Generic O-LLVM Automatic Multi-architecture Deobfuscation Framework Based on Symbolic Execution

Abstract

Nowadays, the O-LLVM obfuscation framework makes it difficult to analyze various types of malware. To address this problem, this paper proposes a multi-architecture automated deobfuscation framework GOAMD specifically for O-LLVM obfuscation technology, which can intelligently identify the differences of programs on different architectures and perform targeted deobfuscation work on them. The experimental results show that the framework has high deobfuscation accuracy and portability.