skills.rest
sayseven7
sayseven7COMMUNITY
Explore all skills by this author →
WebsiteGitHub

code-obfuscation-deobfuscation

Analyze obfuscated binaries to recover control flow, strings, and imports.

11|4|Updated Jun 7, 2026
Search Tags:#reverse engineering#binary analysis#obfuscation#deobfuscation#symbolic execution#control flow flattening#self-modifying code
One-click install
npx skills add https://github.com/sayseven7/frameseven --skill code-obfuscation-deobfuscation-sayseven7
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: code-obfuscation-deobfuscation
Source: https://github.com/sayseven7/frameseven/tree/main/internal/mcp/skills/code-obfuscation-deobfuscation
Command: npx skills add https://github.com/sayseven7/frameseven --skill code-obfuscation-deobfuscation-sayseven7

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps reverse engineers understand binaries that are intentionally obscured with junk code, opaque predicates, self-modifying code, flattened control flow, string encryption, import hiding, and anti-disassembly tricks.

Core Features & Use Cases

  • Obfuscation identification: Classifies common protection patterns so you can choose the right analysis path quickly.
  • Static and dynamic deobfuscation: Guides breakpointing, tracing, emulation, symbolic execution, and CFG recovery for hard-to-read code.
  • Protector-focused workflows: Supports analysis of VM-based protectors, mov-only code, and runtime-decrypted routines.
  • Use case: A malware analyst can use this Skill to dump decrypted code, recover hidden API calls, and reconstruct the real execution flow of a packed or protected sample.

Quick Start

Analyze the attached obfuscated binary, identify the protection techniques present, and outline the safest static and dynamic deobfuscation workflow.

Frequently Asked Questions about code-obfuscation-deobfuscation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I reverse engineer binaries with control flow flattening and self-modifying code?▼

To reverse engineer obfuscated binaries, you must apply static analysis and dynamic tracing to recover real control flow. This process involves identifying protection patterns like flattened control flow and self-modifying code to choose the correct analysis path.

What is the best way to analyze malware that uses anti-disassembly tricks and junk code?▼

The best way to analyze malware with anti-disassembly tricks is to classify the obfuscation patterns present, then apply emulation and symbolic execution. This allows you to dump decrypted code and reconstruct the hidden execution flow safely.

How do I recover hidden API calls and strings from VM-based protectors?▼

To recover hidden API calls and encrypted strings from VM-based protectors, use handler and decryption recovery techniques. Applying dynamic tracing and runtime-decrypted routine analysis helps reconstruct the executable behavior.

Can I use symbolic execution to defeat mov-only code and VM protectors in native binaries?▼

Yes, symbolic execution is explicitly supported for analyzing VM-based protectors and mov-only code. By combining it with static analysis and control flow graph recovery, you can effectively reconstruct the real execution flow.

When should I use dynamic tracing instead of static analysis for deobfuscation?▼

You should use dynamic tracing alongside static analysis when dealing with runtime-decrypted routines and self-modifying code. Static analysis identifies the protection, while dynamic tracing captures the actual decrypted execution behavior.

Related Skills

Explore More Software Engineering Skills→
chicanoandres702chicanoandres702

malware-analyst

Analyze malware samples for triage, static and dynamic analysis, and IOC extraction.

Community
Advanced
Axel051171Axel051171
33

uft-recovery-integrity

Enforce data integrity invariants on recovery functions in src/recovery/.

Community
Advanced
CANTAGESTUDIOCANTAGESTUDIO
3

flutter-obfuscate-docs

Obfuscate Flutter builds and generate symbol files for crash deobfuscation.

Community
Advanced
MystenLabsMystenLabs
20

move-stdlib

Identify and summarize standard Move stdlib patterns for Sui data types.

Official
Intermediate