D810G

English | 中文

Deobfuscation framework for Ghidra — the most comprehensive open-source deobfuscation toolkit for the Ghidra reverse engineering platform.

D810G brings D-810-level deobfuscation capabilities to Ghidra. It uses a hybrid Java + Python architecture: a Ghidra plugin handles UI and binary patching, while a Python engine powered by Z3, Unicorn, Capstone, and Keystone performs the heavy analysis.

Key Features

Module	Description
Control Flow Deflattening	OLLVM + Tigress CFF recovery via Unicorn emulation
MBA Simplification	96 rules with multi-pass iterative simplification and Z3 verification
Opaque Predicate Elimination	Standard + advanced (number theory, integer arithmetic)
Bogus Control Flow Removal	Detect and strip fake branches guarded by opaque predicates
Dead Code Elimination	BFS reachability analysis + NOP patching
String Decryption	XOR, multi-byte XOR, RC4, substitution table, ROT-N
VM Devirtualization	Tigress VM dispatcher detection, handler classification, bytecode tracing
Full Pipeline	7-pass auto-chaining with fixpoint iteration
Standalone CLI	Use without Ghidra: `simplify`, `opaque`, `interactive`, `pipeline`
Ghidra Analyzer	One-click automatic deobfuscation during analysis

Quick Start (CLI — no Ghidra needed)

git clone https://github.com/overkazaf/D810G.git
cd D810G
python3 -m venv .venv && source .venv/bin/activate
pip install z3-solver unicorn keystone-engine capstone

MBA Simplification

$ PYTHONPATH=python python -m d810g_engine cli simplify "(x | y) - (x & y)"
  (x | y) - (x & y)
  → (x ^ y) (Z3 verified)
  Rule: mba_xor_1

Multi-Pass Deep Simplification

$ PYTHONPATH=python python -m d810g_engine cli simplify --deep \
    "((x | y) - (x & y)) ^ ((x | y) - (x & y))"
  ((x | y) - (x & y)) ^ ((x | y) - (x & y))
  → ((x ^ y) ^ ((x | y) - (x & y)))  (step 1, mba_xor_1)
  → ((x ^ y) ^ (x ^ y))              (step 2, mba_xor_1)
  → 0                                 (step 3, mba_zero_1)
  Final: Z3 verified equivalent
  Iterations: 3, fixpoint: True

Opaque Predicate Detection

$ PYTHONPATH=python python -m d810g_engine cli opaque "x == x"
  x == x
  → ALWAYS TRUE  — opaque, can be eliminated

$ PYTHONPATH=python python -m d810g_engine cli opaque "(x & 1) == 2"
  (x & 1) == 2
  → ALWAYS FALSE — opaque, can be eliminated

$ PYTHONPATH=python python -m d810g_engine cli opaque "x > 5"
  x > 5
  → DYNAMIC      — real condition, keep as-is

Interactive Rule Editor

$ PYTHONPATH=python python -m d810g_engine cli interactive
  D810G Interactive Rule Editor
  Loaded 96 rules from 6 files

d810g> test (x | y) - (x & y)
  → (x ^ y)  [Z3 verified]
     Rule: mba_xor_1

d810g> verify (x & y) + (x ^ y) = x | y
  8-bit:  EQUIVALENT
  16-bit: EQUIVALENT
  32-bit: EQUIVALENT
  64-bit: EQUIVALENT

d810g> add my_rule ~(~x & ~y) = x | y
  Added rule 'my_rule': ~(~x & ~y) -> x | y [verified]

All CLI Commands

PYTHONPATH=python python -m d810g_engine cli simplify "<expr>"      # one-shot simplify
PYTHONPATH=python python -m d810g_engine cli simplify --deep "<expr>" # multi-pass
PYTHONPATH=python python -m d810g_engine cli opaque "<condition>"    # classify predicate
PYTHONPATH=python python -m d810g_engine cli rules                   # list all 96 rules
PYTHONPATH=python python -m d810g_engine cli rules --verify          # Z3-verify all rules
PYTHONPATH=python python -m d810g_engine cli batch < exprs.txt       # batch simplify
PYTHONPATH=python python -m d810g_engine cli interactive             # REPL mode
PYTHONPATH=python python -m d810g_engine cli pipeline input.json     # full pipeline

