A static VMProtect unpacker for Windows PE files
It supports legacy plaintext PACKER_INFO metadata and the compact
rotating-XOR format observed in VMProtect 3.9.5 PE32+ samples.
python vmpstaticunpacker.py packed.exe unpacked.exeThe initial destination key is recovered from the first packed section RVA:
key[0] = encoded_destination[0] XOR first_packed_section_rva
destination[i] = encoded_destination[i] XOR key[i]
key[i + 1] = ROL32(key[i], 7)
Each candidate table and LZMA stream is validated before rebuilding the PE.
The output uses a memory-image layout for static analysis. This tool does not devirtualize protected functions, recover the original entry point, remove the VMProtect runtime, or repair imports
The legacy unpacking approach was inspired by oureveryday/VMPUnpacker.
