demovfuscator
A deobfuscator that recovers control flow from binaries compiled with the M/o/Vfuscator one-instruction compiler.
What is demovfuscator?
Demovfuscator is a reverse engineering tool that deobfuscates binaries compiled with the M/o/Vfuscator, a compiler that reduces programs to use only the MOV instruction. It recovers the original control flow and program structure from these heavily obfuscated executables, making them analyzable again. The tool uses static taint analysis and SMT solving to generically handle movfuscated code without relying on implementation-specific assumptions.
Reverse engineers, security researchers, and CTF participants who need to analyze binaries obfuscated with M/o/Vfuscator. It's particularly useful for those dealing with advanced obfuscation techniques in competitive or real-world scenarios.
Demovfuscator offers a generic, hardening-resistant approach to deobfuscation that works against real-world movfuscated binaries. Unlike manual analysis or pattern-based tools, it uses formal methods to recover control flow, saving significant time and effort in reverse engineering tasks.
Overview
A work-in-progress deobfuscator for movfuscated binaries
Use Cases
Best For
- Analyzing CTF challenges that use M/o/Vfuscator obfuscation
- Reverse engineering heavily obfuscated malware or binaries
- Recovering control flow from movfuscated executables
- Researching deobfuscation techniques and one-instruction set computing
- Teaching advanced binary analysis and obfuscation resistance
- Automating analysis of movfuscated code in security workflows
Not Ideal For
- Analyzing binaries obfuscated with non-MOV techniques like VM-based or commercial packers
- Teams requiring a GUI or drag-and-drop interface for deobfuscation workflows
- Projects needing quick, general-purpose obfuscation removal without SMT solver expertise
Pros & Cons
Pros
Adheres to high-level invariants, making it unaffected by proposed hardening like register renaming, as the README states it avoids assumptions about implementation details.
Uses libz3 to reason semantically about MOV instructions, enabling accurate control flow recovery without relying on low-level patterns.
Successfully tested against movfuscated CTF challenges from Hackover CTF and 0CTF, proving real-world applicability beyond synthetic examples.
Generates patched executables, IDC symbol files, and DOT-compatible control flow graphs, offering multiple ways to analyze recovered code.
Cons
Requires installation of three libraries (libcapstone, libz3, libkeystone), which the README admits is inconvenient and may need path adjustments.
Only works on binaries obfuscated with M/o/Vfuscator, making it useless for other obfuscation methods like packing or virtualization.
The compiled package is described as 'very old' in the README, indicating potential maintenance or compatibility issues for users.
Frequently Asked Questions
Related Projects
jadxDex to Java decompiler
radare2UNIX-like reverse engineering framework and command-line toolset
BinwalkFirmware Analysis Tool
Z3The Z3 Theorem Prover
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.