domains / families / security / code-obfuscation-deobfuscation

code-obfuscation-deobfuscation

separate

Code obfuscation analysis and deobfuscation playbook. Use when reversing binaries protected by junk code, opaque predicates, self-modifying code, control flow flattening, VM protection, or string encryption.

When to use

• junk code removal
• opaque predicate deobfuscation
• self-modifying code analysis
• control flow flattening recovery
• movfuscator deobfuscation
• VM protector analysis
• string encryption decryption
• import hiding resolution

When not to use

• anti-debugging techniques
• symbolic execution tool usage
• deep VM bytecode reverse engineering

Skill page

Source