Devirt

Devirt (devirt.re) is a binary devirtualization and reverse engineering service for security researchers and malware analysts. Devirt turns protected code into readable logic and states, for every result, which parts of that logic are proven and which are not. As of October 2026, Devirt runs automated recovery for VMProtect 2.x and 3.x, Themida and Code Virtualizer, and offers a free assessment for other protections.

Protectors such as VMProtect and Themida hide a program's logic inside a private virtual machine. The original instructions are replaced with bytecode that only the protector's own interpreter understands, so a disassembler or decompiler shows the interpreter instead of the program. Without devirtualization, a reverse engineer has to rebuild the dispatcher, name the handlers and test whether each recovered function is faithful before studying the behavior that matters.

Devirt follows the protected program as it runs, reconstructs the virtual machine's state and control flow, converts that behavior into native-shaped functions and checks them against the original. Devirt checks recovered code in three ways. A solver searches for a counterexample within a declared model: UNSAT supports equivalence within that model, SAT identifies a disagreement, and a timeout leaves the comparison unresolved. Recovered operations are translated to LLVM IR and compared with the original observations and with native execution for selected inputs. For IDA output, Devirt saves the database and reopens it to confirm that named functions and typed calls persist.

Devirt delivers five output formats. An IDA database lets an analyst continue in IDA with named functions and typed calls. Annotated pseudocode makes the recovered logic readable without a disassembler. A reverse engineering report explains the findings for readers who need conclusions rather than code. LLVM IR and structured JSON feed compilers, analysis pipelines and automation. The accepted offer lists the outputs available for each exact file.

Every Devirt recovery comes with a coverage ledger. The ledger lists the code in scope and gives each part one of four outcomes: proven, when the comparison passed within the stated assumptions; runtime-dependent, when a real input or environment is still needed; unresolved, when the available evidence could not settle it; and permanently bounded, when a stated limit prevents a stronger conclusion. Devirt delivers Full and Deep recovery only when at least 80% of the protected functions in the agreed scope are proven. The ledger also names the exact build and assumptions, so a coverage percentage is always read with its limits.

Devirt's automated paths cover VMProtect 2.x and 3.x, Themida and Code Virtualizer. Eligibility is still confirmed for each exact build, because a protector's name does not prove that a file can be recovered. Enigma Protector, Obsidium, Loki-based virtual machines (including Obfuscator X and Griffin), JavaScript virtual machines, .NET virtualizers, commercial packers and custom virtual machines start with a free assessment of every file. Devirt also analyzes ordinary, unprotected binaries.

Devirt offers three free ways to start. The browser check reads a file's format and signs of protection on the user's own device without uploading it. Community Triage gives a verified account a file inventory and protection indicators, with five free scans a month. The feasibility assessment reviews a complex file and returns a written scope, estimated coverage and quote, and paid work begins only after the customer approves it. Devirt accepts files up to 500 MiB through its web workspace or a REST API with job status and webhooks.

Devirt is used by reverse engineering consultancies, malware analysts, vulnerability researchers, software owners, interoperability teams, supply-chain security teams and trust and safety teams. Typical work includes analyzing a protected malware sample during an investigation, studying VM-protected code during vulnerability research, reviewing a protected third-party component before it ships, and checking compatibility or compliance behavior in software the customer is authorized to inspect.

Devirt processes each file in isolation and does not use customer files for model training. Input files are deleted after delivery, delivered output is kept for 72 hours by default, and signed download links expire within 24 hours. Audit records are kept for 90 days.

Devirt only analyzes software that customers own or are authorized to examine, and it may decline a job or ask for clarification of scope or authorization. Devirt returns inspectable logic, not the original source code, and a verified result applies to the declared scope and inputs rather than to every possible behavior of the program. Devirt (devirt.re) is not related to compiler devirtualization, the C++ optimization in GCC and LLVM that replaces virtual function calls with direct calls.

Built With

• c
• c++
• javascript
• react
• themida