Devirtualizing Agile.NET VM Protection

[dawwinci]

Hey everyone,

I’ve just open-sourced a devirtualizer for Agile.NET’s VM-based method protection.

The tool analyzes the AgileDotNet.VMRuntime.dll shipped alongside a protected assembly, reconstructs the opcode mapping and handler semantics directly from the runtime, and then converts virtualized methods back into real, executable CIL.

There are no hardcoded opcode tables or version-specific mappings — the devirtualizer derives the required information from the VM runtime itself.

I’ve tested it against multiple Agile.NET builds and VM layouts, with the reconstructed methods validated using PEVerify and runtime comparison against known-source outputs.

GitHub:
https://github.com/dawwinci/agile-net-devirtualizer

Feedback, contributions, and testing against other Agile.NET versions/builds are very welcome.