# What Is OLLVM Deobfuscation and How Is It Supported in the Reverse-Skill Repository

> Understand OLLVM deobfuscation techniques like control-flow flattening and instruction substitution. Learn how the reverse-skill repository supports OLLVM analysis with a detailed three-stage workflow.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: deep-dive
- Published: 2026-08-06

---

**OLLVM deobfuscation is the process of reversing Obfuscator-LLVM transformations—control-flow flattening, bogus control flow, and instruction substitution—to restore analyzable binary code, supported in the reverse-skill repository through a curated three-stage workflow documented in [`skills/reverse-engineering/references/ollvm-deobfuscation.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/reverse-engineering/references/ollvm-deobfuscation.md).**

The **reverse-skill** repository provides an up-to-date, community-curated knowledge base for analysts confronting binaries protected by OLLVM (Obfuscator-LLVM). Understanding how to systematically dismantle these protections requires familiarity with the underlying obfuscation passes and the specific tools mapped out in the repository's routing logic.

## Understanding OLLVM Obfuscation Techniques

OLLVM operates as a set of LLVM intermediate representation (IR) passes that deliberately harden binaries through three core transformations. According to the pattern definitions in [`skills/reverse-engineering/patterns.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/reverse-engineering/patterns.md), each pass targets a specific analysis vector used by reverse engineers.

### Control-Flow Flattening (fla)

The **fla** pass rewrites functions into a dispatcher loop architecture. A *state variable* determines the next basic block to execute, transforming structured code into a star-shaped control-flow graph (CFG). As noted in the "控制流平坦化" section of the reference documentation, this elimination of structured control flow forces analysts to reconstruct the original logic from a flattened state machine.

### Bogus Control Flow (bcf)

The **bcf** pass inserts never-taken branches guarded by **opaque predicates**—conditions that always evaluate to true or false but appear uncertain to static analysis. The "虚假控制流" section explains how this inflates dead code and pollutes the CFG with artificial complexity, consuming analyst time on unreachable paths.

### Instruction Substitution via MBA (sub)

The **sub** pass replaces simple arithmetic and bitwise operations with equivalent but convoluted **Mixed Boolean-Arithmetic (MBA)** expressions. Detailed in the "指令替换" section, this transformation preserves semantic correctness while defeating pattern-based decompilation and constant propagation.

## The Three-Stage OLLVM Deobfuscation Workflow

The repository organizes OLLVM deobfuscation into a systematic pipeline that accounts for the diversity of modern forks and target architectures.

### Stage 1: Identify the OLLVM Variant

Different OLLVM forks—including **Hikari**, **O-MVLL**, **Pluto**, and **Polaris**—expose distinct signatures and implementation quirks. The "现代 OLLVM 变种生态" table in [`skills/reverse-engineering/references/ollvm-deobfuscation.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/reverse-engineering/references/ollvm-deobfuscation.md) provides detection cues such as dispatcher prologue patterns and state variable initialization sequences. Accurate variant identification is critical because it determines which un-flattener algorithms and opaque predicate solvers will be effective.

### Stage 2: Select the Appropriate Tool

The repository's "0. 快速决策：我该用哪个工具？" decision matrix maps your analysis environment and target architecture to specific utilities:

- **obpo-plugin**: A cloud-based Hex-Rays microcode plugin offering the most powerful deobfuscation but requiring network access to proprietary services.
- **d810-ng**: A local IDA Pro plugin combining Z3-SMT solving with specialized un-flatteners tailored to each OLLVM variant.
- **ollvm-unflattener**: A pure-Python Miasm-based symbolic executor for x86/x64 scripted analysis.
- **ollvm-breaker**: A Binary Ninja plugin optimized for Android `.so` binaries.
- **deollvm**: A Unicorn-based emulator specifically designed for ARM64 deflatting.
- **angr**: A generic Python symbolic-execution framework suitable for CTF-style rapid analysis.

### Stage 3: Apply the Layered Deobfuscation Pipeline

The "完整脱密工作流" flowchart recommends applying transformations in a specific order to maximize effectiveness:

1. **Remove opaque predicates** (bcf mitigation) using d810-ng or obpo-plugin to eliminate dead code.
2. **Unflatten control flow** (fla mitigation) using variant-specific un-flatteners such as `UnflattenerSwitchCase` for Tigress-style dispatchers.
3. **Simplify MBA expressions** (sub mitigation) using the d810-ng MBA simplifier or dedicated tools like SiMBA.

Each stage includes verification steps—size reduction metrics, CFG simplification checks, and dynamic validation with Frida—to confirm that semantic equivalence has been preserved.

## Practical Deobfuscation Examples

The repository includes concrete implementation patterns for applying these tools against real-world binaries.

### Quick Analysis with angr

For CTF scenarios or rapid triage, the [`skills/reverse-engineering/references/ollvm-deobfuscation.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/reverse-engineering/references/ollvm-deobfuscation.md) file provides a Python script targeting the five largest functions (typically the obfuscated entry points):

```python
import angr

proj = angr.Project("challenge.so", auto_load_libs=False)
cfg = proj.analyses.CFGFast()

# Pick the five largest functions – they are likely obfuscated

funcs = sorted(cfg.functions.values(), key=lambda f: f.size, reverse=True)[:5]
for func in funcs:
    print(f"[+] {func.name} @ {hex(func.addr)} size={hex(func.size)}")
    try:
        deob = proj.analyses.Deobfuscator(func=func)
        deob.normalize()
        print("    [+] deobfuscated")
    except Exception as e:
        print(f"    [-] failed: {e}")

```

This approach leverages angr's generic deobfuscation passes to normalize control flow without variant-specific tuning.

