Tool

D-810 ng

A refactored, updated fork of Boris Batteux's D-810 IDA Pro plugin that deobfuscates code at decompilation time by rewriting Hex-Rays microcode. Z3-verified instruction rules simplify mixed-boolean-arithmetic, opaque predicates and constant obfuscation across maturity levels, while control-flow unflatteners restore natural flow from O-LLVM, Tigress, Approov and Hodur (PlugX) dispatcher patterns. Rules are declared in a configurable DSL and project JSON, so new patterns can be added without editing the source, and optional Cython extensions speed up the hot paths with pure-Python fallbacks.

Targets: Binary
Category: Native analysis tools
Relationship: Foundation tool
Sources reviewed: 2026-10-27

Stars: 332
Last commit: 2026-08-08
Language: Python
License (GitHub): AGPL-3.0

GitHub data as of 2026-11-09

Copy as Markdown View JSON Cite

Requirements & limits

IDA 9 or later with Python 3.10+ is required. Copy the repository into IDA’s plugins directory and load it with Ctrl-Shift-D. The README warns that incorrect microcode edits can crash IDA.
The pure-Python install uses pip install -e .; optional Cython speedups clone the public MIT-licensed Hex-Rays IDA SDK unless IDA_SDK names an existing copy. The z3-solver helper installs into an isolated user directory, configurable with D810_SPEEDUPS_DIR.
The committed LICENSE is AGPL-3.0, while the README states LGPL v3. The project credits Boris Batteux’s D-810 and Rolf Rolles’s HexRaysDeob.

Cite

BibTeX

@misc{d810-ng,
  title = {{D-810 ng}},
  howpublished = {\url{https://github.com/w00tzenheimer/d810-ng}},
  url = {https://github.com/w00tzenheimer/d810-ng},
  urldate = {2026-10-27},
  note = {Awesome REA entry: \url{https://awesomerea.org/resources/d810-ng/}}
}

Plain text

D-810 ng. https://github.com/w00tzenheimer/d810-ng (accessed 2026-10-27). Awesome REA entry: https://awesomerea.org/resources/d810-ng/

Useful? Star Awesome REA on GitHub2.4k

About this entry

The description was reviewed against primary sources.

Report an outdated entry Suggest a translation fix

Primary sources

README.md GitHub · w00tzenheimer/d810-ng · Revision 2e59ab4
README.md#L174-L270 GitHub · w00tzenheimer/d810-ng · Revision 2e59ab4
samples/README.md GitHub · w00tzenheimer/d810-ng · Revision 2e59ab4
samples/Makefile GitHub · w00tzenheimer/d810-ng · Revision 2e59ab4
setup.py GitHub · w00tzenheimer/d810-ng · Revision 2e59ab4
pyproject.toml GitHub · w00tzenheimer/d810-ng · Revision 2e59ab4
LICENSE GitHub · w00tzenheimer/d810-ng · Revision 2e59ab4