Deobf All

Deobf-All — Unified Deobfuscation Dispatcher

When you encounter any obfuscated or protected code, this skill triages the target first, then loads only the relevant sub-skills — not all 26 at once. This minimises tool calls and context usage.

0. EXECUTION CONTRACT (read first)

DO NOT read_skill all 26 sub-skills blindly.
Instead: triage → load P0 → route → load P1/P2 only if needed.

Goal: never exceed 5 read_skill calls per invocation unless the target is truly unknown.

1. SUB-SKILL INVENTORY

2. TRIAGE — Do This First (before any read_skill)

Inspect the target and determine:

1. Target type: native binary (ELF/PE/Mach-O) / JavaScript / bytecode (DotNet/Java/Python) / Android APK / other
2. Obfuscation family (if identifiable): CFF, VM protection, string encryption, packing, JS obfuscator (obfuscator.io, JSFuck, etc.)
3. Presence of anti-debug / anti-reversing layers
4. Context: CTF challenge? Production analysis? Quick cleanup?

Output: A triage line, e.g. TRIAGE: native PE, VMProtect, has anti-debug → P0:code-obfuscation-deobfuscation P1:vm-and-bytecode-reverse,anti-debugging-techniques

3. ROUTING MATRIX — Load Only What's Needed

Based on triage, read_skill only for the skills marked ✓:

3a. Core Routing — P0 / P1 / P2

Rule: If a cell is empty, do NOT load that skill. This keeps tool calls minimal.

3b. P3 Tooling Selector — Load When Deeper Analysis Demands It

After loading P0-P2 per the core matrix, if the deobfuscation encounters a specific bottleneck, load the matching P3 tool:

Rule: Only load one P3 skill at a time, and only when the P0-P2 workflow hits a specific bottleneck that the P3 tool addresses.

4. WORKFLOW

Step 1: Triage (0–1 tool call)

Inspect the target. Use read_file for source code or file/DIE/PEiD output for binaries. Produce the triage line.

Step 2: Load P0 (1–2 tool calls)

read_skill for the P0 skill(s) the route demands. For native binaries that's code-obfuscation-deobfuscation; for JavaScript that's ast-deobfuscation.

Step 3: Load P1/P2 only if routed (0–3 tool calls)

Only read_skill for P1/P2 skills that the routing matrix marks ✓ for your target type.

Step 4: Deobfuscate

• Static first: pattern matching, CFF reduction, string decryption, dispatcher inlining
• Dynamic if blocked: debugger scripting, emulation, symbolic execution
• For JS: run scripts/detect-patterns.js from ast-deobfuscation first, then apply the matching pipeline
• For JS malware / phishing: load deobfuscating-javascript-malware (P3) for web-specific deobf patterns
• For PowerShell: load deobfuscating-powershell-obfuscated-malware (P3) for layered AST/dynamic analysis
• For native: identify protector (VMProtect/Themida/OLLVM/custom) before choosing strategy
• For native with string encryption: load deobf-string (P3) to auto-decrypt runtime-decrypt loops
• For native with indirect branch obfuscation (CSEL+BR): load deobf-indirect (P3) for CFG recovery
• For LLVM-obfuscated targets: load llvm-obfuscation (P3) for OLLVM/CFF/bogus-CF reduction
• For binary lifting / recompilation: load binary-lifting (P3) to convert machine code → LLVM IR
• For disassembly / CFG / code patching: load binary-analysis-patterns (P3) as a general analysis aid
• For YARA signature authoring after analysis: load yara-rule-authoring (P3)
• For automated Ghidra headless analysis: load ghidra-headless (P3)
• For Ghidra malware analysis workflow: load reverse-engineering-malware-with-ghidra (P3)
• For dynamic instrumentation / runtime hooking: load frida-17 (P3)
• For radare2 disassembly / debugging / scripting: load radare2 (P3)
• For Java bytecode: decompile with java-decompile (CFR/Procyon/Fernflower)
• For Java bytecode with string obfuscation: also load deobf-string (P3)
• For Android APK: unpack with apktool, then decompile DEX with jadx
• For Android malware: also load reverse-engineering-android-malware-with-jadx + optionally scan Firebase config with firebase-apk-scanner

Step 5: Validate

• Compare deobfuscated output to original symptoms
• Verify functional equivalence
• Check for residual/nested obfuscation layers

5. FALLBACK — When Triage Is Uncertain

If you cannot determine the target type after inspection:

1. read_skill for deep-analysis (P2)
2. Follow deep-analysis methodology to classify the target
3. Return to the routing matrix with the classification result
4. Load the appropriate P0/P1 skills

This is the only scenario where you should load a P2 skill before P0.

