IDA 6.8 plugin that devirtualizes Themida's FISH virtual machine (2.2.5.0-2.2.7.0), restoring native code from protected binaries for reverse engineering research.
A proof-of-concept devirtualization engine for Themida, written as part of my Master's Thesis.
The engine is written as a plugin for IDA 6.8, and only supports early versions of the FISH virtual machine architecture (2.2.5.0, 2.2.6.0, 2.2.7.0).
The source code is provided exclusively for educational purposes, and I take no responsibility for what you do with it.
My Master's Thesis is further included as a PDF, which you may read to better understand the subject and project.
The project has been developed using udis86 for disassembling, albeit with a few fixes.
