sexyiam/VMPLift

What it is

VMPLift is a handler walker and VIP tracer for unpacked VMProtect 3.8 to 3.10+ x64 binaries. It is built on Unicorn emulation. The author argues that tools aimed at about VMProtect 3.5 (NoVmp is named) assume a stable dispatch model that no longer holds from 3.7 onward.

How it works

The page lists four changes in 3.8 to 3.10 that break older per-opcode maps:

• Merged handlers: one native chunk often performs several VM ops plus the next-handler computation.
• Rolling key: VIP immediates are encrypted. Decryption is enc ^ key, then a per-handler mix (add, neg, rol and others), then key ^= decrypted.
• Randomized registers and sections: VIP, VSP and the key sit in random GPRs, and sections are named like .kbB0 or .WhW0 instead of .vmp0.
• Unusual entries: many research samples use push enc; call enter_stub, sometimes through a .text jmp, so the PE entry point is not the vmenter.

The tool therefore starts from a real vmenter and records what Unicorn executes: VIP reads, VSP changes and ALU operations. If the target is a simple pure function (rcx, rdx to rax), it tries to synthesize a closed form in devirt_l4.c. Static mnemonic classification is only a fallback.

What to do

Commands from the page (Windows build output path):

build\Release\vmp-lift.exe scan ..\samples\adder.vmp.exe
build\Release\vmp-lift.exe lift ..\samples\adder.vmp.exe
build\Release\vmp-lift.exe lift ..\samples\WaveUIAuth_static_unpacked.dll --vmenter 0x18101da77

Use --vmenter <address> when the vmenter is known and the scan does not find it. Files written to the --out-dir directory:

• report.txt: quick summary
• lifted.ll and lifted.c: handler IR
• vip_trace.*: emulated bytecode stream
• devirt.vasm and devirt_native.c: peeled ops as stack-style C
• devirt_l4.c: closed form when probing succeeds (the adder sample becomes a+b)
• summary.json: counts and flags

Caveats

The input must already be unpacked. The closed-form output is only attempted for pure functions, so anything with side effects or memory dependence should be expected to yield only the trace and stack C. The page gives no build instructions, no success rates and no tested-version matrix. It credits the Recon 2024 VMP 3.8 talk, vxcall and r0da posts, and mzakocs samples as background.