# OLLVM Deobfuscation Tools in reverse-skill: When to Use Each Integration

> Discover OLLVM deobfuscation tools in reverse-skill. Learn which of the 8 integrated tools to use for IDA Pro, Binary Ninja, Ghidra, angr, and Miasm based on obfuscation variants and analysis needs.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: tutorial
- Published: 2026-08-08

---

**The reverse-skill repository integrates eight specialized OLLVM deobfuscation tools covering IDA Pro plugins, Binary Ninja extensions, Ghidra scripts, and headless Python frameworks like angr and Miasm, each optimized for specific obfuscation variants and analysis workflows.**

The `reverse-skill` repository by zhaoxuya520 maintains a comprehensive arsenal of **OLLVM deobfuscation tools** targeting modern obfuscation derivatives including Hikari, Polaris, O-MVLL, and Arkari. These integrated utilities address the fragmentation in OLLVM variants by providing specialized solutions for interactive disassembly, automated batch processing, and architecture-specific emulation. Selecting the appropriate tool ensures efficient removal of control-flow flattening, opaque predicates, and MBA (Mixed Boolean Arithmetic) obfuscation based on your analysis environment and automation requirements.

## Interactive Disassembler Plugins

For analysts working within commercial or open-source disassembler environments, the repository provides native plugins that operate directly on the intermediate representation of the binary.

### obpo-plugin for Hex-Rays Micro-code Recovery

The **obpo-plugin** operates as a Hex-Rays micro-code plugin within IDA Pro, rewriting OLLVM-generated SSA forms into cleaned C-like decompilation output. This tool delivers the strongest interactive deobfuscation available in the suite, supporting not only standard OLLVM but also Tigress, Hodur, and Approov variants. Invoke this plugin when you require precise manual oversight of the deobfuscation process and need to recover high-level C constructs from heavily flattened control flow.

```python

# 1️⃣ obpo‑plugin (IDA Pro)

# Load the script from the repo and run it inside IDA's Python console

import idaapi, ida_kernwin
ida_kernwin.run_plugin("obpo_plugin.py", {"binary": "target.bin"})

```

### d810-ng for Lightweight Batch Processing

**d810-ng** serves as the modern successor to D-810, implemented as an IDA Pro Python script rather than a compiled plugin. It performs pattern-based flattening removal, MBA simplification, and indirect-branch cleaning with lower overhead than obpo-plugin. Deploy d810-ng when you need fast, batch deobfuscation inside IDA Pro without the resource intensity of full micro-code transformation.

```python

# 2️⃣ d810‑ng (IDA Pro)

# Run the d810‑ng script from the IDA console

import ida_kernwin
ida_kernwin.run_plugin("d810_ng.py", {"binary": "target.bin"})

```

### ollvm-breaker for Binary Ninja IL Analysis

Analysts preferring Binary Ninja's workflow can utilize **ollvm-breaker**, a BN plugin that leverages Binary Ninja's intermediate language (IL) to remove control-flow flattening and simplify MBA expressions. This tool integrates directly with Binary Ninja's graph views and decompiler, making it ideal when your workflow depends on BN's UI features and cross-reference capabilities.

```python

# 4️⃣ ollvm‑breaker (Binary Ninja)

import binaryninja as bn
bv = bn.BinaryViewType.get_view_of_file("target.bin")
bv.add_plugin("ollvm_breaker")
bv.apply_ollvm_breaker()

```

### GOOMBA for Ghidra P-Code Simplification

**GOOMBA** provides Ghidra users with P-Code based deobfuscation that operates within Ghidra's decompiler pipeline. As a scriptable solution that requires no commercial license, GOOMBA excels in GUI-free automation scenarios where you prefer Ghidra's open-source ecosystem for analyzing OLLVM-protected binaries.

```python

# 7️⃣ GOOMBA (Ghidra)

# From Ghidra's Script Manager, load and execute goomba.py

# goomba.py automatically detects OLLVM flattening and rewrites the P‑Code.

```

## Headless Symbolic Execution Frameworks

When interactive UI is unnecessary or unavailable—such as in CI pipelines or Linux-only servers—the repository offers pure Python solutions based on symbolic execution engines.

### ollvm-unflattener with Miasm

The **ollvm-unflattener** utilizes the Miasm framework to perform symbolic execution that extracts the dispatcher state variable and rebuilds the original control flow graph (CFG). This stand-alone Python solution requires no commercial disassembler, making it optimal for isolated analysis environments or automated scripting pipelines.

```python

# 3️⃣ ollvm‑unflattener (Miasm)

from miasm.analysis import binary
from miasm.core.binary import Binary
proj = binary.Binary("target.bin")
proj.unflatten()          # built‑in helper removes the dispatcher

proj.disasm()             # view the cleaned CFG

```

### angr Deobfuscator for Automated Analysis

The **angr Deobfuscator** provides pure symbolic execution capabilities that automatically deobfuscate OLLVM flattening, opaque predicates, and MBA transformations. This headless Python framework excels in automated analysis scenarios and handles ARM64 binaries particularly well when interactive debugging is not required.

```python

# 5️⃣ angr Deobfuscator (head‑less)

import angr
proj = angr.Project("target.bin", load_options={'auto_load_libs': False})
deob = proj.analyses.Deobfuscator()
deob.deobfuscate()
proj.save("deobf_target.bin")

```

### Triton and Miasm for Rapid MBA Simplification

For binaries exhibiting limited branching after initial flattening removal, **Triton** and **Miasm** provide single-path symbolic execution that executes faster than full angr exploration. These frameworks specialize in rapid constraint solving for MBA simplification when you need to clean arithmetic obfuscation without exploring multiple execution paths.

