Devirtualizing Agile.NET VM Protection
 

Hey everyone,

I’ve just open-sourced a devirtualizer for Agile.NET’s VM-based method protection.

The tool analyzes the AgileDotNet.VMRuntime.dll shipped alongside a protected assembly, reconstructs the opcode mapping and handler semantics directly from the runtime, and then converts virtualized methods back into real, executable CIL.

There are no hardcoded opcode tables or version-specific mappings — the devirtualizer derives the required information from the VM runtime itself.

I’ve tested it against multiple Agile.NET builds and VM layouts, with the reconstructed methods validated using PEVerify and runtime comparison against known-source outputs.

GitHub:
https://github.com/dawwinci/agile-net-devirtualizer

Feedback, contributions, and testing against other Agile.NET versions/builds are very welcome.

Hey everyone,

I’ve also put together a detailed article covering the Agile.NET devirtualization process and some of the technical work behind reversing its VM-based protection. If anyone is interested or thinks it might be useful for learning or research, feel free to take a look.

https://www.amariei.org/agile-net-devirtualizer.html

I hope you find it useful. Feedback is always welcome! 🙏