirtualize pure functions protected by VMProtect 3.x

https://github.com/JonathanSalwan/VMProtect-devirtualization

#reverse #vmp #vmprotect #protection #obfuscation #deobfuscation #devirtualization #sloukixnx

Mergen converts Assembly code into LLVM IR, a process known as lifting. It leverages the LLVM optimization pipeline for code optimization and constructs control flow through pseudo-emulation of instructions. Unlike typical emulation, Mergen can handle unknown values, easing the detection of opaque branches and theoretically enabling exploration of multiple code branches.

These capabilities facilitate the deobfuscation and devirtualization of obfuscated or virtualized functions. Currently in early development, Mergen already shows promise in devirtualizing older versions of VMProtect, with ambitions to support most x86_64 instructions.

https://github.com/NaC-L/Mergen

#llvm #lifting #vmprotect #tnaci