## Dynamic Emulation for ARM64 Binaries

Certain OLLVM variants require runtime analysis to capture dynamic state changes that static analysis cannot resolve.

### deollvm with Unicorn Emulation

**deollvm** implements a Unicorn-based emulator specifically optimized for ARM64 binaries. By executing the binary under emulation, capturing runtime state, and rewriting flattened control flow based on observed behavior, this tool addresses architecture-specific obfuscation patterns that static tools may miss.

```python

# 6️⃣ deollvm (Unicorn emulator, ARM64)

from deollvm import DeOllvmEmu
emu = DeOllvmEmu("target_arm64.bin")
emu.run()
emu.dump_cleaned_binary("deobf_arm64.bin")

```

## Orchestrating Multi-Tool Pipelines

According to [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md) in the repository, effective OLLVM deobfuscation often requires chaining multiple tools in sequence. A typical pipeline progresses through three stages:

1. **Flattening removal** using either `obpo-plugin`, `d810-ng`, `ollvm-unflattener`, or `ollvm-breaker` to restore the original CFG.
2. **MBA and opaque-predicate simplification** employing `angr Deobfuscator` or `Triton`/`Miasm` to resolve arithmetic obfuscation.
3. **Architecture-specific cleanup** utilizing `deollvm` for ARM64 binaries or `GOOMBA` for Ghidra-based workflows.

The repository documents these integration patterns in [`skills/reverse-engineering/references/ollvm-deobfuscation.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/reverse-engineering/references/ollvm-deobfuscation.md), which provides configuration files and command-line options for automating these pipelines.

## Key Repository Files and References

| File | Purpose |
|------|---------|
| [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md) | High-level routing table that maps OLLVM variants to appropriate deobfuscation tools and execution contexts. |
| [`skills/reverse-engineering/references/ollvm-deobfuscation.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/reverse-engineering/references/ollvm-deobfuscation.md) | Detailed documentation for each tool, installation requirements, and example automation pipelines. |
| [`skills/reverse-engineering/tools-advanced.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/reverse-engineering/tools-advanced.md) | Comparative analysis of angr, Triton, and Miasm frameworks with performance benchmarks. |
| [`skills/reverse-engineering/patterns.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/reverse-engineering/patterns.md) | Pattern-matching rules for identifying specific OLLVM variants (Hikari, Polaris, O-MVLL) to inform tool selection. |
| [`skills/pentest-tools/src-hunter/references/tools/mcp-jshook.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/pentest-tools/src-hunter/references/tools/mcp-jshook.md) | Integration guide for wiring deobfuscation hooks into automated source-hunting frameworks. |

## Summary

- The reverse-skill repository provides **eight distinct OLLVM deobfuscation tools** spanning IDA Pro, Binary Ninja, Ghidra, angr, Miasm, and Unicorn frameworks.
- **obpo-plugin** delivers the strongest interactive deobfuscation for IDA Pro users, while **d810-ng** offers a lighter Python-based alternative for the same platform.
- **ollvm-unflattener** and **angr Deobfuscator** enable fully headless automation without commercial disassembler dependencies.
- **deollvm** specifically targets ARM64 binaries through dynamic Unicorn emulation, capturing runtime state that static analysis misses.
- Complex obfuscation schemes benefit from **chained pipelines** documented in [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md), typically progressing from flattening removal through MBA simplification to architecture-specific cleanup.

## Frequently Asked Questions

### When should I use angr instead of the IDA Pro plugins?

Use **angr Deobfuscator** when you require fully automated, headless analysis without commercial disassembler licenses or when integrating deobfuscation into CI pipelines. The IDA Pro plugins (`obpo-plugin` and `d810-ng`) provide superior interactive control and immediate visual feedback within the Hex-Rays decompiler, making them preferable for manual reverse engineering tasks where you need to inspect intermediate states.

### Which tool handles modern OLLVM variants like Hikari and O-MVLL best?

The **obpo-plugin** maintains the broadest support for modern OLLVM derivatives including Hikari, Polaris, O-MVLL, Arkari, Tigress, Hodur, and Approov according to the source analysis. For binaries protected with these variants, start with obpo-plugin in IDA Pro; if automation is required, combine **ollvm-unflattener** for flattening removal with **Triton** or **angr** for MBA simplification, as these symbolic engines handle variant-specific opaque predicates through constraint solving rather than pattern matching.

### How do I deobfuscate ARM64 binaries without IDA Pro?

For ARM64 binaries lacking commercial tool access, use **deollvm** which executes the target under Unicorn emulation to capture the true control flow dynamically. Alternatively, **angr Deobfuscator** supports ARM64 architecture in pure Python without requiring IDA Pro or Binary Ninja licenses, making it suitable for Linux-based analysis servers.

### Can I chain multiple deobfuscation tools together automatically?

Yes. The repository documents pipeline architectures in [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md) and [`skills/reverse-engineering/references/ollvm-deobfuscation.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/reverse-engineering/references/ollvm-deobfuscation.md) that allow you to chain tools sequentially. A typical automated pipeline invokes `ollvm-unflattener` or `d810-ng` for initial flattening removal, pipes the output to **angr** or **Triton** for MBA simplification, and finally applies `deollvm` for architecture-specific cleanup if targeting ARM64.