Demo Scripts

D810G ships with 8 interactive demo scripts showcasing every module. Run them all at once or individually:

# Run all demos
PYTHONPATH=python python demo/demo_all.py

# Or run individually
PYTHONPATH=python python demo/demo_mba.py         # MBA simplification (7 examples + Z3 proof table)
PYTHONPATH=python python demo/demo_deep_mba.py     # Multi-pass iterative simplification
PYTHONPATH=python python demo/demo_opaque.py       # Opaque predicate detection (always_true/false/dynamic)
PYTHONPATH=python python demo/demo_bcf.py          # Bogus control flow removal (3-layer BCF + ASCII diagrams)
PYTHONPATH=python python demo/demo_deflat.py       # Control flow deflattening (OLLVM state machine)
PYTHONPATH=python python demo/demo_strings.py      # String decryption (XOR / RC4 / multi-byte / ROT-N)
PYTHONPATH=python python demo/demo_vm.py           # VM devirtualization (handler table + Fibonacci pseudocode)
PYTHONPATH=python python demo/demo_pipeline.py     # Full 7-pass pipeline with fixpoint iteration

Ghidra Integration

Plugin (Manual)

Build the extension (see Building from Source)
In Ghidra: File > Install Extensions > Add extension (select the zip)
Right-click any function → D810G > Deobfuscate Function
Results appear in the D810G Results panel

Analyzer (Automatic)

D810G includes a Ghidra Analyzer that automatically detects and deobfuscates functions during analysis:

Open Analysis > Auto Analyze options
Enable D810G Deobfuscation
Run analysis — D810G scans all functions for obfuscation patterns and deobfuscates suspicious ones

Headless Script

analyzeHeadless /path/to/project Project -import binary.exe \
    -postScript headless_deobfuscate.py

Screenshots

More screenshots

Obfuscated code (before):

Right-click to deobfuscate:

Clean code (after):

Architecture

Deobfuscation Pipeline

The full pipeline runs 7 passes in optimal order, iterating until no more changes:

Supported Obfuscation

Technique	Status	Details
OLLVM Control Flow Flattening	✅	Switch-dispatch + Unicorn emulation + Keystone patching
Tigress CFF (indirect jump)	✅	Jump table detection and resolution
Tigress CFF (if-chain)	✅	Sequential comparison chain detection
OLLVM Bogus Control Flow	✅	Opaque predicate-guarded fake branch removal
MBA Expressions	✅	96 rules, multi-pass iterative, sub-expression recursive
Opaque Predicates (standard)	✅	Z3 bitvector satisfiability analysis
Opaque Predicates (advanced)	✅	Integer arithmetic fallback + number theory patterns
Dead Code Elimination	✅	BFS reachability + NOP fill (x86/ARM64/ARM32)
String Encryption (XOR)	✅	Single-byte, multi-byte, XOR-with-index
String Encryption (RC4)	✅	Brute-force key search
String Encryption (substitution)	✅	ROT-N and custom lookup tables
Tigress VM (detection)	✅	Dispatcher detection + handler classification
Tigress VM (bytecode tracing)	✅	Execution simulation + pseudocode generation
Full Pipeline	✅	7-pass auto-chain with fixpoint iteration
Standalone CLI	✅	simplify, opaque, rules, batch, interactive, pipeline
Ghidra Analyzer	✅	Automatic analysis integration
Ghidra Headless	✅	Batch scan via `analyzeHeadless`

Architecture Support

Architecture	Deflattening	Patching	Dead Code
x86_64	✅	✅	✅
ARM64 (AArch64)	✅	✅	✅
ARM32	✅	✅	✅

MBA Rule Sets

D810G ships with 96 rules across 6 rule files:

