The project's README from github.com/x86rc/vmp-lazy-unpack. As one markdown file: README.md.
An emulation-based unpacker and import resolver for Windows x64 VMProtect 3.x binaries.
The project started as a script used to unpack VMProtect 3 in our devirtualization pipeline. It does this without the need to attach a debugger or dump live.
The project uses Unicorn to emulate syscalls used by VMProtect's unpacker and import resolver.
py -m pip install -e .
For decent speeds its recommended to install Microsoft C++ Build Tools so the C helper is used. If not installed the unpacking falls back to purely python based hooks (slower).
For normal unpacking + import fixups run:
py -m unpack "C:\path\file.exe"
To fix imports on an already unpacked bin:
py -m unpack "C:\path\file.bin" --imports_only