VMProtect / VMP2 / Themida Workflow
Use this for VMProtect 2, VMP2 tooling questions, Themida, CodeVirtualizer,
and other VM-based protectors. Do not promise automatic devirtualization.
Most wins come from disciplined recovery of VM control-flow facts.
Source Guidance
Back Engineering Labs' public VMP2/Themida work points to one durable rule:
Avoid brittle VM-handler pattern matching. Handler layouts, opcode tables,
and dispatch glue change too easily. Prefer incremental lifting and control-flow recovery with as little VM-specific logic as possible.
Loop
bin_identify and bin_packer first; record format, arch, entropy, and
protector strings.- Use
bin_r2_script or Ghidra to locate VMEnter stubs, handler-table
references, VM context/virtual stack sections, and suspicious indirect
dispatch loops.
- Recover VIP movement. For VMProtect 2, track bytecode/module loads feeding
the indirect jump. For Themida, expect branch state in VM context and trace
the branch-taken flag through the VPC update.
- Classify VMEXIT behavior: return to native epilog, call-shaped exit, or
unsupported-instruction exit. Record stack displacement evidence.
- Prefer trace/lift plans that run simple optimizations to convergence:
constant promotion over VM-private ranges, constant folding, instruction
combination, branch folding, dead-store/dead-dependency cleanup, and stack
pointer rewrite.
- If using VMP2-style tooling, treat
vmemu/vmprofiler/vmprofiler-cli
outputs as evidence, not ground truth. Re-check recovered paths in r2/Ghidra.
- Write findings with exact addresses, section names, vmenter candidates,
VMEXIT classification, VIP source, and unresolved symbolic branches.
Report Shape
- Protector: VMProtect / VMProtect 2 / Themida / CodeVirtualizer / unknown
- Entrypoints: candidate VMEnter addresses and why
- Dispatch: handler-table location, decrypt/transform clues, indirect jump path
- VIP: source load or Themida branch flag/VPC update evidence
- VMEXIT: stack displacement and native continuation/call target
- Recovery plan: trace, lift, or manual simplification; no fake devirt claims
1---2name: reverser-virtualized-protectors3description: VMProtect, VMP2, Themida, and CodeVirtualizer reversing workflow using Radare2/Ghidra facts and Back Engineering Labs research guidance.4---56# VMProtect / VMP2 / Themida Workflow78Use this for VMProtect 2, VMP2 tooling questions, Themida, CodeVirtualizer,9and other VM-based protectors. Do not promise automatic devirtualization.10Most wins come from disciplined recovery of VM control-flow facts.1112## Source Guidance1314Back Engineering Labs' public VMP2/Themida work points to one durable rule:15Avoid brittle VM-handler pattern matching. Handler layouts, opcode tables,16and dispatch glue change too easily. Prefer incremental lifting and control-flow recovery with as little VM-specific logic as possible.1718## Loop19201. `bin_identify` and `bin_packer` first; record format, arch, entropy, and21 protector strings.222. Use `bin_r2_script` or Ghidra to locate VMEnter stubs, handler-table23 references, VM context/virtual stack sections, and suspicious indirect24 dispatch loops.253. Recover VIP movement. For VMProtect 2, track bytecode/module loads feeding26 the indirect jump. For Themida, expect branch state in VM context and trace27 the branch-taken flag through the VPC update.284. Classify VMEXIT behavior: return to native epilog, call-shaped exit, or29 unsupported-instruction exit. Record stack displacement evidence.305. Prefer trace/lift plans that run simple optimizations to convergence:31 constant promotion over VM-private ranges, constant folding, instruction32 combination, branch folding, dead-store/dead-dependency cleanup, and stack33 pointer rewrite.346. If using VMP2-style tooling, treat `vmemu`/`vmprofiler`/`vmprofiler-cli`35 outputs as evidence, not ground truth. Re-check recovered paths in r2/Ghidra.367. Write findings with exact addresses, section names, vmenter candidates,37 VMEXIT classification, VIP source, and unresolved symbolic branches.3839## Report Shape4041- Protector: VMProtect / VMProtect 2 / Themida / CodeVirtualizer / unknown42- Entrypoints: candidate VMEnter addresses and why43- Dispatch: handler-table location, decrypt/transform clues, indirect jump path44- VIP: source load or Themida branch flag/VPC update evidence45- VMEXIT: stack displacement and native continuation/call target46- Recovery plan: trace, lift, or manual simplification; no fake devirt claims
purpleailab