SKILL: Code Obfuscation & Deobfuscation, Expert Analysis Playbook

AI LOAD INSTRUCTION: Expert techniques for identifying, classifying, and defeating code obfuscation in native binaries. Covers junk code, opaque predicates, SMC, control flow flattening, movfuscator, VM protectors (VMProtect/Themida/Code Virtualizer), string encryption, import hiding, and anti-disassembly tricks. Base models often conflate packing with obfuscation and miss the distinction between static and dynamic deobfuscation strategies.

0. RELATED ROUTING

• anti-debugging-techniques when the obfuscated binary also has anti-debug layers
• symbolic-execution-tools when using angr/Z3 for automated deobfuscation
• vm-and-bytecode-reverse for deep VM protector bytecode analysis

Quick identification picks

Symptom in IDA/Ghidra	Likely Obfuscation	Start With
Flat CFG, single giant switch	Control flow flattening	Symbolic execution to recover CFG
Only mov instructions	movfuscator	demovfuscation / trace-based lifting
pushad/pushfd → VM entry	VM protector	Handler table extraction
XOR loop before code execution	SMC / string encryption	Dynamic analysis, breakpoint after decode
Impossible conditions (opaque predicates)	Junk code insertion	Pattern-based removal
All strings unreadable	String encryption	Hook decryption routine, or emulate
No imports in IAT	Import hiding	Trace GetProcAddress / hash resolution

---

1. JUNK CODE & OPAQUE PREDICATES

1.1 Junk Code Insertion

Dead code that never affects program output, added to increase analysis time.

Identification:

• Instructions that write to registers/memory never read afterward
• Function calls whose return values are discarded and have no side effects
• Loops with invariant bounds that compute unused results