code-obfuscation-deobfuscation
Master techniques for analyzing and defeating code obfuscation in protected binaries. Learn to identify junk code, opaque predicates, self-modifying code, control flow flattening, movfuscator, VM protectors like VMProtect and Themida, string encryption, and import hiding. Covers both static analysis patterns and dynamic deobfuscation strategies using symbolic execution, emulation, and trace-based recovery.
Code Obfuscation & Deobfuscation identifies and defeats protection techniques like control flow flattening, VM protectors, and string encryption in native binaries.
AI-generated summary based on this skill's SKILL.md
Decision gist · record as of 2026-06-16
Code Obfuscation & Deobfuscation identifies and defeats protection techniques like control flow flattening, VM protectors, and string encryption in native binaries. Master techniques for analyzing and defeating code obfuscation in protected binaries. Learn to identify junk code, opaque predicates, self-modifying code, control flow flattening, movfuscator, VM protectors like VMProtect and Themida, string encryption, and import hiding. Covers both static analysis patterns and dynamic deobfuscation strategies using symbolic execution, emulation, and trace-based recovery.
Use it when
- code-obfuscation-deobfuscation covers deobfuscation techniques including control flow flattening removal.
- Yes.
Verify before relying
Read SKILL.md below before installing (1 file). Open directory: indexed for reading, not audited.
Install
yaklang/hack-skills/code-obfuscation-deobfuscation · repository language: CSS
Open directory. Skills are indexed for reading, not audited. Review a skill's body before installing it.
Frequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
How to reverse obfuscated code using code-obfuscation-deobfuscation?
code-obfuscation-deobfuscation teaches you to identify and remove obfuscation layers from protected binaries through both static and dynamic analysis. You'll learn to recognize junk code, opaque predicates, self-modifying code, and control flow flattening patterns, then apply symbolic execution, emulation, and trace-based recovery to restore original logic and control flow.
What deobfuscation techniques does code-obfuscation-deobfuscation cover?
code-obfuscation-deobfuscation covers deobfuscation techniques including control flow flattening removal, VM-protected code devirtualization (VMProtect, Themida), string encryption decryption, movfuscator demovfuscation, opaque predicate solving via symbolic execution, self-modifying code unpacking, anti-disassembly trick removal, and import hiding resolution.
Can code-obfuscation-deobfuscation help automate malware analysis?
Yes. code-obfuscation-deobfuscation automates deobfuscation using symbolic execution and emulation to unpack encrypted, self-modifying code and recover original control flow. It covers dynamic unpacking via breakpoint dumping, Z3 solver integration for opaque predicate proving, and trace-based analysis—essential for malware string decryption and behavior extraction.
Which tools and frameworks does code-obfuscation-deobfuscation integrate with?
code-obfuscation-deobfuscation integrates with IDA Pro, Ghidra, angr symbolic execution engine, Z3 solver, and specialized plugins like D-810 for deflattening. It covers IDA scripting for obfuscation analysis, dynamic breakpoint dumping techniques, and trace-based recovery methods applicable to CTF challenges and binary deprotection.
What VM protectors can code-obfuscation-deobfuscation help defeat?
code-obfuscation-deobfuscation teaches reverse engineering of VM-protected and virtualized code, with specific focus on VMProtect and Themida devirtualization. You'll learn to analyze VM bytecode, recover original control flow, and apply symbolic execution to extract meaningful logic from virtualized binaries.
Is code-obfuscation-deobfuscation suitable for CTF and security research?
Yes. code-obfuscation-deobfuscation is designed for binary deprotection, CTF challenges, and malware analysis. Under MIT license, it provides comprehensive coverage of defeating code obfuscation protectors through static pattern recognition, dynamic unpacking, symbolic execution, and automated deobfuscation strategies.
SKILL.md
Rendered from the published skill. Quoted content, verbatim.
SKILL: Code Obfuscation & Deobfuscation — Expert Analysis Playbook
> AI LOAD INSTRUCTION: Expert techniques for identifying, classifying, and defeating code obfuscation in native binaries. Covers junk code, opaque predicates, SMC, control flow flattening, movfuscator, VM protectors (VMProtect/Themida/Code Virtualizer), string encryption, import hiding, and anti-disassembly tricks. Base models often conflate packing with obfuscation and miss the distinction between static and dynamic deobfuscation strategies.
0. RELATED ROUTING
- anti-debugging-techniques when the obfuscated binary also has anti-debug layers
- symbolic-execution-tools when using angr/Z3 for automated deobfuscation
- vm-and-bytecode-reverse for deep VM protector bytecode analysis
Quick identification picks
|
(truncated - see the full file via the links below)
File tree — 1 file
skills/code-obfuscation-deobfuscation/SKILL.md
Let your AI agent find skills like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 56,283 agent skills by what they can do, searchable in plain language.
wish › “Identify and remove obfuscation layers from protected binaries”
Give your agent the search over MCP, or paste the wish link into any chat. No install? Search from any chat →
Related skills
Master symbolic execution techniques to solve CTF challenges, recover keys, and bypass checks. Learn angr state initialization, constraint solving with Z3, function hooking patterns, and Unicorn Engine emulation for binary analysis and unpacking.
This skill teaches systematic techniques for analyzing custom virtual machines and bytecode interpreters found in CTF challenges and commercial protectors. Learn to identify dispatcher patterns, map opcodes to operations, extract bytecode programs, and write custom disassemblers to understand stack-based, register-based, and esoteric VM architectures. Includes methods for solving maze-style challenges embedded in VM implementations.
ctf-reverse equips you with techniques for analyzing compiled, obfuscated, packed, and virtualized targets in CTF competitions. It covers static analysis tools like GDB and Ghidra, dynamic approaches with Frida and angr, emulation frameworks, anti-analysis bypass strategies, and language-specific reversing for Python bytecode, WASM, Android, and compiled languages. Use this when understanding the target's behavior is the blocker before exploitation.
Reverse Engineering provides techniques and tools for static and dynamic analysis of compiled binaries, firmware, and protected code. Recover decompiled source, unpack obfuscated samples, bypass anti-debugging defenses, and extract vulnerability details through patch diffing and protocol inference.
This skill covers hands-on cryptanalysis of symmetric encryption vulnerabilities across block and stream ciphers. Learn to exploit CBC padding oracles and bit flipping attacks, detect and abuse ECB mode repetition, decrypt data byte-at-a-time, and break stream ciphers through key reuse and state recovery. Includes Python implementations and tool usage for authorized testing and CTF challenges.
Identify and solve classical ciphers encountered in CTF challenges through systematic analysis. The skill covers cipher identification via character set, frequency distribution, and index of coincidence, then applies targeted attacks for monoalphabetic substitution, Caesar/ROT variants, polyalphabetic ciphers like Vigenere, and transposition methods. Includes Kasiski examination for key-length recovery and known-plaintext techniques.
More skills sandbox-escape-techniques (MIT) · shellcode-dev (MIT) · ctf-malware (MIT) · edr-evasion (MIT) · ctf-crypto (Apache-2.0)