logoalt Hacker News

Static Devirtualization of Themida

20 points • by homarp • last Tuesday at 8:27 PM • 2 comments • view on HN

Comments

not_a9 • yesterday at 11:58 PM

They include a fun follow-up with a stronger obfuscator: https://www.youtube.com/watch?v=3LtwqJM3Qjg

homarp • last Tuesday at 8:27 PM

This article demonstrates devirtualization of CodeVirtualizer/Themida protected code, however the techniques described apply to pretty much every virtual machine based obfuscator.