A custom C++ debugger that dynamically unpacks VMProtect-protected binaries, dumps in-memory decrypted code, and disassembles it using Capstone.
This tool leverages a custom Windows debugger to:
- Launch protected binaries in suspended mode
- Locate the real entry point (OEP) post-unpacking
- Set an
INT3breakpoint to capture unpacking - Dump memory of the real, unpacked executable
- Disassemble the code using Capstone engine
This project uses CMake (v3.16 or higher) and C++17. Capstone is required as an external dependency.
- Capstone Engine installed:
- Headers:
C:/Program Files/capstone/include - Libs:
C:/Program Files/capstone/lib
- Headers:
- CMake 3.16+
- Visual Studio (MSVC) or any C++17-compatible compiler
# Clone the repo
git clone https://github.com/sudha2323/vmprotectunpacker.git
cd vmprotectunpacker
# Configure with CMake
cmake -B build -S . -DCMAKE_BUILD_TYPE=Release
# Build
cmake --build build --config Release