Devmp: A Virtual Instruction Extraction Method for Commercial Code Virtualization Obfuscators.

In code virtualization deobfuscation, extracting virtual instructions is a crucial first step for reverse-engineering programs protected by virtual machine obfuscation. This process is essential for uncovering concealed malicious code, yet existing methods face significant limitations, such as the inability to resolve virtual branch jumps and support multi-version of specified obfuscators, severely hindering their effectiveness. To address these challenges, we introduce a novel method for virtual instruction extraction based on dynamic binary instrumentation and symbolic execution. We implement this method in Devmp, a prototype system designed to extract virtual instructions and facilitate virtualization deobfuscation. Devmp dynamically generates instruction traces through binary instrumentation and performs offline analysis to partition handler sets based on virtual machine structures and jump rules. Then it employs symbolic execution to derive state expressions for semantic analysis of handlers and extracts virtual instructions with complete semantics. We evaluate Devmp on eight test programs protected by two versions of VMProtect. Experimental results demonstrate that Devmp outperforms state-of-the-art tools like VMP Analysis Plugin and NoVmpy, achieving a 28.49% increase in virtual instruction recognition rate by optimized virtual branch processing and accurately analyzing all extracted virtual instructions through enhanced cross-version applicability. These results indicate that Devmp not only improves the accuracy and completeness of virtual instruction extraction but also provides a robust and versatile solution for analyzing programs obfuscated by commercial code virtualization obfuscators.