{
  "added_at": "2026-11-02",
  "additional_evidence_urls": [
    "https://github.com/cdong1012/ollvm-unflattener/blob/d0062012b66ab2c845207c733216900d5e99f0a9/requirements.txt",
    "https://github.com/cdong1012/ollvm-unflattener/blob/d0062012b66ab2c845207c733216900d5e99f0a9/unflattener/__main__.py",
    "https://github.com/cdong1012/ollvm-unflattener/blob/d0062012b66ab2c845207c733216900d5e99f0a9/unflattener/unflattener.py",
    "https://github.com/cdong1012/ollvm-unflattener/blob/d0062012b66ab2c845207c733216900d5e99f0a9/unflattener/binrewrite.py",
    "https://github.com/cdong1012/ollvm-unflattener/tree/d0062012b66ab2c845207c733216900d5e99f0a9/samples",
    "https://github.com/cdong1012/ollvm-unflattener/blob/d0062012b66ab2c845207c733216900d5e99f0a9/samples/linux/CFF_full.c",
    "https://github.com/cdong1012/ollvm-unflattener/blob/d0062012b66ab2c845207c733216900d5e99f0a9/LICENSE",
    "https://github.com/cdong1012/ollvm-unflattener/releases/tag/v2.0",
    "https://github.com/cea-sec/miasm/blob/3671fc24d6e625c2d75f3311724eb6b0c97664f8/LICENSE",
    "https://github.com/keystone-engine/keystone/blob/dc7932ef2b2c4a793836caec6ecab485005139d6/EXCEPTIONS-CLIENT"
  ],
  "category": "native-analysis",
  "description_en": "Python command-line deobfuscator for the control-flow flattening applied by Obfuscator-LLVM (OLLVM). Given a flattened function's address, it uses Miasm's symbolic execution to track the dispatcher's state variable, records which blocks each state value selects and which state follows it, and writes a copy of the binary in which the function is reassembled with Keystone in its recovered order; an optional mode also follows the function's calls. The README covers 32- and 64-bit x86 Windows and Linux binaries and contrasts this approach with MODeflattener's static one.",
  "description_zh": "针对 Obfuscator-LLVM（OLLVM）控制流平坦化的 Python 命令行去混淆工具。给定被平坦化函数的地址后，它借助 Miasm 的符号执行跟踪分发器的状态变量，记录每个状态值对应的基本块及其后继状态，再用 Keystone 按恢复出的顺序重新汇编该函数，并写出一份修改后的二进制副本；可选模式还会沿该函数的调用继续处理。README 涵盖 32 位和 64 位 x86 的 Windows 与 Linux 二进制，并将这种做法与 MODeflattener 的静态方法作了对比。",
  "entry_url": "https://awesomerea.org/resources/ollvm-unflattener/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/ollvm-unflattener/",
  "evidence_url": "https://github.com/cdong1012/ollvm-unflattener/blob/d0062012b66ab2c845207c733216900d5e99f0a9/README.md",
  "group": "tools",
  "id": "ollvm-unflattener",
  "json_url": "https://awesomerea.org/resources/ollvm-unflattener/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/ollvm-unflattener/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/ollvm-unflattener/index.md",
  "name": "ollvm-unflattener",
  "name_zh": "ollvm-unflattener OLLVM 控制流平坦化去混淆工具",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "Latest release at review: v2.0, published 2025-04-16 without attached binaries; its notes call it most likely the final release, and the reviewed master commit is that tag and the repository's last push. The tool runs from a clone as python unflattener -i <input> -o <output> -t <hex address>, with -a to follow calls; there are no tests or CI.",
    "The README requires Python 3.10+ and Git; requirements.txt lists miasm, graphviz and keystone-engine without version pins. The code handles PE and ELF files for x86_32 and x86_64 and raises an error for other formats or architectures.",
    "The analyst supplies the obfuscated binary and the target function's address. Functions scoring below 0.9 on a dominator-based flattening heuristic are left unchanged, the dispatcher and state variable are located by structural assumptions about OLLVM's layout, and -a only follows calls into the .text section. Output is a patched copy in which the original function bytes are overwritten with int3 padding and the reassembled function is written at its start.",
    "The samples folder bundles small obfuscated test programs for 32- and 64-bit Linux and Windows (CFF.bin, CFF_full.bin, CFF_full_linux64.bin, CFF_win.exe, CFF_win_full.exe, CFF_win64.exe and CFF_win64_full.exe), their deob_* outputs and C/C++ sources for most of them; a comment in CFF_full.c says Claude generated that test program. The README's only reported result is a before/after control-flow graph of target_function in CFF_full.bin, with no check that deobfuscated binaries behave like the originals.",
    "Apache-2.0; the dependencies keep their own licenses, including GPL-2.0-only for Miasm and GPL-2.0 with a FOSS exception for Keystone."
  ],
  "requirements_zh": [
    "审阅时最新版本为 v2.0，发布于 2025-04-16，未附带二进制文件；发布说明称这很可能是最后一个版本，所审阅的 master 提交即该标签，也是仓库最近一次推送。工具从克隆的仓库运行，命令为 python unflattener -i <输入> -o <输出> -t <十六进制地址>，加 -a 可沿调用继续处理；仓库没有测试或 CI。",
    "README 要求 Python 3.10+ 和 Git；requirements.txt 列出 miasm、graphviz 和 keystone-engine，均未固定版本。代码支持 x86_32 和 x86_64 的 PE 与 ELF 文件，遇到其他格式或架构会报错。",
    "分析者需提供被混淆的二进制以及目标函数的地址。在基于支配树的平坦化评分中低于 0.9 的函数不会被改动；分发器和状态变量依据对 OLLVM 代码布局的结构性假设来定位，-a 只跟进指向 .text 节的调用。输出是一份修改后的副本：原函数的字节被 int3 填充覆盖，重新汇编的函数写在其起始地址处。",
    "samples 目录附带面向 32 位与 64 位 Linux 和 Windows 的小型混淆测试程序（CFF.bin、CFF_full.bin、CFF_full_linux64.bin、CFF_win.exe、CFF_win_full.exe、CFF_win64.exe 和 CFF_win64_full.exe）、对应的 deob_* 输出，以及其中大多数程序的 C/C++ 源码；CFF_full.c 中的注释称该测试程序由 Claude 生成。README 唯一报告的结果是 CFF_full.bin 中 target_function 去混淆前后的控制流图，没有检验去混淆后的二进制与原程序行为是否一致。",
    "采用 Apache-2.0 许可；依赖保留各自的许可证，其中 Miasm 为 GPL-2.0-only，Keystone 为附带 FOSS 例外的 GPL-2.0。"
  ],
  "targets": [
    "binary"
  ],
  "url": "https://github.com/cdong1012/ollvm-unflattener",
  "verification": "source-reviewed",
  "verified_at": "2026-10-20"
}