Top AI Repos — open-source AI, indexed and scored
Top AI Repos tracks AI repositories on GitHub and answers two different questions about each one: is it moving right now, and would you bet a product on it.
Top AI Repos tracks AI repositories on GitHub and answers two different questions about each one: is it moving right now, and would you bet a product on it.
Automated multi-engine framework for unpacking, analyzing, and devirtualizing binaries protected by commercial and custom Virtual Machine based protectors. Combines Dynamic Taint Tracking, Symbolic Execution, Pattern & Semantic Classification, and Machine Learning–driven prioritization to dramatically reduce manual reverse engineering time.
| Date | Stars |
|---|---|
| 2026-07-31 | 431 |
| 2026-08-05 | 431 |
| 2026-08-06 | 432 |
Today
+1 stars today
This week
— stars this week
This month
— stars this month
Momentum
0.0
growth rate 0.00%/day
# VMDragonSlayer
**Project will be public by mid-October Refactoring In Progress**
**Advanced Virtual Machine Detection and Analysis Framework**
VMDragonSlayer is a comprehensive framework for analyzing binaries protected by Virtual Machine (VM) based protectors such as VMProtect 2.x/3.x, Themida, and custom malware VMs. The framework combines multiple analysis engines including Dynamic Taint Tracking (DTT), Symbolic Execution (SE), Pattern Classification, and Machine Learning to automate the reverse engineering process.
> **Goal**: Transform complex protected binary analysis from weeks/months of manual work into structured, automated analysis with explainable results.
## Key Features
- **Multi-Engine Analysis**: Combines static, dynamic, and hybrid analysis techniques
- **VM Detection**: Automated detection of commercial and custom VM protectors
- **Plugin Ecosystem**: Integrations with Ghidra, IDA Pro, and Binary Ninja
- **Machine Learning**: Proof-of-concept ML models for pattern classification
- **Extensible Architecture**: Modular design for custom analysis workflows
- **Research Framework**: Built for malware research and reverse engineering education
---
## Core Capabilities
| Domain | Engine / Module | Highlights |
|--------|-----------------|-----------|
| VM Discovery | `analysis.vm_discovery` | Dispatcher & handler table identification, nested VM heuristics |
| Pattern Analysis | `analysis.pattern_analysis` | Rule-based + similarity + ML (hybrid auto-selection) |
| Taint Tracking | `analysis.taint_tracking` | Intel Pin–driven byte-level taint, handler discovery, flow confidence |
| Symbolic Execution | `analysis.symbolic_execution.executor` | PathPrioritizer ML-weighted exploration, constraint & state tracking |
| Hybrid Orchestration | (Python core) | Sequential / parallel / adaptive workflows (Ghidra report indicates implemented) |
| Synthetic Data | `data/training/synthetic_sample_generator.py` | Obfuscation mutation, multi-architecture sample generation |
| Pattern DB | `data/patterns/` | JSON + enhanced DB + SQLite-backed runtime patterns |
| Ghidra Plugin | `plugins/ghidra/` | In-progress UI integration (several templates missing) |
| Schemas / Validation | `data/schemas/` | JSON schema–validated analysis output & pattern formats |
---
## Architecture Overview
VMDragonSlayer uses a modular architecture where multiple analysis engines work together:
```mermaid
graph TD
A[VM Discovery Engine] --> B[Pattern/ML Classifier]
B --> C[Symbolic Execution Engine]
B --> D[Dynamic Taint Tracker]
D --> C
subgraph DataSources ["Data Sources"]
E[Pattern Database]
F[ML Models - PoC]
end
subgraph Coordination
G[Orchestrator - Workflow Management & Coordination]
end
E --> B
F --> B
A --> G
B --> G
C --> G
D --> G
E --> G
F --> G
G --> H[REST API Server]
G --> I[Plugins - RE Tools]
```
### Core Analysis Engines
#### 1. **VM Discovery Engine** (`dragonslayer.analysis.vm_discovery`)
- **Purpose**: Detect and classify VM-based protection schemes
- **Techniques**: Dispatcher loop detection, handler table analysis, control flow heuristics
- **Targets**: VMProtect, Themida, custom malware VMs, nested protection
#### 2. **Dynamic Taint Tracking** (`dragonslayer.analysis.taint_tracking`)
- **Purpose**: Track data flow through VM execution to identify critical paths
- **Implementation**: Intel Pin-based instrumentation with byte-level precision
- **Features**: Shadow memory, anti-analysis evasion, automated handler discovery
#### 3. **Pattern Analysis** (`dragonslayer.analysis.pattern_analysis`)
- **Purpose**: Classify and categorize VM patterns and behaviors
- **Methods**: Rule-based matching, similarity analysis, ML classification
- **Database**: Extensible pattern database with JSON schemas
#### 4. **Symbolic Execution** (`dragonslayer.analysis.symbolic_execution`)
- **Purpose**: Explore VM execution paths symExcerpt of 15,272 characters
Read on GitHubWould you bet a product on this? Bounded 0–100 and slow moving.
matched fp:8896544766b1d3cf, llm:Description: 'Automated multi-engine framework for unpacking, analyzing, and devirtualizing binaries... Combines Dynamic Taint Tracking, Symbolic Execution, Pattern & Semantic Classification, and Machine Learning–driven prioritization to dramatically reduce manual reverse engineering time.' Language: Python. No topics.
matched fp:8896544766b1d3cf, llm:Description: 'Automated multi-engine framework for unpacking, analyzing, and devirtualizing binaries... Combines Dynamic Taint Tracking, Symbolic Execution, Pattern & Semantic Classification, and Machine Learning–driven prioritization to dramatically reduce manual reverse engineering time.' Language: Python. No topics.