YuroGod GitHub avatar

VMPStaticUnpacker

YuroGod

A static unpacker for VMProtect-protected Windows PE files, supporting legacy plaintext and VMProtect 3.9.5's rotating-XOR metadata.

Stars

24

7-day growth

No data

Forks

10

Open issues

0

License

No data

Last updated

2026-07-29

AI repository intelligence
FR-AI / ANALYSIS

Why it is worth attention

It provides a static, no-execution approach to unpacking VMProtect, including the newer rotating-XOR cipher, and validates data before rebuilding the PE.

Who it is for

  • Malware analysts
  • Reverse engineers
  • Security researchers
  • Developers dealing with packed binaries

Use cases

  • Unpacking VMProtect-packed samples for static analysis
  • Extracting original PE sections from protected files
  • Analyzing protected binaries without runtime execution
  • Recovering the unpacked memory image for further examination

Strengths

  • Supports both legacy plaintext and modern rotating-XOR encoded metadata
  • Validates candidate tables and LZMA stream before rebuilding
  • Simple command-line usage with minimal dependencies
  • Inspired by a proven unpacker (VMPUnpacker)

Considerations

  • Does not devirtualize protected functions or recover the original entry point
  • Does not remove VMProtect runtime or repair imports
  • Output is a memory-image layout suitable only for static analysis

README quick start

Usage

Description

Static VMProtect unpacker , supporting VMProtect 3.9.5 rotating-XOR metadata.

Related repositories

Similar projects matched by category, topics, and programming language.

lopopolo
Featured
lopopolo GitHub avatar

harness-engineering

Harness Engineering is a methodology for improving coding agent outputs by carefully crafting the environment around them—providing curated context, tools, and executable constraints that encode an organization’s nonfunctional requirements and cumulative lessons.

AI & Machine LearningAI Agents
2,390
slvDev
Featured
slvDev GitHub avatar

esp32-ai

A 28.9 million parameter language model runs on an $8 ESP32-S3 microcontroller entirely on-device, generating simple stories at about 9.5 tokens per second.

AI & Machine LearningLarge Language Models
1,960
littledivy
Featured
littledivy GitHub avatar

mimic

mimic captures traffic from any iOS or web app and automatically generates a Python client library that lets you call the app's API like a regular library.

AI & Machine Learning
1,482