duntss/ida-zvm-disassembler

IDA-ZVM-Disassembler is a plugin for IDA Pro, a professional tool security researchers use to read and analyze compiled binary programs. When malware authors want to make their code harder to analyze, they sometimes build a custom virtual machine, a mini interpreter with its own made-up instruction set, and compile their malicious logic into that private bytecode instead of normal machine code. Zeus VM is one such custom virtual machine found in the wild, and its bytecode cannot be read by standard disassembly tools. This plugin teaches IDA Pro how to read Zeus VM bytecode. It adds both a loader (which recognizes .zvm files when you open them) and a processor module (which translates the raw bytes into readable assembly-style instructions). Once installed, you open a .zvm file and IDA automatically decodes the format and presents the disassembly. The plugin handles 69 instructions covering arithmetic, bitwise operations, memory access, control flow, RC4 (an encryption algorithm), and shuffle operations. It also transparently decrypts XOR key chains that would otherwise obscure the analysis, adds cross-references between loop branches so you can trace execution flow, and auto-generates comments explaining what each instruction does. Registers are shown with size suffixes (.b for byte.w for word) matching the architecture's conventions. Installation involves copying two Python files into the appropriate folders inside your IDA Pro installation. The plugin is ported from an existing Binary Ninja plugin by OALabs and is written in Python.