can1357/NoVmp

Health v2 · maintenance only

Adoption not part of the score

2185 stars · 352 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

NoVmp is a static devirtualizer that translates VMProtect x64 3.x-virtualized binaries into optimized VTIL intermediate code, optionally recompiling back to x64. It is an experimental proof-of-concept built on the VTIL-Core library.

Use cases

• devirtualize VMProtect-protected x64 binaries
• convert virtualized code into readable VTIL for reverse engineering
• remove VMProtect virtualization from an unpacked dump
• analyze specific virtualized routines by address
• undo VMProtect constant obfuscation

When to choose

• you need to statically analyze or deobfuscate binaries protected with VMProtect x64 3.0-3.5
• you work with VTIL-based binary analysis workflows
• you have an unpacked dump of the target binary

When to avoid

• you need to handle packed binaries without dumping them first
• you require the experimental x64 recompilation for production use
• the target binary has relocations stripped
• you need jump table support or fast optimization passes

Facets

cli-tool · maturity experimental

reverse-engineering compiler parser developer-tools security reverse-engineering developer-tools windows cpp cli devirtualization vmprotect vtil binary-analysis deobfuscation proof-of-concept

Member repositories

For agents

markdown · JSON · MCP: product_card(name="can1357/NoVmp")