A devirtualization engine for Themida.
☆107Mar 2, 2024Updated 2 years ago
Alternatives and similar repositories for TDE
Users that are interested in TDE are comparing it to the libraries listed below
Sorting:
- unorthodox approach to analyze a trace, but this helped me get comfy with x64 instructions overall (excluding sse/avx/etc lol), cleared u…☆68Feb 7, 2024Updated 2 years ago
- Deobfuscation via optimization with usage of LLVM IR and parsing assembly.☆776Updated this week
- Static deobfuscator for Themida, WinLicense and Code Virtualizer 3.x's mutation-based obfuscation.☆331Jul 29, 2024Updated last year
- Native code virtualizer for x64 binaries☆519Dec 20, 2024Updated last year
- Kernel ReClassEx☆68Nov 21, 2023Updated 2 years ago
- MBA deobfuscator via Program Synthesis and Term Rewriting☆57Oct 13, 2025Updated 4 months ago
- devirtualization vmprotect☆65Mar 11, 2023Updated 2 years ago
- Exemplary LLVM function pass implementing Control Flow Flattening.☆17May 2, 2018Updated 7 years ago
- Code Deobfuscator x86_32/64☆52Aug 16, 2022Updated 3 years ago
- Kernel driver for detecting Intel VT-x hypervisors.☆197Jul 11, 2023Updated 2 years ago
- Deobfuscation of Semi-Linear Mixed Boolean-Arithmetic Expressions☆81Jan 24, 2026Updated last month
- Hooking Windows' exception dispatcher to protect process's PML4☆227Jan 24, 2025Updated last year
- Titan is a VMProtect devirtualizer☆120Mar 6, 2024Updated 2 years ago
- Using Microsoft Warbird to automatically unpack and execute encrypted shellcode in ClipSp.sys without triggering PatchGuard☆269Aug 31, 2022Updated 3 years ago
- A repository of IDA Databases and Binaries used for the analysis of popular commercial virtual-machine obfuscators☆72Oct 7, 2022Updated 3 years ago
- A Binary Ninja plugin to detect Themida, WinLicense and Code Virtualizer's obfuscated code locations.☆92Jul 28, 2024Updated last year
- Minimalistic AMD-V/SVM hypervisor with memory introspection capabilities☆376Feb 26, 2025Updated last year
- ☆66Apr 12, 2023Updated 2 years ago
- Me fockin' pe protector☆45Nov 19, 2022Updated 3 years ago
- ☆47Jul 7, 2024Updated last year
- x86-64 code/pe virtualizer☆206Dec 2, 2024Updated last year
- page table manipulation to gain physical r/w☆44May 7, 2024Updated last year
- Converted phnt (Native API header files from the System Informer project) to IDA TIL, IDC (Hex-Rays).☆163Aug 23, 2024Updated last year
- VMProtect 2.x-3.x x64 Import Deobfuscator☆429Oct 22, 2025Updated 4 months ago
- A simple x86_64 AMD-v hypervisor type-2 Programmed with C++, with soon to be added syscall hooks. [W.I.P]☆104Aug 3, 2023Updated 2 years ago
- protector & obfuscator & code virtualizer☆686Updated this week
- kernel mode anti cheat☆642Aug 4, 2024Updated last year
- Detour library (x64 and x86 compatible)☆13Dec 15, 2020Updated 5 years ago
- PE (and elf now!) bin2bin obfuscator☆823Oct 11, 2025Updated 4 months ago
- Kernel-mode Paravirtualization in Ring 2, LLVM based linker, and some other things!☆408Apr 19, 2025Updated 10 months ago
- A simple pluggable tool to convert an unrolled TritonAST to LLVM-IR, optimize it and get back to TritonAST.☆39Apr 3, 2020Updated 5 years ago
- VMProtect, VMP, Devirter, 3,5☆112Jan 30, 2023Updated 3 years ago
- This is the PoC of a dynamic lifter and deobfuscator with collecting trace.☆37Oct 11, 2023Updated 2 years ago
- AMx64 is a simulated 64-bit environment that can interpret nasm-like asm code. It allows a usage of different 64-bit registers and 64-bit…☆21Dec 22, 2023Updated 2 years ago
- Universal x86/x64 VMProtect 2.0-3.X Import fixer☆21Dec 29, 2021Updated 4 years ago
- Efficient general mixed boolean-arithmetic (MBA) simplifier☆124Mar 1, 2026Updated last week
- A basic implementation of Patch Guard that I implemented, that includes integrity checks and other protection mechanisms I added.☆78Mar 29, 2025Updated 11 months ago
- Hex-Rays microcode plugin for automated simplification of Windows Kernel decompilation.☆657Jan 28, 2025Updated last year
- ☆22Mar 23, 2016Updated 9 years ago