Course Details

Modern reverse engineering is moving toward automation, custom tooling, and agent-assisted workflows. These workflows speed up formerly slow and manual analysis tasks, but they quickly run into limits when binaries actively resist analysis through control-flow obfuscation, virtualization, mixed Boolean-Arithmetic (MBA), and other transformations. This training teaches the deobfuscation techniques, validation strategies, and automation patterns needed to make reverse engineering workflows effective on real-world protected targets.

Participants first learn how modern obfuscation techniques complicate reverse engineering, and then gradually build the deobfuscation techniques required to attack them in hands-on sessions. Along the way, they deepen their understanding of program analysis and learn when and how to apply different techniques in practice.

We begin with core obfuscation patterns and practical ways to attack them. Participants learn how to recognize common protection mechanisms, understand how they interfere with analysis and decompilation, and gain traction through careful manual analysis and targeted cleanup.

Early in the course, we introduce automation and agent-assisted reverse engineering as a practical layer on top of manual analysis. Participants learn how to set up analysis environments that make automated workflows easier to run, inspect, and repeat. They then learn how to divide analysis goals into smaller tasks, connect the required tools and scripts to the workflow, preserve useful intermediate artifacts, and validate each step. The goal is to turn manual expertise into repeatable, validated workflows that can be reused on related targets.

From there, the course builds toward more powerful reasoning with SMT-based analysis. Participants learn how to prove properties of code, reason about complex computations, and verify whether MBA-heavy expressions are equivalent to simpler rewrites. SMT then becomes a recurring building block for the automated techniques that follow.

To scale the analysis, the training introduces intermediate representations and compiler-style simplification passes that help normalize protected code and expose higher-level control-flow structures. On top of this, participants use symbolic execution to automate larger parts of deobfuscation, combine symbolic reasoning with SMT solving to attack opaque predicates, and explore feasible execution paths through protected code.

Building on these foundations, the course then returns to virtualization-based obfuscation. Participants learn how to use symbolic execution to identify virtual machine components, reason about instruction handlers, validate recovered semantics against traces, and write custom disassemblers and analysis helpers to reconstruct original program behavior.

The training also covers MBA simplification and program synthesis. Participants simplify code based on observed behavior, use synthesis to recover compact expressions, apply algebraic simplification techniques, and validate the correctness of simplified computations. These techniques are used to attack MBA-heavy expressions and to recover instruction-handler semantics of virtual machines.

By the end of the training, participants will understand how these techniques fit together in practical deobfuscation pipelines. The final part of the course focuses on scaling these workflows across larger protected programs and related obfuscation components. We also examine why automated and agent-assisted analysis fails on hardened targets, including patterns that deliberately mislead tools and agents. Participants learn how to recover from these failures by improving the analysis setup, strengthening validation, and reintroducing human guidance where automation reaches its limits.

For more information on this training, please visit here.

Details last updated July 19, 2026

About the Instructor: Tim Blazytko

Tim Blazytko is a well-known binary security researcher and reverse-engineering expert with a PhD in program analysis. He focuses on independent consulting and hands-on work across reverse engineering and software protection. He regularly contributes to the reverse engineering community through trainings, international conference talks, research papers, and open-source tools. Furthermore, he supports clients with advanced binary analysis, malware investigations, and security audits. Tim also serves as Chief Scientist at Emproof.