> For the complete documentation index, see [llms.txt](https://devirt.gitbook.io/devirt/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://devirt.gitbook.io/devirt/devirt-knowledge-base.md).

# Devirt knowledge base

Devirt (devirt.re) is a binary devirtualization and reverse engineering service for security researchers and malware analysts. This knowledge base explains how it works, what it delivers and the terms

![Devirt: binary devirtualization for authorized analysis. A VM handler trace recovered into readable pseudocode (illustrative example).](https://raw.githubusercontent.com/Devirt-re/.github/main/profile/devirt-hero-light.svg)

Devirt (devirt.re) is a binary devirtualization and reverse engineering service for security researchers and malware analysts. Protectors such as VMProtect and Themida hide a program's logic inside a private virtual machine. Devirt follows the protected program as it runs, reconstructs the virtual machine's state and control flow, converts that behavior into native-shaped functions and checks them against the original. Customers choose the output they need: an IDA database, annotated pseudocode, a reverse engineering report, LLVM IR or structured JSON.

Use these pages to see how Devirt gets VM-protected code back into readable form, what a delivery contains and what each term in a coverage ledger means. Endpoints and API details live separately on [devirt.re/docs](https://devirt.re/docs).

## Quick facts

|                            |                                                                                                                                  |
| -------------------------- | -------------------------------------------------------------------------------------------------------------------------------- |
| Name                       | Devirt                                                                                                                           |
| Website                    | [devirt.re](https://devirt.re/)                                                                                                  |
| What it is                 | A binary devirtualization and reverse engineering service in cybersecurity                                                       |
| Recovered automatically    | VMProtect, Themida, Code Virtualizer                                                                                             |
| Assessed first, at no cost | Enigma Protector, Obsidium, Loki-based virtual machines, JavaScript virtual machines, .NET virtualizers, custom virtual machines |
| Deliverables               | IDA database · annotated pseudocode · reverse engineering report · LLVM IR · structured JSON                                     |
| Attached to every result   | A coverage ledger                                                                                                                |
| No-cost starting points    | Browser check · Community Triage · feasibility assessment                                                                        |
| Accepted files             | PE, ELF and Mach-O up to 500 MiB, uploaded in the web workspace or sent through the REST API                                     |

## Pages

* [How Devirt works](/devirt/how-devirt-works.md): the path from protected binary to checked functions
* [Services](/devirt/services.md): what each Devirt service covers, with links to the full pages
* [Supported protectors](/devirt/supported-protectors.md): automated protections and the ones that start with an assessment
* [Outputs and the coverage ledger](/devirt/outputs-and-the-coverage-ledger.md): five deliverables and four ledger outcomes
* [Use cases](/devirt/use-cases.md): the teams that send files to Devirt and why
* [Getting started](/devirt/getting-started.md): the no-cost ways in
* [Glossary](/devirt/glossary.md): devirtualization and reverse engineering vocabulary
* [Research](/devirt/research.md): where Devirt publishes its methods and results
* [FAQ](/devirt/faq.md): short answers to common questions

{% hint style="info" %}
Devirt accepts only software that the customer owns or is authorized to examine.
{% endhint %}

## Find Devirt elsewhere

[Website](https://devirt.re/) · [YouTube](https://www.youtube.com/@devirtre) · [GitHub](https://github.com/Devirt-re) · [Medium](https://medium.com/@devirt) · [DEV Community](https://dev.to/devirt) · [SourceForge](https://sourceforge.net/software/product/Devirt/) · [Devpost](https://devpost.com/software/devirt) · [Quora](https://www.quora.com/profile/Devirt) · [Gravatar](https://gravatar.com/devirtre) · [Notion](https://devirt.notion.site/Devirt-bc247eb0c77e83d2928b81c547846d64) · [Contact](https://devirt.re/contact)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://devirt.gitbook.io/devirt/devirt-knowledge-base.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.