De-obfuscating VMP 3.5 virtualization, working through the VM's handlers and dispatch loop to recover code protected by the older protector, with the result and caveats spelled out.
Static unpacking for VMProtect 3.9.5, reversing the rotating-XOR decryption layer to recover the protected binary without ever running it, for anyone reversing similar targets.
A general approach to defeating VMProtect-style code virtualization: JIT tracing, equivalence rewriting, and handler matching, with the commands and code included.
Manually de-virtualizing a VMProtect 3.9.4 cmp-jne handler sequence, tracing the handlers to recover the original comparison logic, with a full walkthrough of the technique.
VMProtect 3.8.1 obfuscation strategies, cataloging the transformation techniques it applies to protected code and how each complicates analysis, and the gotchas flagged along the way.
Building an open-source ARM64 VMP from scratch, virtualizing all 121 A64 base instructions to create a custom VM-based protector, so you can reproduce it yourself.
Deobfuscating VMProtect 3.9.4 with symbolic execution, using symbolic analysis to strip the VM's obfuscation and recover the original logic, with the commands and code included.
Fixing the VMProtect 3.5.1 Win32 runtime compilation issue, a troubleshooting walkthrough for a protected binary that won't compile, with the analysis method shown end to end.
Analyzing VMProtect 3.9.4's virtual machine flow, tracing the dispatch loop and handler set that drive its newest VM architecture and opcode mapping, so you can reproduce it yourself.
Analyzing VMProtect 3.0.0 beta's virtual machine handler chaining, tracing how its handlers link together to interpret protected code at runtime, with the tools and offsets documented.
Analyzing VMProtect 2.12.3's virtual machine handler flow, mapping how its handlers chain together to interpret and execute virtualized code, including the pitfalls and the fix.
Replacing the HWID in VMProtect 3.8.4, patching the machine-binding check inside the VM so a protected binary runs on different hardware, so you can reproduce it yourself.
VMProtect 1.81 under the hood: dissecting its VM structure and de-virtualization, mapping the handlers to reconstruct the original native code, and the mechanism explained clearly.
Breaking VMProtect's local license lock by reversing its RSA and big-number encryption, then building a fully working offline keygen from the recovered math.