### IDA Pro Integration with d810-ng

For production-grade analysis, the repository documents integration with **d810-ng**:

```bash
git clone https://github.com/w00tzenheimer/d810-ng.git

```

Copy the plugin directory into IDA's `plugins` folder, then open your target binary. Press **Ctrl-Shift-D** to invoke the control panel, enable the desired rule set (MBA simplification, opaque-predicate removal, and un-flattening), and apply it to the selected function. Save the IDB and verify that the CFG has collapsed from a star-shaped dispatcher layout to a linear tree structure, indicating successful restoration of the original control flow.

### Scripted Unflattening with ollvm-unflattener

For automated pipelines or x86/x64-specific batch processing, the **ollvm-unflattener** tool provides a Miasm-based solution:

```bash
git clone https://github.com/cdong1012/ollvm-unflattener.git
cd ollvm-unflattener
pip install -r requirements.txt      # miasm, graphviz, keystone-engine

python unflattener -i target.bin -o deobf.bin -t 0x401000 -a

```

This performs symbolic execution locally to resolve state variable transitions and reconstruct the original basic block relationships without requiring a full IDA installation.

## Key Repository Files for OLLVM Deobfuscation

The reverse-skill ecosystem organizes OLLVM knowledge across several authoritative files:

- **[`skills/reverse-engineering/references/ollvm-deobfuscation.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/reverse-engineering/references/ollvm-deobfuscation.md)**: The central reference containing variant taxonomy, detection cues, the complete tool matrix, and the full three-stage workflow.
- **[`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md)**: Maps the "OLLVM-obfuscated binary" capability to the above reference, enabling automated routing of queries to the appropriate knowledge base.
- **[`skills/reverse-engineering/tools-advanced.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/reverse-engineering/tools-advanced.md)**: Lists OLLVM-related deobfuscation frameworks with comparative strengths (e.g., d810-ng's SMT integration versus obpo-plugin's cloud microcode optimization).
- **[`skills/reverse-engineering/patterns.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/reverse-engineering/patterns.md)**: Describes the underlying obfuscation patterns (fla, bcf, sub) that define the adversary model for all deobfuscation tooling.

## Summary

- **OLLVM deobfuscation** requires reversing three specific transformations: control-flow flattening (`fla`), bogus control flow (`bcf`), and MBA-based instruction substitution (`sub`).
- The **reverse-skill** repository supports this through a documented workflow in [`skills/reverse-engineering/references/ollvm-deobfuscation.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/reverse-engineering/references/ollvm-deobfuscation.md) covering variant detection, tool selection, and layered pipeline application.
- **Tool selection** depends on your environment: use **d810-ng** for local IDA Pro work, **obpo-plugin** for maximum decompiler integration, **ollvm-unflattener** for Python-based x86/x64 scripting, and **deollvm** for ARM64 Android targets.
- **Pipeline order** matters: remove opaque predicates first, unflatten control flow second, and simplify MBA expressions last to avoid analysis errors.

## Frequently Asked Questions

### What are the main differences between OLLVM variants like Hikari, O-MVLL, and Pluto?

Each variant implements the core fla, bcf, and sub passes with distinct signatures. **Hikari** focuses on iOS/macOS compatibility with anti-debug features, **O-MVLL** targets mobile architectures with updated LLVM backends, and **Pluto** introduces VM-style flattening with indirect branches. The "现代 OLLVM 变种生态" table in [`skills/reverse-engineering/references/ollvm-deobfuscation.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/reverse-engineering/references/ollvm-deobfuscation.md) provides specific detection heuristics for each, ensuring you select the correct un-flattener algorithm.

### Can OLLVM deobfuscation be fully automated for unknown binaries?

Full automation remains challenging due to the diversity of state variable implementations and the potential for nested obfuscation passes. While tools like **obpo-plugin** and **d810-ng** automate significant portions of the workflow, analysts must typically verify variant identification manually and validate output with dynamic instrumentation (e.g., Frida) to ensure semantic preservation.

### Which tool should I use for Android ARM64 binaries protected by OLLVM?

For Android ARM64 targets, the repository recommends **deollvm** (a Unicorn-based emulator specifically designed for ARM64 deflatting) or **ollvm-breaker** (a Binary Ninja plugin optimized for `.so` files). If you are working within IDA Pro, **d810-ng** also supports ARM64 but may require manual configuration of the un-flattener rules for specific dispatcher patterns.

### How does d810-ng differ from generic symbolic execution approaches like angr?

**d810-ng** is specialized for OLLVM deobfuscation within IDA Pro, integrating Z3-SMT solving with hand-tuned un-flatteners for specific variants (e.g., Tigress-style switch-case dispatchers). In contrast, **angr** provides generic symbolic execution suitable for rapid CTF analysis but may struggle with complex MBA simplification and variant-specific dispatcher logic without custom scripts. Use d810-ng for production reverse engineering and angr for quick triage or automated CTF solutions.