De-flattening mutated OLLVM control flow with angr symbolic execution, recovering the original logic from heavily obfuscated native binaries, with the analysis method shown end to end.
De-obfuscating an OLLVM CFF and MBA/BDD dylib, reconstructing 167 hooks hidden behind 223 trampolines to recover the real logic, with the setup and commands all covered.
Writing and defeating OLLVM control-flow flattening, an offense-defense look at building the obfuscation pass and then reversing it back out, with the result and caveats spelled out.
Reversing a deeply obfuscated modified MD5, cutting through the obfuscation to recover a custom variant of the hash function and its constants, with the analysis method shown end to end.
Reversing OLLVM control-flow flattening with IDA Hex-Rays microcode, using the decompiler's IR to reconstruct the flattened logic, for anyone reversing similar targets.
Removing OLLVM bogus control flow with angr symbolic execution, using symbolic analysis to strip opaque predicates and junk blocks, with the analysis method shown end to end.
An OLLVM survival guide, collecting practical techniques for navigating flattened control flow, bogus blocks, and instruction substitution, and the bypass logic broken down.
Reversing OLLVM control-flow flattening, reconstructing the original control flow from the dispatcher loop, state variable, and jump tables, and the code traced down to the core.
Analyzing the control-flow flattening obfuscation pass, explaining how it breaks the CFG into a dispatcher loop and what it looks like in decompiled code.
Tracing a short-video app's sig3 request signature from the Java layer through OLLVM-obfuscated native code, using Jadx and Frida to walk the call chain down to the signing routine.