> For the complete documentation index, see [llms.txt](https://devirt.gitbook.io/devirt/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://devirt.gitbook.io/devirt/faq.md).

# FAQ

Frequently asked questions about Devirt: what binary devirtualization is, which files Devirt analyzes, what it returns and how uploaded files are handled.

<details>

<summary>What is Devirt?</summary>

Devirt (devirt.re) is a binary devirtualization and reverse engineering service for security researchers and malware analysts. It recovers the logic hidden by VMProtect, Themida and Code Virtualizer and reports, function by function, which parts of that logic are proven.

</details>

<details>

<summary>What does binary devirtualization mean?</summary>

A VM-based protector rewrites parts of a program as bytecode for its own interpreter, which leaves disassemblers and decompilers showing the interpreter rather than the program's logic. Binary devirtualization is the work of recovering that logic and expressing it again as native-shaped functions that an analyst can read.

</details>

<details>

<summary>Is Devirt related to compiler devirtualization?</summary>

No. Devirt (devirt.re) is not related to compiler devirtualization, the C++ optimization in GCC and LLVM that replaces virtual function calls with direct calls.

</details>

<details>

<summary>Will I get the original source code back?</summary>

No. A delivery contains logic you can inspect; the original source code is not part of it. Verification covers the declared scope and inputs, not every behavior the program could exhibit.

</details>

<details>

<summary>Which files does Devirt accept?</summary>

Protected or unprotected PE, ELF and Mach-O binaries of up to 500 MiB, provided the customer owns the software or is authorized to examine it. Eligibility is checked against the exact build.

</details>

<details>

<summary>How are uploaded files handled?</summary>

Each file is processed on its own, customer files are never used for model training, and input files are removed once the result is delivered.

</details>

<details>

<summary>What does it cost?</summary>

Current prices are listed on [devirt.re/pricing](https://devirt.re/pricing). Starting is free: the browser check and Community Triage cost nothing, and complex files receive a free feasibility assessment and a written quote before any paid work.

</details>