skills.rest
3xecutablefile
3xecutablefileCOMMUNITY
Explore all skills by this author →
GitHub

code-obfuscation-deobfuscation

Recover readable logic and control flow from obfuscated native binaries.

Updated Aug 23, 2026
Search Tags:#reverse engineering#deobfuscation#symbolic execution#string encryption#control flow flattening#anti-disassembly#vm protection
One-click install
npx skills add https://github.com/3xecutablefile/opencode-rev-forensics --skill code-obfuscation-deobfuscation-3xecutablefile
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: code-obfuscation-deobfuscation
Source: https://github.com/3xecutablefile/opencode-rev-forensics/tree/main/skills/code-obfuscation-deobfuscation
Command: npx skills add https://github.com/3xecutablefile/opencode-rev-forensics --skill code-obfuscation-deobfuscation-3xecutablefile

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Code Obfuscation & Deobfuscation helps you quickly recover real program logic from binaries that hide behavior using junk code, opaque predicates, self-modifying code, control flow flattening, movfuscators, VM protectors, encrypted strings, import hiding, and anti-disassembly tricks.

Core Features & Use Cases

  • Deobfuscation playbook for common protection layers: Identify the obfuscation family by observable patterns in IDA/Ghidra, then apply the most effective static or dynamic recovery strategy.
  • Targeted techniques by obfuscation type: Remove dead junk code, prove/neutralize opaque predicates (including Z3-based proof), unpack SMC via breakpoints/emulation, and reverse control flow flattening with symbolic or trace-based deflattening.
  • VM protector and string/import recovery: Extract VM handler logic for VMProtect/Themida/Code Virtualizer-style protectors, decrypt strings by hooking/emulating decode routines, and resolve hidden imports via hash-based export lookups.
  • Anti-disassembly countermeasures: Correct misaligned/overlapping instructions and exception-based flow so the disassembler becomes trustworthy again.

Quick Start

Ask the skill to guide you through deobfuscating your specific binary by identifying the obfuscation type in IDA/Ghidra and proposing the shortest static-then-dynamic workflow to recover decrypted code and meaningful control flow.

Frequently Asked Questions about code-obfuscation-deobfuscation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I recover readable logic from a binary with control flow flattening?▼

Control flow flattening can be reversed using trace-based or symbolic deflattening techniques to reconstruct the original dispatcher logic into actionable control flow within disassemblers like IDA or Ghidra.

What's the best way to deobfuscate encrypted strings in native binaries?▼

Encrypted strings are deobfuscated by hooking or emulating the binary's decode routines, allowing you to extract the plaintext data without needing to manually reverse the decryption algorithm.

How do I bypass anti-disassembly artifacts like overlapping instructions?▼

Anti-disassembly artifacts are corrected by fixing misaligned or overlapping instructions and normalizing exception-based flow, which makes the disassembler output trustworthy for further static analysis.

Can I extract VM handler logic from binaries protected by VM protectors?▼

VM protector entry and handler tables can be extracted by analyzing the dispatch mechanism, allowing you to map the virtualized instructions back to native operations for logic recovery.

How do I neutralize opaque predicates during binary deobfuscation?▼

Opaque predicates are neutralized by proving their constant evaluation using SMT solvers like Z3, allowing you to remove the false conditional branches and clean up the junk code.

Does this deobfuscation workflow require specific tools for symbolic execution?▼

The workflow utilizes symbolic execution, tracing, and emulation to verify recovered logic, relying on standard reverse engineering environments to apply static and dynamic recovery strategies.

Related Skills

Explore More Education & Research Skills→
yaklangyaklang
1.6k

code-obfuscation-deobfuscation

Identify and defeat code obfuscation in native binaries.

Official
Advanced
sayseven7sayseven7
11

code-obfuscation-deobfuscation

Analyze obfuscated binaries to recover control flow, strings, and imports.

Community
Advanced
lNwNllNwNl
2

code-obfuscation-deobfuscation

Deobfuscate native binaries using emulation and symbolic execution.

Community
Advanced
gl0bal01gl0bal01
44

malware-dynamic-analysis

Execute malware samples in sandboxes and capture runtime behavior with monitoring tools.

Community
Advanced