skills.rest
lNwNl
lNwNlCOMMUNITY
Explore all skills by this author →
GitHub

code-obfuscation-deobfuscation

Deobfuscate native binaries using emulation and symbolic execution.

2|Updated May 15, 2026
Search Tags:#reverse engineering#binary analysis#deobfuscation#control flow flattening#code obfuscation#VM protection#string decryption
One-click install
npx skills add https://github.com/lNwNl/Methodos --skill code-obfuscation-deobfuscation-lnwnl
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: code-obfuscation-deobfuscation
Source: https://github.com/lNwNl/Methodos/tree/main/docker/opencode/skills/code-obfuscation-deobfuscation
Command: npx skills add https://github.com/lNwNl/Methodos --skill code-obfuscation-deobfuscation-lnwnl

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

It helps analysts understand and reverse engineered binaries that use code obfuscation, including junk code, opaque predicates, self-modifying code, control flow flattening, VM protectors, and encrypted strings.

Core Features & Use Cases

  • Junk code & opaque predicate deobfuscation: identify dead instructions and mathematically prove opaque branches are constant.
  • Self-modifying and string decryption workflows: locate decryption loops, dump decrypted regions after execution, and recover plaintext strings by emulating or hooking decode routines.
  • Control-flow and VM deobfuscation guidance: recover real CFG from flattened dispatchers and extract VM handler tables to enable devirtualization.

Use case: You have a stripped native challenge binary whose strings are unreadable and whose control flow is a giant dispatcher switch—use this playbook to recover the underlying logic, deobfuscate execution, and reconstruct the true program behavior.

Quick Start

Use this playbook to classify the obfuscation style you see in IDA/Ghidra and apply the matching static or dynamic recovery steps to recover decrypted code, strings, and control flow.

Frequently Asked Questions about code-obfuscation-deobfuscation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I deobfuscate a binary with control flow flattening?▼

To deobfuscate control flow flattening, you recover the real control flow graph from flattened dispatchers by identifying dispatcher switch patterns and extracting VM handler tables to enable devirtualization.

What is the best way to decrypt encrypted strings in a native binary?▼

Decrypting encrypted strings involves locating decryption loops, then dumping decrypted memory regions after execution or emulating and hooking decode routines to recover plaintext strings.

How does opaque predicate deobfuscation work?▼

Opaque predicate deobfuscation identifies dead instructions and mathematically proves that opaque branches are constant, removing fake conditional logic from the disassembly.

Can I use emulation to recover logic from self-modifying code?▼

Yes, you can use emulation to recover logic from self-modifying code by tracing execution, dumping decrypted regions after they are written, and validating deobfuscation assumptions dynamically.

When do I need symbolic execution for binary deobfuscation?▼

You need symbolic execution for binary deobfuscation when static disassembly is misleading or incomplete and you must validate deobfuscation assumptions against complex obfuscation patterns like VM protectors.

How do I identify obfuscation patterns in IDA or Ghidra?▼

You identify obfuscation patterns in IDA or Ghidra by classifying the obfuscation style visible in the disassembly and applying matching static or dynamic recovery steps to reconstruct true program behavior.

Related Skills

Explore More Software Engineering Skills→
CANTAGESTUDIOCANTAGESTUDIO
3

flutter-obfuscate-docs

Obfuscate Flutter builds and generate symbol files for crash deobfuscation.

Community
Advanced
rainoftimerainoftime
17

control-flow-analysis

Build control flow graphs and identify basic blocks, dominators, and loops.

Community
Intermediate
lNwNllNwNl
2

symbolic-execution-tools

Recover CTF reversing inputs using angr, Z3, and Unicorn emulation.

Community
Advanced
DorianGalloDorianGallo
5

code-obfuscation-deobfuscation

Identify obfuscation types and generate deobfuscation plans for native binaries.

Community
Advanced