Agent skill · security · yaklang
code-obfuscation-deobfuscation
Code obfuscation analysis and deobfuscation playbook. Use when reversing binaries protected by junk code, opaque predicates, self-modifying code, control flow flattening, VM protection, or string encryption.
Why this skill is useful
Provides a comprehensive playbook with executable strategies and techniques for analyzing and defeating complex code obfuscation methods that are not widely known.
What it needs
Requires unicorn installed locally. About 8k tokens when loaded. Last updated 2026-06-16. 1,563 stars on the source repository.
What this skill does
SKILL: Code Obfuscation & Deobfuscation — Expert Analysis Playbook AI LOAD INSTRUCTION: Expert techniques for identifying, classifying, and defeating code obfuscation in native binaries. Covers junk code, opaque predicates, SMC, control flow flattening, movfuscator, VM protectors (VMProtect/Themida/Code Virtualizer), string encryption, import hiding, and anti-disassembly tricks. Base models often conflate packing with obfuscation and miss the distinction between static and dynamic deobfuscation strategies. 0. RELATED ROUTING anti-debugging-techniques when the obfuscated binary also has anti-debug layers symbolic-execution-tools when using angr/Z3 for automated deobfuscation vm-and-bytecode-reverse for deep VM protector bytecode analysis Quick identification picks Symptom in IDA/Ghidra Likely Obfuscation Start With --- --- --- Flat CFG, single giant switch Control flow flattening Symbolic execution to recover CFG Only mov instructions movfuscator demovfuscation / trace-based lifting pushad/pushfd → VM entry VM protector Handler table extraction XOR loop before code execution SMC / string encryption Dynamic analysis, breakpoint after decode Impossible conditions (opaque predicates) Junk code insertion Pattern-based removal All strings unreadable String encryption Hook decryption routine, or emulate No imports in IAT Import hiding Trace GetProcAddress / hash resolution --- 1. JUNK CODE & OPAQUE PREDICATES 1.1 Junk Code Insertion Dead code that never affects program output, added to increase analysis time. Identification: Instructions that write to registers/memory never read afterward Function calls whose return values are discarded and have no side effects Loops with invariant bounds that compute unused results Removal strategy: 1. Compute def-use chains (IDA/Ghidra data flow analysis) 2. Mark instructions with no downstream use as dead 3. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills yaklang/code-obfuscation-deobfuscation