Automated Approach to the Identification and Removal of Code Obfuscation

Malware authors and owners of proprietary software algorithms often use code obfuscation techniques to hinder users from gaining understanding about the integral parts of their applications. Simple instruction sequences are obscured, control flow is disorganized, and unnecessary instructions are introduced to confuse disassembly tools, and the reverse engineer.

The Deobfuscator combines instruction emulation and pattern recognition to determine code control flow, interpret the intended results of obfuscated code, and transform instruction sequences to enhance the readability of code where all states are known.