How OLLVM Deobfuscation Routing Integrates with the RO Fallback Path

The reverse‑skill repository implements a three‑layer routing architecture where OLLVM deobfuscation attempts cascade through specialized tools (d810‑ng, ollvm‑unflattener, deflat) before automatically falling back to the RO (Raw‑Object) path when all tools fail, ensuring continuous binary analysis.

The zhaoxuya520/reverse‑skill project handles OLLVM‑obfuscated binaries through a deterministic routing system that prioritizes specialized deobfuscation while maintaining resilient fallback mechanisms. Understanding how OLLVM deobfuscation routing integrates with the RO fallback path allows reverse engineers to predict workflow behavior when analyzing control‑flow flattening and MBA‑obfuscated code. This integration ensures that even when proprietary OLLVM variants evade automated tooling, the analysis pipeline never dead‑ends.

Three‑Layer Routing Architecture

The routing system operates through three distinct layers designed to balance speed, specificity, and reliability:

• Primary Layer – config/routing.json selected by master‑route scripts (PowerShell and Shell). This layer provides fast, deterministic dispatch based on unambiguous keywords in the task hint.
• Ambiguous/Advisory Layer – skills/routing.md. This 3‑axis matrix guides sub‑skill selection when the primary router cannot confidently decide, mapping opaque binaries to specialized handlers.
• Fallback Layer – The RO (Raw‑Object) path. This generic reverse‑engineering workflow analyzes the binary as‑is when specialized deobfuscation routes exhaust their tool chains.

OLLVM Deobfuscation Entry Point

OLLVM‑obfuscated binaries enter the system through the advisory matrix defined in skills/routing.md. At line 53, the document explicitly maps OLLVM patterns to the dedicated deobfuscation skill:

| OLLVM‑obfuscated binary (控制流平坦化/虚假控制流/MBA) |
| `reverse-engineering/references/ollvm-deobfuscation.md` — 完整脱密工作流 |

When a task hint contains “OLLVM” but lacks a clear match in config/routing.json, the primary router (master‑route.ps1 or master‑route.sh) defers to this advisory entry. The router then invokes the deobfuscation pipeline described in skills/reverse-engineering/references/ollvm-deobfuscation.md.

The Deobfuscation Tool Cascade

The OLLVM deobfuscation skill attempts recovery through a ordered cascade of specialized tools, as documented at lines 227–232 of routing.md. Each tool returns a Boolean success flag that determines whether the pipeline proceeds or continues to the next candidate:

1. D‑810 / d810‑ng (IDA Pro plugin) – Pattern‑based unflattening for standard control‑flow flattening.
2. ollvm‑unflattener (Miasm framework) or ollvm‑breaker (Binary Ninja) – For non‑IDA environments requiring intermediate representation analysis.
3. deflat (Quarkslab) / Angr symbolic execution – Automated control‑flow flattening removal through symbolic execution.
4. GOOMBA (Ghidra) – P‑Code based deobfuscation for Ghidra users.

The pipeline executes these tools sequentially, passing the binary output of one stage to the next only if the previous stage reports failure.

RO Fallback Mechanism

If every tool in the deobfuscation cascade returns false—indicating an unknown OLLVM variant, missing plugin, or structural incompatibility—the pipeline triggers the RO fallback automatically. Rather than terminating the task, the system transitions control to the generic reverse‑engineering skill defined in skills/reverse-engineering/SKILL.md.

This fallback path executes the standard static analysis suite (IDA, Ghidra, Binary Ninja) against the original binary, treating it as a raw object without deobfuscation preprocessing. The RO path uses the same entry point that non‑obfuscated binaries traverse, ensuring workflow continuity. The fallback logic is explicitly described in the fallback section of ollvm-deobfuscation.md (lines 231‑232) and mirrors the Raw‑Object workflow documented in the architecture diagram.

Step‑by‑Step Integration Flow

The complete integration between OLLVM routing and the RO fallback follows this execution sequence:

1. User submits task hint containing OLLVM indicators → master‑route.ps1 or master‑route.sh queries config/routing.json.
2. No PRIMARY match found → Router opens skills/routing.md and resolves the OLLVM advisory entry.
3. Launcher invokes skills/reverse-engineering/references/ollvm-deobfuscation.md with the target binary.
4. Tool chain executes D‑810 → ollvm‑unflattener → deflat → GOOMBA, checking success flags.
5. Success condition → Any successful tool produces a deobfuscated binary passed to downstream RE skills.
6. Universal failure → Control transfers to the RO path via skills/reverse-engineering/SKILL.md, initiating standard binary analysis.

Implementation Logic

The routing logic implemented in master‑route.* scripts follows this pseudo‑code pattern:

def route_task(hint):
    # Primary lookup in config/routing.json

    primary = primary_lookup(hint)
    if primary:
        return primary

    # Ambiguous lookup via skills/routing.md

    if "ollvm" in hint.lower():
        success = run_ollvm_pipeline()
        if success:
            return "deobfuscated_binary"
        # RO fallback to generic RE workflow

        return "raw_object_analysis"
    
    # Additional ambiguous branches...

Summary

• OLLVM routing resides in the advisory layer (skills/routing.md), mapping obfuscated binaries to ollvm-deobfuscation.md.
• Tool cascade includes d810‑ng, ollvm‑unflattener, deflat, and GOOMBA, executed sequentially until success.
• RO fallback activates only when the entire deobfuscation tool chain fails, transferring control to skills/reverse-engineering/SKILL.md for raw binary analysis.
• Graceful degradation ensures that even unsupported OLLVM variants receive standard reverse‑engineering treatment without manual intervention.

Frequently Asked Questions

What triggers the RO fallback path during OLLVM analysis?

The RO fallback triggers when all specialized deobfuscation tools in the cascade return failure. According to ollvm-deobfuscation.md lines 231‑232, if d810‑ng, ollvm‑unflattener, deflat, and GOOMBA all fail to produce valid output, the pipeline automatically redirects the binary to the raw‑object analysis skill.

Which specific tools are attempted before falling back to RO?

The pipeline attempts four categories of tools in order: D‑810/d810‑ng for IDA Pro users, ollvm‑unflattener or ollvm‑breaker for Miasm/Binary Ninja environments, deflat or Angr for symbolic execution approaches, and GOOMBA for Ghidra P‑Code analysis. Each tool must report success to halt the cascade.

How does the primary router differ from the advisory matrix?

The primary router queries config/routing.json for fast, deterministic matches based on exact keywords. When hints are ambiguous or contain multiple indicators, the advisory matrix in skills/routing.md provides nuanced routing decisions through a structured 3‑axis evaluation system that considers binary characteristics rather than simple string matching.

Is the RO fallback path different from standard binary analysis?

No, the RO fallback path converges with the standard entry point defined in skills/reverse-engineering/SKILL.md. It executes identical static analysis procedures used for non‑obfuscated binaries, ensuring that the reverse‑engineering workflow remains consistent regardless of whether the input underwent successful deobfuscation.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}