VMPHide

VMPHide is a small reverse engineering utility aimed at software protected by VMProtect, a commercial code obfuscation and anti-tamper tool. It works around the checks VMProtect uses to detect whether its protected program is being debugged or is running inside a virtual machine, which is a common step for security researchers analyzing protected binaries. The project ships as three pieces: a Windows driver, a plugin for the popular x64dbg debugger, and a command line tool, so it can be used depending on how someone prefers to work.

On the anti-debug side, the README lists the specific detection methods it defeats. These include checks against a process's PEB structure, such as the BeingDebugged flag and the process heap flags, along with several Windows system calls that a debugged process would otherwise expose, like NtQueryInformationProcess calls that reveal a debug port or debug object handle. It also handles a trick involving closing an invalid handle, which crashes a program only if a debugger is attached, and covers the ThreadHideFromDebugger flag that Windows lets a program set to hide a thread from debugging tools.

On the anti-VM side, it addresses a CPUID based check, which normally involves changing a virtual machine's configuration file, and a system information query that can reveal firmware details pointing to a virtual machine. The README gives one concrete usage example for the anti-VM case, showing that setting a specific hypervisor CPUID flag to false in a VMware .vmx configuration file is part of how the anti-VM bypass is used.

The README is brief and does not describe installation steps, build instructions, or a license, beyond listing the included components and the detection methods it targets.