Rule Set	Count	Description
`mba_basic.json`	7	Fundamental MBA identities (XOR, AND, OR equivalences)
`mba_hackers_delight.json`	16	Bit manipulation from Hacker's Delight (abs, min, max, De Morgan)
`mba_ollvm.json`	10	OLLVM instruction substitution patterns
`mba_constant_folding.json`	10	Algebraic identities and constant folding
`mba_advanced.json`	28	Advanced MBA patterns (nested, multi-variable, compound)
`mba_chains.json`	25	Chained MBA transformations for deep simplification

Adding Custom Rules

Create a JSON file in data/rules/:

{
  "name": "my_rules",
  "description": "Custom MBA rules",
  "rules": [
    {
      "id": "my_xor_1",
      "pattern": "(x | y) ^ (x & y)",
      "replacement": "x ^ y",
      "commutative": true,
      "description": "XOR via OR XOR AND"
    }
  ]
}

Or use the interactive editor:

PYTHONPATH=python python -m d810g_engine cli interactive
d810g> add my_rule (x | y) ^ (x & y) = x ^ y
d810g> save my_rules.json

Installation

Option 1: CLI Only (no Ghidra)

git clone https://github.com/overkazaf/D810G.git
cd D810G
python3 -m venv .venv && source .venv/bin/activate
pip install z3-solver unicorn keystone-engine capstone

Option 2: Ghidra Extension

# Build
export GHIDRA_INSTALL_DIR=/path/to/ghidra_11.x
cd D810G
$GHIDRA_INSTALL_DIR/support/gradle/gradlew buildExtension

# Install
# In Ghidra: File > Install Extensions > select dist/*.zip
# Set up venv in the extension directory:
cd <ghidra_extensions>/D810G
python3 -m venv .venv && source .venv/bin/activate
pip install z3-solver unicorn keystone-engine capstone

Building from Source

Requirements

JDK 17+
Ghidra 11.x
Python 3.11+
pip install z3-solver unicorn keystone-engine capstone pytest

Build & Test

# Build Ghidra extension
export GHIDRA_INSTALL_DIR=/path/to/ghidra
$GHIDRA_INSTALL_DIR/support/gradle/gradlew buildExtension

# Run all 398 tests
source .venv/bin/activate
PYTHONPATH=python python -m pytest test/ -v

Test Modules

python -m pytest test/test_deflattener.py     # CFF + Unicorn emulation (12 tests)
python -m pytest test/test_tigress.py         # Tigress variants (6 tests)
python -m pytest test/test_mba.py             # MBA matching (9 tests)
python -m pytest test/test_mba_extended.py    # 96-rule Z3 verification (41 tests)
python -m pytest test/test_mba_deep.py        # Multi-pass simplification (8 tests)
python -m pytest test/test_opaque.py          # Opaque predicates (6 tests)
python -m pytest test/test_opaque_advanced.py # Advanced predicates (11 tests)
python -m pytest test/test_bcf.py             # Bogus control flow (10 tests)
python -m pytest test/test_dce.py             # Dead code elimination (14 tests)
python -m pytest test/test_strings.py         # String decryption (19 tests)
python -m pytest test/test_virtualization.py  # VM analysis (13 tests)
python -m pytest test/test_vm_tracer.py       # Bytecode tracing (13 tests)
python -m pytest test/test_pipeline.py        # Full pipeline (9 tests)
python -m pytest test/test_cli.py             # CLI commands (7 tests)
python -m pytest test/test_interactive.py     # Interactive editor (10 tests)
python -m pytest test/test_protocol.py        # IPC protocol (4 tests)
python -m pytest test/test_parser.py           # Shared expression parser (12 tests)
python -m pytest test/test_vm_disasm.py        # VM disassembly + Capstone (10 tests)
python -m pytest test/test_mba_advanced_chains.py # Advanced + chained MBA rules (35 tests)
python -m pytest test/test_real_binary.py      # Realistic binary test cases (12 tests)
python -m pytest test/test_integration.py     # Integration (9 tests)

