deobf-indirect

Patch indirect branches in ARM64 binaries using symbolic execution.

134|24|Updated May 7, 2026

Search Tags:#deobfuscation #reverse-engineering #arm64 #patching #binary-analysis #symbolic-execution #indirect-branch

Ready to run

npx skills add https://github.com/P4nda0s/bin-deobf-skills --skill deobf-indirect

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: deobf-indirect
Source: https://github.com/P4nda0s/bin-deobf-skills/tree/main/skills/deobf-indirect
Command: npx skills add https://github.com/P4nda0s/bin-deobf-skills --skill deobf-indirect

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Indirect branches hidden behind obfuscation patterns (CSEL/BR) obscure control flow, making analysis and patching difficult. This Skill uses symbolic execution and BFS traversal to recover true targets and restore readable program structure for ARM64 binaries.

Core Features & Use Cases

Symbolic execution-guided identification of indirect branch targets in ARM64 code.
BFS-based traversal from function entry to discover patch points and multiple successor paths.
Patch generation that rewrites indirect branches into direct control flow for easier analysis and re-linking of successors.

Quick Start

Run the deobf-indirect workflow on a target ARM64 binary to patch the indirect branches.

Frequently Asked Questions about deobf-indirect

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I deobfuscate indirect branches in ARM64 binaries?▼

To deobfuscate indirect branches in ARM64 binaries, you can use symbolic execution combined with BFS traversal to identify true targets and rewrite the control flow into direct branches.

How does symbolic execution recover control flow from CSEL/BR obfuscation patterns?▼

Symbolic execution recovers control flow by enforcing CSEL/CSET decisions during BFS traversal from the function entry, discovering multiple possible successor paths hidden behind indirect branches.

Can I patch indirect branches into direct control flow for binary analysis?▼

Yes, you can patch indirect branches into direct control flow by generating patch instructions that rewrite the obfuscated branches, restoring readable program structure for easier analysis.

Does this deobfuscation approach work with all ARM64 obfuscated functions?▼

This deobfuscation approach works specifically with ARM64 functions obfuscated via CSEL/BR patterns, requiring a symbolic execution environment to resolve and patch the indirect branch targets.

What is the best way to reveal hidden control flow in ARM64 reverse engineering?▼

The best way to reveal hidden control flow is using symbolic execution to identify indirect branch targets and generate patches that rewrite the control flow into direct, readable instructions.

Why does BFS traversal fail to find all indirect branch targets in ARM64 code?▼

BFS traversal may miss targets if the symbolic execution environment is not properly configured to enforce CSEL/CSET decisions, preventing accurate discovery of multiple successor paths.