0xnobody/vmpdump

Health v2 · maintenance only

Adoption not part of the score

1412 stars · 230 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

VMPDump is a dynamic dumper and import fixer for binaries protected with VMProtect 3.x (x64), built on the VTIL intermediate language. It scans a running process for VMProtect import stubs, lifts them to VTIL for analysis, and rewrites calls to a reconstructed import table.

Use cases

• dump a VMProtect-packed executable from a running process
• fix imports in a VMP-protected binary after unpacking
• produce a runnable dump of a VMProtect 3.x x64 module
• analyze obfuscated import stubs in malware samples
• rebuild an import address table for a dumped PE

When to choose

• you need to unpack VMProtect 3.x x64 binaries dynamically
• you want automated import stub resolution and IAT rebuilding for VMP dumps
• you prefer a VTIL-based analysis pipeline over manual stub patching

When to avoid

• the target uses VMProtect versions other than 3.x or 32-bit binaries
• you need a static unpacker that works without running the target process
• you require heavily mutated code sections to be fully resolved, since linear scanning can miss stubs

Facets

cli-tool · maturity maintenance

reverse-engineering security developer-tools security reverse-engineering windows windows cli cpp vmprotect unpacking import-fixing binary-analysis vtil malware-analysis

Member repositories

For agents

markdown · JSON · MCP: product_card(name="0xnobody/vmpdump")