AwesomeREA.org

Tool

VTIL-Core

C++20 core of the VTIL (Virtual-machine Translation Intermediate Language) project, an intermediate language and optimizing compiler that the README describes as built for binary de-obfuscation and de-virtualization. Unlike LLVM IR, VTIL keeps the native stack, physical registers and non-SSA form, so code from register or stack machines can be lifted into it, native instructions can stay inline, and code can be emitted back at any virtual address. The library provides the IL with routines, basic blocks and serialization, a symbolic expression engine and simplifier, optimizer passes such as dead-code elimination, propagation and stack pinning, and Capstone/Keystone-based AMD64 and ARM64 disassembly and assembly helpers.

Requirements and limitations

  • No releases or tags; the README says the repository is incomplete because the initial release is not done, and further documentation is still to come. The reviewed master commit (2026-07-27) only edits the README; the preceding code commits date from 2026-04-04 and 2026-04-05. This entry pins it for documentation only.
  • Build with CMake 3.16+ and a C++20 compiler: generate a Visual Studio solution on Windows, or use Ninja on Linux and macOS, where Apple Silicon builds need -DCMAKE_OSX_ARCHITECTURES=x86_64. CMake fetches Capstone and Keystone at pinned commits, and CI builds on Windows Server 2022, Ubuntu 24.04 and macOS 14.
  • This is a library for analyzing virtualized or obfuscated code: the user supplies a lifter that translates the code under analysis into VTIL routines, which can then be optimized, inspected or re-emitted. The reviewed tree contains no lifter for a particular virtual machine or protector. Its Sample Routines folder holds 2020 .vtil test routines next to the small C test functions they correspond to, which commit messages describe as VMProtect tests; this entry covers analysis use only.
  • BSD-3-Clause license. The fetched dependencies keep their own licenses: Capstone's BSD-style license, and Keystone's GPL-2.0 with a FOSS license exception, which matters when distributing builds. No routines were lifted or optimized, and nothing was built.

About this entry

Type
Tool
Category
Binary analysis libraries
Relationship
Foundation tool
Targets
Binary

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Primary sources

  1. README.md GitHub · vtil-project/VTIL-Core · Revision 9ebee8e
  2. CMakeLists.txt GitHub · vtil-project/VTIL-Core · Revision 9ebee8e
  3. Docs/COMPILE.md GitHub · vtil-project/VTIL-Core · Revision 9ebee8e
  4. VTIL-Common/CMakeLists.txt GitHub · vtil-project/VTIL-Core · Revision 9ebee8e
  5. Dependencies/capstone/CMakeLists.txt GitHub · vtil-project/VTIL-Core · Revision 9ebee8e
  6. Dependencies/keystone/CMakeLists.txt GitHub · vtil-project/VTIL-Core · Revision 9ebee8e
  7. VTIL-Compiler/optimizer GitHub · vtil-project/VTIL-Core · Revision 9ebee8e
  8. Sample%20Routines GitHub · vtil-project/VTIL-Core · Revision 9ebee8e
  9. .github/workflows/build.yml GitHub · vtil-project/VTIL-Core · Revision 9ebee8e
  10. LICENSE.md GitHub · vtil-project/VTIL-Core · Revision 9ebee8e
  11. EXCEPTIONS-CLIENT GitHub · keystone-engine/keystone · Revision dc7932e