What is this?
This is a Python tool that automatically unpacks Windows x64 binaries protected with VMProtect 3.x and rebuilds their import table (IAT), without needing a debugger or live memory dump.
This is a Python tool that automatically unpacks Windows x64 binaries protected with VMProtect 3.x and rebuilds their import table (IAT), without needing a debugger or live memory dump.Is this a library or a standalone script I run against a binary?It is a script-based CLI tool, not a library: you point it at a protected binary and it emulates VMProtect's own unpacker and syscalls using Unicorn, then dumps the restored process to disk.
It is a script-based CLI tool, not a library: you point it at a protected binary and it emulates VMProtect's own unpacker and syscalls using Unicorn, then dumps the restored process to disk.How do I unpack a binary with this?Run the main script against a VMProtect-packed executable to unpack it and fix imports in one pass, or run the separate import-fixup mode on a binary that's already been unpacked.
Run the main script against a VMProtect-packed executable to unpack it and fix imports in one pass, or run the separate import-fixup mode on a binary that's already been unpacked.What do I need installed before running it?It relies on the Unicorn emulation engine; for better speed you should also install Microsoft C++ Build Tools so a compiled C helper is used instead of the slower pure-Python hooks.
It relies on the Unicorn emulation engine; for better speed you should also install Microsoft C++ Build Tools so a compiled C helper is used instead of the slower pure-Python hooks.Does it handle any VMProtect binary, and what won't it do?It only targets Windows x64 binaries, tested against VMProtect 3.4, 3.9, and 3.10, it does not devirtualize virtualized code, and it won't automatically resolve external calls made from inside virtualized functions.
It only targets Windows x64 binaries, tested against VMProtect 3.4, 3.9, and 3.10, it does not devirtualize virtualized code, and it won't automatically resolve external calls made from inside virtualized functions.What is VMProtect and why does unpacking it matter?VMProtect is a commercial obfuscator/virtualizer for Windows binaries; unpacking it is a necessary first step before any devirtualization or further reverse-engineering pipeline can analyze the protected code.
VMProtect is a commercial obfuscator/virtualizer for Windows binaries; unpacking it is a necessary first step before any devirtualization or further reverse-engineering pipeline can analyze the protected code.How does it avoid attaching a debugger to the target?It maps the target binary into a simulated Windows process and emulates its syscalls and API calls with Unicorn, stopping once execution reaches the restored code, so no live debugger or memory dump is required.
It maps the target binary into a simulated Windows process and emulates its syscalls and API calls with Unicorn, stopping once execution reaches the restored code, so no live debugger or memory dump is required.What happens to the Import Address Table after unpacking?The IAT is rebuilt from data collected during emulation, recognized import stubs are patched, and exception tables are fixed before the restored process is dumped from memory to disk.
The IAT is rebuilt from data collected during emulation, recognized import stubs are patched, and exception tables are fixed before the restored process is dumped from memory to disk.Does it recover calls made from inside virtualized code?Yes, imports called from within virtualized functions are still recovered and added to the IAT, even though the virtualized code itself isn't devirtualized.
Yes, imports called from within virtualized functions are still recovered and added to the IAT, even though the virtualized code itself isn't devirtualized.What are similar projects?x64dbg, umium, GhidraMCP, awesome-reverse-engineering, hacker-roadmap, raptor, dsh-redteam-model, ablation
x64dbg, umium, GhidraMCP, awesome-reverse-engineering, hacker-roadmap, raptor, dsh-redteam-model, ablationWhich topics is it in?x86-64, malware, malware-analysis, binary-analysis, security-research, hacking-tool, hacking, reverse-engineering, cybersecurity, security-tools, command-line-tool, security
x86-64, malware, malware-analysis, binary-analysis, security-research, hacking-tool, hacking, reverse-engineering, cybersecurity, security-tools, command-line-tool, security