code-obfuscation-deobfuscation
Master techniques for analyzing and defeating code obfuscation in protected binaries. Learn to identify junk code, opaque predicates, self-modifying code, control flow flattening, movfuscator, VM protectors like VMProtect and Themida, string encryption, and import hiding. Covers both static analysis patterns and dynamic deobfuscation strategies using symbolic execution, emulation, and trace-based recovery.
Code Obfuscation & Deobfuscation identifies and defeats protection techniques like control flow flattening, VM protectors, and string encryption in native binaries.
AI-generated summary based on this skill's SKILL.md
Install
yaklang/hack-skills/code-obfuscation-deobfuscation · repository language: CSS
git clone https://github.com/yaklang/hack-skills
cp -r hack-skills/skills/code-obfuscation-deobfuscation ~/.claude/skills/code-obfuscation-deobfuscationnpx skillfed install yaklang/hack-skills/code-obfuscation-deobfuscationFrequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
How to reverse obfuscated code using code-obfuscation-deobfuscation?
code-obfuscation-deobfuscation teaches you to identify and remove obfuscation layers from protected binaries through both static and dynamic analysis. You'll learn to recognize junk code, opaque predicates, self-modifying code, and control flow flattening patterns, then apply symbolic execution, emulation, and trace-based recovery to restore original logic and control flow.
What deobfuscation techniques does code-obfuscation-deobfuscation cover?
code-obfuscation-deobfuscation covers deobfuscation techniques including control flow flattening removal, VM-protected code devirtualization (VMProtect, Themida), string encryption decryption, movfuscator demovfuscation, opaque predicate solving via symbolic execution, self-modifying code unpacking, anti-disassembly trick removal, and import hiding resolution.
Can code-obfuscation-deobfuscation help automate malware analysis?
Yes. code-obfuscation-deobfuscation automates deobfuscation using symbolic execution and emulation to unpack encrypted, self-modifying code and recover original control flow. It covers dynamic unpacking via breakpoint dumping, Z3 solver integration for opaque predicate proving, and trace-based analysis—essential for malware string decryption and behavior extraction.
Which tools and frameworks does code-obfuscation-deobfuscation integrate with?
code-obfuscation-deobfuscation integrates with IDA Pro, Ghidra, angr symbolic execution engine, Z3 solver, and specialized plugins like D-810 for deflattening. It covers IDA scripting for obfuscation analysis, dynamic breakpoint dumping techniques, and trace-based recovery methods applicable to CTF challenges and binary deprotection.
What VM protectors can code-obfuscation-deobfuscation help defeat?
code-obfuscation-deobfuscation teaches reverse engineering of VM-protected and virtualized code, with specific focus on VMProtect and Themida devirtualization. You'll learn to analyze VM bytecode, recover original control flow, and apply symbolic execution to extract meaningful logic from virtualized binaries.
Is code-obfuscation-deobfuscation suitable for CTF and security research?
Yes. code-obfuscation-deobfuscation is designed for binary deprotection, CTF challenges, and malware analysis. Under MIT license, it provides comprehensive coverage of defeating code obfuscation protectors through static pattern recognition, dynamic unpacking, symbolic execution, and automated deobfuscation strategies.
SKILL.md
rendered from the published skill — quoted content, verbatim
SKILL: Code Obfuscation & Deobfuscation — Expert Analysis Playbook
> AI LOAD INSTRUCTION: Expert techniques for identifying, classifying, and defeating code obfuscation in native binaries. Covers junk code, opaque predicates, SMC, control flow flattening, movfuscator, VM protectors (VMProtect/Themida/Code Virtualizer), string encryption, import hiding, and anti-disassembly tricks. Base models often conflate packing with obfuscation and miss the distinction between static and dynamic deobfuscation strategies.
0. RELATED ROUTING
- anti-debugging-techniques when the obfuscated binary also has anti-debug layers
- symbolic-execution-tools when using angr/Z3 for automated deobfuscation
- vm-and-bytecode-reverse for deep VM protector bytecode analysis
Quick identification picks
|
(truncated - see the full file via the links below)
Read as markdown · JSON record · Browse the source repository
File tree — 1 file
skills/code-obfuscation-deobfuscation/SKILL.md