Skip to content

chramiq/de4vmp

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

6 Commits
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

Description

a fully static devirtualizer for vmp, works for versions 3.4, and early 3.5

image

Usage

  1. if target has anti-tamper, dump it via ks-dumper (https://github.com/EquiFox/KsDumper)
  2. demutate with demutation (https://github.com/xlfj5211/DeMutation)
  3. clean with de4dot to allow pattern detection
  4. drag n drop into devirtualizer
  5. clean junk with de4dot

Common errors

  • if demutatiton fails, anti-tamper is probably still present
  • if devirtualizer fails, you are most likely trying to devirtualize unsupported version or the target file is corrupted

Disclaimer

  • I made it a long time ago, left no comments so don't ask me how it works, neither do I know
  • special thanks to @Washi1337 for answering my never ending stupid questions

Languages