D810: Creating an extensible deobfuscation plugin for IDA Pro

Published

2020-11-20 00:00

Collected

2026-10-19 12:29

---
id: 10067
title: "D810: Creating an extensible deobfuscation plugin for IDA Pro"
source_domain: eshard.com
source_url: "https://www.eshard.com/blog/d810-deobfuscation-ida-pro"
published_at: "2020-11-20T00:00:00Z"
tags: ["vulnerability-research", "software-security", "deobfuscation", "ida-pro", "eshard", "d810"]
phying_url: "https://phying.com/item/10067"
lang: en
---

# D810: Creating an extensible deobfuscation plugin for IDA Pro

## Summary

# Specify 1 representation of the pattern PATTERN = AstNode(m_sub, AstNode(m_add, AstLeaf("x"), AstLeaf("y")), AstNode(m_mul, AstConstant("2", 2), AstNode(m_and, AstLeaf("x"), AstLeaf("y"))))...

## Intelligence Metadata

- **Sources:** eshard.com
- **Published:** 2020-11-20T00:00:00Z
- **Original:** https://www.eshard.com/blog/d810-deobfuscation-ida-pro
- **Phying News:** https://phying.com/item/10067