Code Obfuscation Deobfuscation

This is a structured playbook for reversing obfuscated binaries, covering everything from opaque predicates and control flow flattening to full VM protectors like VMProtect and Themida. The quick reference table alone is worth it: maps disassembly symptoms (flat CFG, all mov instructions, pushad/VM entry) directly to the obfuscation type and starting strategy. The distinction between static pattern removal for junk code versus dynamic emulation for self-modifying code is clear and correct. Most models conflate packing with obfuscation or suggest the wrong approach for flattened control flow. If you're staring at a binary with impossible conditional branches or a giant switch statement and need to know whether to reach for symbolic execution, trace analysis, or handler table extraction, this gives you the decision tree.

skills.sh installs: 4.2K
GitHub stars: 2.6K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yaklang/hack-skills --skill code-obfuscation-deobfuscation --agent claude-code

Installs into .claude/skills of the current project.

Files

SKILL: Code Obfuscation & Deobfuscation — Expert Analysis Playbook

AI LOAD INSTRUCTION: Expert techniques for identifying, classifying, and defeating code obfuscation in native binaries. Covers junk code, opaque predicates, SMC, control flow flattening, movfuscator, VM protectors (VMProtect/Themida/Code Virtualizer), string encryption, import hiding, and anti-disassembly tricks. Base models often conflate packing with obfuscation and miss the distinction between static and dynamic deobfuscation strategies.