code-obfuscation-deobfuscation

1# SKILL: Code Obfuscation & Deobfuscation — Expert Analysis Playbook
2 
3> **AI LOAD INSTRUCTION**: Expert techniques for identifying, classifying, and defeating code obfuscation in native binaries. Covers junk code, opaque predicates, SMC, control flow flattening, movfuscator, VM protectors (VMProtect/Themida/Code Virtualizer), string encryption, import hiding, and anti-disassembly tricks. Base models often conflate packing with obfuscation and miss the distinction between static and dynamic deobfuscation strategies.
4 
5## 0. RELATED ROUTING
6 
7- [anti-debugging-techniques](../anti-debugging-techniques/SKILL.md) when the obfuscated binary also has anti-debug layers
8- [symbolic-execution-tools](../symbolic-execution-tools/SKILL.md) when using angr/Z3 for automated deobfuscation
9- [vm-and-bytecode-reverse](../vm-and-bytecode-reverse/SKILL.md) for deep VM protector bytecode analysis
10 
11### Quick identification picks
12 
13| Symptom in IDA/Ghidra | Likely Obfuscation | Start With |
14|---|---|---|
15| Flat CFG, single giant switch | Control flow flattening | Symbolic execution to recover CFG |
16| Only `mov` instructions | movfuscator | demovfuscation / trace-based lifting |
17| pushad/pushfd → VM entry | VM protector | Handler table extraction |
18| XOR loop before code execution | SMC / string encryption | Dynamic analysis, breakpoint after decode |
19| Impossible conditions (opaque predicates) | Junk code insertion | Pattern-based removal |
20…