Skip to content

Back to the catalog

YuroGod/VMPStaticUnpacker
github.comrepo

YuroGod/VMPStaticUnpacker

VMPStaticUnpacker is a Python tool that statically unpacks VMProtect-protected Windows PE binaries without executing them, supporting both the legacy plaintext PACKER_INFO metadata format and the compact rotating-XOR format seen in VMProtect 3.9.5 PE32+ samples. It recovers the destination key by XORing the encoded destination with the first packed section's RVA and rolling the key with ROL32(key,7), then validates candidate tables and LZMA streams before rebuilding a memory-image PE for static analysis. It does not devirtualize protected code, recover the original entry point, strip the VMProtect runtime, or fix imports.

TL;DR A Python static unpacker that recovers VMProtect-encoded PE sections (legacy and 3.9.5 rotating-XOR formats) for further static analysis, without devirtualization.
Open original ↗
Document

What it is

VMPStaticUnpacker is a Python script that unpacks VMProtect-protected Windows PE files without running them. It handles the legacy plaintext PACKER_INFO metadata and the compact rotating-XOR format seen in VMProtect 3.9.5 PE32+ samples. The page says the legacy approach was inspired by oureveryday/VMPUnpacker.

How it works

The page gives the destination decoding exactly. The first key comes from the first packed section's RVA, and each later key is the previous one rotated left by 7 bits:

key[0] = encoded_destination[0] XOR first_packed_section_rva
destination[i] = encoded_destination[i] XOR key[i]
key[i + 1] = ROL32(key[i], 7)

Each candidate table and LZMA stream is validated before the PE is rebuilt. The output uses a memory-image layout, not a file-aligned one.

What to do

Run it with the packed file and an output path:

python vmpstaticunpacker.py packed.exe unpacked.exe

Treat the output as input for static analysis, for example loading it in a disassembler. The memory-image layout means it is not a runnable replacement for the original binary.

Caveats

The page states that the tool does not devirtualize protected functions, recover the original entry point, remove the VMProtect runtime, or repair imports. The compact format is confirmed only for VMProtect 3.9.5 PE32+ samples. The page names no other versions, and it gives no sample set, test results or license.

Technologies named here

Techniques named here

  • VMProtect packing/metadata unpacking

Related in Malware & RE