6. QUICK REFERENCE CHECKLISTS

Native Binary

1. Triage: identify protector/packer (file, DIE, PEiD)
2. Load P0: code-obfuscation-deobfuscation
3. Anti-debug? → Load anti-debugging-techniques
4. VM-protected? → Load vm-and-bytecode-reverse
5. Stuck on CFF? → Load symbolic-execution-tools
6. Packed/protected? → Load binary-protection-bypass
7. Anti-reversing? → Load anti-reversing-techniques
8. String encryption? → Load deobf-string
9. Indirect branch obfuscation? → Load deobf-indirect
10. LLVM-obfuscated (OLLVM)? → Load llvm-obfuscation
11. Binary lifting / recompilation needed? → Load binary-lifting
12. Disassembly / CFG / patching? → Load binary-analysis-patterns
13. Dynamic instrumentation / hooking? → Load frida-17
14. Ghidra headless at scale? → Load ghidra-headless
15. Ghidra malware workflow? → Load reverse-engineering-malware-with-ghidra
16. radare2 preferred? → Load radare2
17. YARA signatures after analysis? → Load yara-rule-authoring
18. Deobfuscate → validate

JavaScript

1. Triage: identify obfuscator (obfuscator.io, JSFuck, custom)
2. Load P0: ast-deobfuscation
3. Run scripts/detect-patterns.js to identify site/framework
4. Apply matching pipeline (CFF reduction, string decryption, dispatcher inline)
5. Heavy obfuscation? → also load code-obfuscation-deobfuscation
6. JS malware / phishing / dropper? → Load deobfuscating-javascript-malware
7. PowerShell payload mixed in? → Load deobfuscating-powershell-obfuscated-malware
8. Re-parse after each stage → validate

CTF

1. Load P2: ctf-reverse + deep-analysis
2. Identify challenge type (VM, packing, crypto, custom)
3. Load P0/P1 per routing matrix
4. String encryption in challenge? → Load deobf-string
5. VM-based challenge? → also consider deobf-indirect
6. OLLVM/CFF challenge? → also consider llvm-obfuscation
7. Dynamic analysis needed? → Load frida-17 or radare2
8. Solve → validate flag

Java / Android

1. Triage: JAR/class file? Android APK?
2. Java bytecode → Load P2: java-decompile
3. Android APK → Load P2: jadx (and apktool for unpacking if needed)
4. Android malware analysis → also load reverse-engineering-android-malware-with-jadx
5. Firebase config scan → Load P3: firebase-apk-scanner
6. String obfuscation? → also load deobf-string
7. Dynamic instrumentation? → Load frida-17
8. Decompile → analyze → validate

PowerShell / JS Malware

1. Triage: identify obfuscation layers (base64, XOR, compression, eval chains)
2. PowerShell → Load P3: deobfuscating-powershell-obfuscated-malware
3. JavaScript malware → Load P0: ast-deobfuscation + also load deobfuscating-javascript-malware
4. Apply layered deobf (Unicode → decode → AST cleanup)
5. YARA signatures post-analysis? → Load yara-rule-authoring
6. Validate behavioral equivalence

Generic P3 Tooling — Load When Bottleneck Appears

1. String encryption? → deobf-string
2. Indirect branch / CFG blocked? → deobf-indirect
3. LLVM obfuscation? → llvm-obfuscation
4. Binary lifting? → binary-lifting
5. General binary analysis? → binary-analysis-patterns
6. Automated Ghidra? → ghidra-headless
7. Ghidra malware workflow? → reverse-engineering-malware-with-ghidra
8. Live hooking / tracing? → frida-17
9. radare2 scripting? → radare2
10. YARA signatures? → yara-rule-authoring