VMPStaticUnpacker

A static VMProtect unpacker for Windows PE files

It supports legacy plaintext PACKER_INFO metadata and the compact rotating-XOR format observed in VMProtect 3.9.5 PE32+ samples.

Usage

python vmpstaticunpacker.py packed.exe unpacked.exe

VMProtect 3.9.5

The initial destination key is recovered from the first packed section RVA:

key[0] = encoded_destination[0] XOR first_packed_section_rva
destination[i] = encoded_destination[i] XOR key[i]
key[i + 1] = ROL32(key[i], 7)

Each candidate table and LZMA stream is validated before rebuilding the PE.

Limitations

The output uses a memory-image layout for static analysis. This tool does not devirtualize protected functions, recover the original entry point, remove the VMProtect runtime, or repair imports

Credits

The legacy unpacking approach was inspired by oureveryday/VMPUnpacker.