code-obfuscation-deobfuscation

Analyze obfuscated binaries to recover control flow, strings, and imports.

11|4|Updated Jun 7, 2026

Search Tags:#reverse engineering #binary analysis #obfuscation #deobfuscation #symbolic execution #control flow flattening #self-modifying code

Ready to run

npx skills add https://github.com/sayseven7/frameseven --skill code-obfuscation-deobfuscation-sayseven7

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: code-obfuscation-deobfuscation
Source: https://github.com/sayseven7/frameseven/tree/main/internal/mcp/skills/code-obfuscation-deobfuscation
Command: npx skills add https://github.com/sayseven7/frameseven --skill code-obfuscation-deobfuscation-sayseven7

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps reverse engineers understand binaries that are intentionally obscured with junk code, opaque predicates, self-modifying code, flattened control flow, string encryption, import hiding, and anti-disassembly tricks.

Core Features & Use Cases

Obfuscation identification: Classifies common protection patterns so you can choose the right analysis path quickly.
Static and dynamic deobfuscation: Guides breakpointing, tracing, emulation, symbolic execution, and CFG recovery for hard-to-read code.
Protector-focused workflows: Supports analysis of VM-based protectors, mov-only code, and runtime-decrypted routines.
Use case: A malware analyst can use this Skill to dump decrypted code, recover hidden API calls, and reconstruct the real execution flow of a packed or protected sample.

Quick Start

Analyze the attached obfuscated binary, identify the protection techniques present, and outline the safest static and dynamic deobfuscation workflow.

Frequently Asked Questions about code-obfuscation-deobfuscation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I reverse engineer binaries with control flow flattening and self-modifying code?▼

To reverse engineer obfuscated binaries, you must apply static analysis and dynamic tracing to recover real control flow. This process involves identifying protection patterns like flattened control flow and self-modifying code to choose the correct analysis path.

What is the best way to analyze malware that uses anti-disassembly tricks and junk code?▼

The best way to analyze malware with anti-disassembly tricks is to classify the obfuscation patterns present, then apply emulation and symbolic execution. This allows you to dump decrypted code and reconstruct the hidden execution flow safely.

How do I recover hidden API calls and strings from VM-based protectors?▼

To recover hidden API calls and encrypted strings from VM-based protectors, use handler and decryption recovery techniques. Applying dynamic tracing and runtime-decrypted routine analysis helps reconstruct the executable behavior.

Can I use symbolic execution to defeat mov-only code and VM protectors in native binaries?▼

Yes, symbolic execution is explicitly supported for analyzing VM-based protectors and mov-only code. By combining it with static analysis and control flow graph recovery, you can effectively reconstruct the real execution flow.

When should I use dynamic tracing instead of static analysis for deobfuscation?▼

You should use dynamic tracing alongside static analysis when dealing with runtime-decrypted routines and self-modifying code. Static analysis identifies the protection, while dynamic tracing captures the actual decrypted execution behavior.