Evidence at a glance
Loading source evidence…
What was done
This project provides a research-grade reconstruction of the PAFET crackme's four virtual machines. It includes a bytecode interpreter, native wrapper translations, and an autonomous Hex-VM executor. The original flag remains unrecovered.
The PAFET project is an independent reconstruction of a Windows x64 crackme by NIMA Nikjoo. The author reports that the executable utilizes four nested virtual machines, which the project studies through instruction-level translations and bytecode interpretation. The current research base includes an interpreter for the recovered User-VM program, translations of five selected User-VM wrappers, and an autonomous literal Hex-VM executor. Functional implementations for the Serial-VM and SHA-VM are also provided. The Hex-VM executor is a C++ state-machine translation of 58,662 unique native instructions, covering initialization, state mixing, and queue exceptions. The author notes that these components represent a reproducible research base rather than a complete devirtualization. The original flag has not been recovered. The project documentation is available at https://raw.githubusercontent.com/ajaniramon/pafet-crackme/HEAD/README.md. Co-authorship is credited to Claude Opus 4.7 and 5.5 for various stages of the reconstruction.
Reproduce it
Follow the build instructions provided in the repository README.md for the specific VM components. Use the provided Unicorn-based differential scripts to validate native instruction lockstep against the original PE.
Community
Ask a question, share what worked, or follow the next milestone.