Overview›SLOP8445
Seeing Through Obfuscated Code
Obfuscation, assembly, and recovering program semantics. Demonstration course, Semester 2, 2026 — the teaching weeks and dates below are fictional.
Demonstration teaching week 12 of 12, derived from this course's fixed fictional term dates. It is not the real ANU teaching calendar.
Course information
- Course outline and how this course runsPageWhat the twelve weeks do, the one program they all work on, and the reading habit the whole course is built around.
- Software and lab accessPageWhat you need installed, what the lab image is for, and why every core exercise has a route that works offline on any platform.
Assessments
- Assessment overviewPageFour pieces of assessment, what each one asks for, and the one criterion they share.
- A1 — Trace the transformationAssessmentFollow one operation from C to IR to x64 across a clean/obfuscated pair you have not seen, and write down what you established and what you did not.
- Week 6 evidence auditAssessmentA short marked exercise: take three published claims about this corpus and say, for each, exactly what evidence would settle it.
- A2 — Recover the semanticsAssessmentGiven a flattened or gated function, a recovered graph and a set of solver results, decide what has been established — and defend the boundary you draw.
- Capstone — Seeing through an unfamiliar binaryAssessmentOne sample, withheld identity, every method you have. Choose an approach, justify it, validate whatever you conclude, and state the boundary of your own result.
Week 1
- Lecture 1 — Same program, four storiesLectureWhy a compiler already makes a program harder to read before anyone tries to, and what it means to say two very different listings are the same function.
- From C to machine codePageOne computation, four truthful descriptions of it, and the beginning of a habit — saying which description you are looking at before you say what it means.
- Studio 1 — Find a constant, then follow its meaningPracticalLocate one XOR site in all three representations, say what the compiler added around it, and write the sentence you will repeat all semester.
Week 3
- Instruction substitutionPageThe oldest trick in the book, applied to twenty-four sites, and largely undone by the compiler backend before anyone tried to analyse it.
- Studio 3 — Follow one operation through the pairPracticalTake one ADD site and one XOR site, and account for what happened to each between the source and the executable.
Week 4
- Lecture 2 — Something always simplifies it for youLectureThree different things reduce obfuscated arithmetic, and confusing them is how people come to believe a simplifier recovered something it never touched.
- MBA and semantic simplificationPageMixed Boolean-arithmetic, the tools that reduce it, and the difference between a shorter expression and a proved one.
Week 7
- Lecture 3 — What a proof is worthLectureA solver can show a branch has only one reachable outcome. Turning that into a working executable takes a separate tool, and neither step is the same as knowing the program is still correct.
- Symbolic execution and SMTPageOne branch, two queries, and a solver that answers one with a witness and the other with nothing at all. Plus the assumption that turns zero proofs into three.
Week 9
- Control-flow flatteningPageThe dispatcher, the state variable, and why the thing being hidden here is not a value but a relationship — which block runs next.
- Studio 9 — Trace the dispatcherPracticalBuild the state table for one region by hand, and then say what the recovered graph could not have told you.
Week 10
- Lecture 4 — The smaller graph problemLectureTwo results in this corpus look like successes and are not. Both were caught by running the program; neither would have been caught by looking at the output.
- Unflattening and hidden assumptionsPageFour runs of one unmodified tool. Two working rewrites, one valid executable that returns the wrong answer, and one failure that never reached the part of the tool everybody talks about.
Other course resourcesresources with no week — filed here automatically
- Obfuscation terminologyReferenceCourse shorthand, with the qualification attached. Several of these definitions exist mainly to stop a word meaning two things in one sentence.
- What this course does and does not claimReferenceEvery empirical statement on this site, paired with the overclaim it is routinely confused with.
- Tools, and what each one actually producedReferenceA catalogue organised around one column — did this tool produce a working rewritten binary of the original specimen? For most of them the answer is no, and that is not a criticism.
- External: LLVM Language ReferenceExternalThe primary reference for LLVM IR syntax and instruction semantics. Use it whenever a week page says "check this against the primary source".
- External: The SMT-LIB standardExternalThe definition of the fixed-width bit-vector theory the week 7 and 8 queries are written in.