code-obfuscation-deobfuscation

An expert playbook for identifying, classifying, and defeating code obfuscation in native binaries. It targets binaries hardened with junk code, opaque predicates, self-modifying code, control-flow flattening, the movfuscator, VM protectors such as VMProtect, Themida, and Code Virtualizer, string encryption, import hiding, and anti-disassembly tricks, and it explicitly separates obfuscation from packing and static from dynamic deobfuscation strategies, distinctions that base models tend to blur.

A quick-identification table maps what an analyst sees in IDA or Ghidra to the likely technique and a starting point: a flat CFG with one giant switch points to control-flow flattening, recovered with symbolic execution; a function of only `mov` instructions points to the movfuscator, handled with demovfuscation or trace-based lifting; a pushad/pushfd sequence into a VM entry points to a VM protector, addressed by extracting the handler table; and an XOR loop before execution points to self-modifying code or string encryption, broken by dynamic analysis after decode.

Each technique then gets its own section with identification signs and concrete removal or recovery strategies, illustrated with runnable snippets: Z3 to prove an opaque predicate is constant, Unicorn to emulate and dump self-modified code, and angr to symbolically deflatten a dispatcher by finding the highest in-degree block and solving for each case's real successor. Control-flow flattening recovery is compared across angr, Triton, miasm, trace-based tooling, and the D-810 IDA plugin, and VM protection is broken down from entry-point identification through handler-table extraction to devirtualization. Cross-references route to related skills for anti-debugging layers, symbolic-execution tooling, and deep VM bytecode analysis when a binary combines multiple protections.