Project Structure

D810G/
├── src/main/java/d810g/         # Ghidra plugin (Java)
│   ├── D810GPlugin.java         # Plugin entry point
│   ├── D810GAnalyzer.java       # Auto-analysis integration
│   ├── engine/                  # Python process management + JSON-RPC
│   ├── core/                    # Orchestrator, PatchManager, PcodeUtils
│   ├── actions/                 # Right-click menu actions
│   └── ui/                      # Results panel
├── python/d810g_engine/         # Analysis engine (Python)
│   ├── server.py                # JSON-RPC server
│   ├── cli.py                   # Standalone CLI
│   ├── interactive.py           # Interactive rule editor
│   ├── deflattener/             # OLLVM + Tigress + Unicorn
│   ├── mba/                     # Rules + matcher + Z3 verifier
│   ├── opaque/                  # Standard + advanced predicates
│   ├── bcf/                     # Bogus control flow
│   ├── dce/                     # Dead code elimination
│   ├── strings/                 # String decryption (XOR/RC4/sub)
│   ├── virtualization/          # VM analysis + bytecode tracer
│   └── pipeline/                # Multi-pass orchestrator
├── data/rules/                  # MBA rule definitions (96 rules)
├── test/                        # 398 tests
├── demo/                        # Demo scripts
├── scripts/                     # Headless analysis scripts
└── .github/workflows/           # CI (Python 3.11/3.12/3.13)

Credits

D810G is inspired by:

D-810 — the original IDA Pro deobfuscation plugin by eShard
D-810-ng — community fork with updates

Built to bring these capabilities — and more — to the Ghidra reverse engineering ecosystem.

License

Apache License 2.0. See LICENSE for details.

Name		Name	Last commit message	Last commit date
.github/workflows		.github/workflows
data		data
demo		demo
docs		docs
python/d810g_engine		python/d810g_engine
scripts		scripts
src/main/java/d810g		src/main/java/d810g
tapes		tapes
test		test
.gitignore		.gitignore
CHANGELOG.md		CHANGELOG.md
CONTRIBUTING.md		CONTRIBUTING.md
LICENSE		LICENSE
Module.manifest		Module.manifest
README.md		README.md
README_CN.md		README_CN.md
build.gradle		build.gradle
extension.properties		extension.properties
pyproject.toml		pyproject.toml
requirements-dev.txt		requirements-dev.txt
requirements.txt		requirements.txt
settings.gradle		settings.gradle

Navigation Menu

Repository navigation

About

Repository files navigation

D810G

Key Features

Quick Start (CLI — no Ghidra needed)

MBA Simplification

Multi-Pass Deep Simplification

Opaque Predicate Detection

Interactive Rule Editor

All CLI Commands

Demo Scripts

Ghidra Integration

Plugin (Manual)

Analyzer (Automatic)

Headless Script

Screenshots

Architecture

Deobfuscation Pipeline

Supported Obfuscation

Architecture Support

MBA Rule Sets

Adding Custom Rules

Installation

Option 1: CLI Only (no Ghidra)

Option 2: Ghidra Extension

Building from Source

Requirements

Build & Test

Test Modules

Project Structure

Credits

License

About

Releases

Packages

Contributors

Languages

Latest commit

History

Folders and files

Repository files navigation

D810G

Key Features

Quick Start (CLI — no Ghidra needed)

MBA Simplification

Multi-Pass Deep Simplification

Opaque Predicate Detection

Interactive Rule Editor

All CLI Commands

Demo Scripts

Ghidra Integration

Plugin (Manual)

Analyzer (Automatic)

Headless Script

Screenshots

Architecture

Deobfuscation Pipeline

Supported Obfuscation

Architecture Support

MBA Rule Sets

Adding Custom Rules

Installation

Option 1: CLI Only (no Ghidra)

Option 2: Ghidra Extension

Building from Source

Requirements

Build & Test

Test Modules

Project Structure

Credits

License

About

Topics

Resources

Contributing

Stars

Watchers

Forks

Releases

Packages

Contributors

Languages