Skip to content

Latest commit

 

History

History
9 lines (7 loc) · 632 Bytes

unflat.md

File metadata and controls

9 lines (7 loc) · 632 Bytes

Unflattening

Here is a deep modification of original code by Rolf Rolles and Takahiro Haruyama to deal with nested flattening and jg/jle instead jz/jnz comparing were used in FinSpy (FinFisher) malware. As well it should be useful in RE other flattened malware.

Unflattener may be disabled/enabled in decompiler's context menu. Current state of unflattener reported in a comment in the first line of pseudocode.

Unflattening