Writing and Removing LLVM Bogus Control Flow
Writing and removing LLVM bogus control flow, showing how the pass inserts junk blocks and opaque predicates, then how to strip them back out, and the mechanism explained clearly.
Writing and removing LLVM bogus control flow, showing how the pass inserts junk blocks and opaque predicates, then how to strip them back out, and the mechanism explained clearly.
Analyzing and deobfuscating Polaris's BogusControlFlow pass, using angr to detect opaque predicates and strip the bogus control flow, and the internals laid out in detail.
Deobfuscating VMProtect 3.9.4 with symbolic execution, using symbolic analysis to strip the VM's obfuscation and recover the original logic, with the commands and code included.