xqzme / working notes

0d<         14a         2f#a*5z0d         2f#a9-4q&c1e>9-      e25         e>9      e>9-4q&9z0d<8+3
x%b         /6m         z0d<8+36m         4q6m1e>9-4q&c=7      %b/         6m1      e5z0d<8+3x%b7e2
f+3         2f#      <8b         >9-                  43x      +3x%b/   e>9m=0      8+3
/6c         z0d      z0d         c=7                  d<8      6m1eq&   *5z0d<      0d<
   a*5   9-4         >9-         z06               +3x         %#a   0d<   *5z      x<1
   2f#   z06         c=7         e<8               >2f         0e2   *5z   8+0      =7e
      m1e            b/&         %b/            +32            *5z   %bq   q&c      q&c=7e2f#a*2
      4q&            d<8         e>&            &c=            -4a   q&c   9-4      2f#7d%b/6m1e
   <8e   4q&         %b/   4q*   dm1         7e2               q&c         =7e      b/6
   4q&   d<8         #a*   6m=   f#a         dm1               9-4         3x%      a*%
5z0         e2f      6c=      *5z         7e2                  f+3         mf+      m1e
+3x         %b/      f#a      %4q         x%b                  3x%         b/6      #a*
d<8         7e2         -4q*5z   1e>      =7e2f=0dm1e><8+      <8+         a*f      d<-4a*5z0d<8+3x
<4q         *<1         /6m1e>   q&c      /6m1ed<8+3*5z0d      b/>         5z0      5z0d<8+06-4q&c=

current:: LLVM MachineIR / MBA / devirtualization

work / unfinished

A²MBA-LLVMC++ / LLVM 21

Mixed Boolean-arithmetic. A pass plugin. i32, i64.

Context Trap / nonlinear envelopes / post-O3 checks.

context-trap / parameter-space check

combinations checked     6024 / 6024
verification failures       0
toolchain                LLVM 21.1.8

archived run · 2026-08-22 ↗

promba: still unhappy

XQVMC++20

VM experiments. Typed MachineIR, physical islands, a streaming verifier.

status: rewriting parts I shouldn't have written this way

Amice-Deobfuscatorrust

LLVM IR / strings / PE64. Static only.

No guessed ISA; malformed descriptors stop decoding.

smaller tools

nasm-seh64: prologues ↔ .pdata / .xdata
Deobfusk8: strings + API extraction from obfusk8 PE64
BinProtect-Devirtualizer: x86-64 / static devirtualization
AntiObfusHunter: counter-measures for ObfusHunter

notes / loose ends

2026-09-19

stateful regions / flat export

100 stateful expressions. The export limit was 100,000 nodes.

report

cheater.to / SalatStealer, WebRat

Static analysis notes and a defensive guard.