De-flattening mutated OLLVM control flow with angr symbolic execution, recovering the original logic from heavily obfuscated native binaries, with the analysis method shown end to end.
Indirect branch obfuscation with LLVM, replacing direct branches with indirect jumps to break static control-flow analysis of compiled binaries, and the internals laid out in detail.
De-obfuscating ZKM control-flow flattening with ASM, using bytecode rewriting to reconstruct the original Java control flow and logic, with the tools and offsets documented.
Reversing the Windows Photos AI eraser models, digging into the on-device machine learning model files to understand how the feature works, including the pitfalls and the fix.
De-obfuscating an OLLVM CFF and MBA/BDD dylib, reconstructing 167 hooks hidden behind 223 trampolines to recover the real logic, with the setup and commands all covered.
Reversing Cython pyd modules, part one: understanding how Cython compiles Python into C extensions and how to read the resulting binaries, including the pitfalls and the fix.
Deobfuscating VMProtect 3.9.4 with symbolic execution, using symbolic analysis to strip the VM's obfuscation and recover the original logic, with the commands and code included.
Reversing OLLVM control-flow flattening with IDA Hex-Rays microcode, using the decompiler's IR to reconstruct the flattened logic, for anyone reversing similar targets.
Reversing an ARM64 VMP: virtual instructions, virtual registers, and de-virtualization, mapping the custom ISA back to real ARM64, with every step broken down clearly.
Analyzing VMProtect 3.9.4's virtual machine flow, tracing the dispatch loop and handler set that drive its newest VM architecture and opcode mapping, so you can reproduce it yourself.
Analyzing VMProtect 3.0.0 beta's virtual machine handler chaining, tracing how its handlers link together to interpret protected code at runtime, with the tools and offsets documented.
Analyzing VMProtect 2.12.3's virtual machine handler flow, mapping how its handlers chain together to interpret and execute virtualized code, including the pitfalls and the fix.
Reversing the V8 bytecode format, fingerprinting the engine version and disassembling bytecode to read the compiled JavaScript internals, with the commands and code included.
Unpacking a .NET JIT protector on .NET Framework 4.8+ with WinDbg TTD, using time-travel debugging to recover JIT-compiled methods, and the gotchas flagged along the way.
Removing OLLVM bogus control flow with angr symbolic execution, using symbolic analysis to strip opaque predicates and junk blocks, with the analysis method shown end to end.