NaC-L / Mergen

Deobfuscation via optimization with usage of LLVM IR and parsing assembly.

hseoa / ironshield-analysis

Static analysis of Ironshield anti-cheat

sexyiam / VMPLift

map and lift the VM handlers so you can read them in IDA/Ghidra made for vmp 3.8-3.10

dawwinci / agile-net-devirtualizer

Generic devirtualizer for Agile.NET (SecureTeam/CodeVeil) VM-based method protection — reconstructs CIL by reverse-engineering the runtime DLL structurally, no hardcoded per-build opcode tables.