skills.rest
P4nda0s
P4nda0sCOMMUNITY
Explore all skills by this author →
𝕏@ppp123qqqwGitHub

deobf-indirect

Patch indirect branches in ARM64 binaries using symbolic execution.

134|24|Updated May 7, 2026
Search Tags:#deobfuscation#reverse-engineering#arm64#patching#binary-analysis#symbolic-execution#indirect-branch
One-click install
npx skills add https://github.com/P4nda0s/bin-deobf-skills --skill deobf-indirect
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: deobf-indirect
Source: https://github.com/P4nda0s/bin-deobf-skills/tree/main/skills/deobf-indirect
Command: npx skills add https://github.com/P4nda0s/bin-deobf-skills --skill deobf-indirect

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Indirect branches hidden behind obfuscation patterns (CSEL/BR) obscure control flow, making analysis and patching difficult. This Skill uses symbolic execution and BFS traversal to recover true targets and restore readable program structure for ARM64 binaries.

Core Features & Use Cases

  • Symbolic execution-guided identification of indirect branch targets in ARM64 code.
  • BFS-based traversal from function entry to discover patch points and multiple successor paths.
  • Patch generation that rewrites indirect branches into direct control flow for easier analysis and re-linking of successors.

Quick Start

Run the deobf-indirect workflow on a target ARM64 binary to patch the indirect branches.

Frequently Asked Questions about deobf-indirect

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I deobfuscate indirect branches in ARM64 binaries?▼

To deobfuscate indirect branches in ARM64 binaries, you can use symbolic execution combined with BFS traversal to identify true targets and rewrite the control flow into direct branches.

How does symbolic execution recover control flow from CSEL/BR obfuscation patterns?▼

Symbolic execution recovers control flow by enforcing CSEL/CSET decisions during BFS traversal from the function entry, discovering multiple possible successor paths hidden behind indirect branches.

Can I patch indirect branches into direct control flow for binary analysis?▼

Yes, you can patch indirect branches into direct control flow by generating patch instructions that rewrite the obfuscated branches, restoring readable program structure for easier analysis.

Does this deobfuscation approach work with all ARM64 obfuscated functions?▼

This deobfuscation approach works specifically with ARM64 functions obfuscated via CSEL/BR patterns, requiring a symbolic execution environment to resolve and patch the indirect branch targets.

What is the best way to reveal hidden control flow in ARM64 reverse engineering?▼

The best way to reveal hidden control flow is using symbolic execution to identify indirect branch targets and generate patches that rewrite the control flow into direct, readable instructions.

Why does BFS traversal fail to find all indirect branch targets in ARM64 code?▼

BFS traversal may miss targets if the symbolic execution environment is not properly configured to enforce CSEL/CSET decisions, preventing accurate discovery of multiple successor paths.

Related Skills

Explore More Software Engineering Skills→
alicangnllalicangnll

Malware Analysis

Analyze Windows PE binaries to extract IOCs and map them to MITRE ATT&CK.

Community
Advanced
AI-Foundry-CoreAI-Foundry-Core
4

binary-analysis-patterns

Analyze x86-64 and ARM binaries to reveal disassembly and control-flow patterns.

Official
Advanced
not-matthiasnot-matthias
9

rizin-analysis

Analyze binary code with Rizin and Radare2 to reveal functions, CFGs, and disassembly.

Community
Advanced
Prohao42Prohao42
120

code-obfuscation-deobfuscation

Identify obfuscation techniques in binaries and produce readable deobfuscated logic.

Community
Advanced