Reverse Engineering VMProtect 3.8.x – Rumored Source Leak?

[Cheetah]

Hi everyone,


I’ve been working on unpacking an executable protected with VMProtect (between versions 3.6.x and 3.8.1), and during my research I came across multiple mentions of a leaked source code for VMProtect 3.8.


In particular, I saw this comment from a respected member of the reversing community suggesting that the 3.8.1 source had leaked:

This link is hidden for visitors. Please Log in or register now.

So far, I’ve already checked the following sources:

• GitHub – Obfuscator-Collections/VMProtect (incomplete)
• GitHub – jmpoep/vmprotect-3.5.1 (more complete, but still an older version)
• Kanxue thread – which shares some early versions, but not the 3.8.x branch

Despite lots of digging, I haven’t been able to find anything that clearly contains the actual 3.8.1 source — especially the parts related to the newer VM handler structure or the ultra mutation logic.


So I’m wondering:
Has anyone here seen an actual leak or source dump for 3.8.x (even partial)?
Or is it just a rumor that never really materialized publicly?


Any pointers would be greatly appreciated.
Thank you in advance!

 

[dEEpEst]

In the conversation they talk about this

This link is hidden for visitors. Please Log in or register now.

but I think it's what I already sent you.

For 3.7 There is this

This link is hidden for visitors. Please Log in or register now.

I remember hearing something about a vmprotect leak but I'm not sure if it was 3.6 or 3.8

Maybe someone can shed some light

 

[Cheetah]

Hey, thank you so much for taking the time to share those links with me — I really appreciate your help


About the first one, I actually had a look and it seems to be based on VMProtect 3.5 — still useful, but not quite the more recent versions I was hoping for.


As for the second link (the VMUnprotect.Dumper tool), yeah, I know this one — it works well but only for .NET targets, unfortunately.


I remember hearing the same thing about a VMProtect leak too, possibly for 3.6 or even 3.8, but I haven’t been able to confirm anything solid yet either.


If anyone has more info or access to something related to 3.7 or newer, I’d be super interested. Again, really appreciate your effort!