2026
Static Devirtualization of Themida
Cross-post: devirtualizing CodeVirtualizer/Themida with guided symbolic evaluation, co-authored with IDontCode at Aftermath Labs.
Naci's blog
Reverse engineering, LLVM, and binary lifting. Sometimes slides.
Posts
5 entries
2025
When Dragons Fight Back: Logic Assisted Reversal Program (L.A.R.P.) and Super Learning Optimized Program (S.L.O.P.)
A closer look at VMDragonSlayer, its symbolic execution, and its approach to lifting control flow.
2025
Check out my presentations!
Slides on devirtualizing VMProtect with Mergen and using LLVM for deobfuscation.
2025
Lifting Binaries, Part 0.5: Recompiling for error detection for binaries without source code
Finding errors in binaries without source code through lifting, recompilation, and runtime sanitizers.
2025
Lifting Binaries, Part 0: Devirtualizing VMProtect and Themida: It's Just Flattening?
Using LLVM and compiler techniques to lift binaries and untangle VMProtect and Themida.