# D-810 ng

> A refactored, updated fork of Boris Batteux's D-810 IDA Pro plugin that deobfuscates code at decompilation time by rewriting Hex-Rays microcode. Z3-verified instruction rules simplify mixed-boolean-arithmetic, opaque predicates and constant obfuscation across maturity levels, while control-flow unflatteners restore natural flow from O-LLVM, Tigress, Approov and Hodur (PlugX) dispatcher patterns. Rules are declared in a configurable DSL and project JSON, so new patterns can be added without editing the source, and optional Cython extensions speed up the hot paths with pure-Python fallbacks.

- Type: Tool
- Targets: Binary
- Category: Native analysis tools
- Relationship: Foundation tool
- Sources reviewed: 2026-10-27
- Added to the catalog: 2026-11-09
- Original resource: <https://github.com/w00tzenheimer/d810-ng>
- Primary source: <https://github.com/w00tzenheimer/d810-ng/blob/2e59ab4ce18e5e82911880137d1285d95279981a/README.md>
- Catalog page: <https://awesomerea.org/resources/d810-ng/>
- Record JSON: <https://awesomerea.org/resources/d810-ng/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/resources/d810-ng/index.md)

## Requirements & limits

- IDA 9 or later with Python 3.10+ is required. Copy the repository into IDA’s plugins directory and load it with Ctrl-Shift-D. The README warns that incorrect microcode edits can crash IDA.
- The pure-Python install uses pip install -e .; optional Cython speedups clone the public MIT-licensed Hex-Rays IDA SDK unless IDA_SDK names an existing copy. The z3-solver helper installs into an isolated user directory, configurable with D810_SPEEDUPS_DIR.
- The committed LICENSE is AGPL-3.0, while the README states LGPL v3. The project credits Boris Batteux’s D-810 and Rolf Rolles’s HexRaysDeob.

## Primary sources

1. <https://github.com/w00tzenheimer/d810-ng/blob/2e59ab4ce18e5e82911880137d1285d95279981a/README.md>
2. <https://github.com/w00tzenheimer/d810-ng/blob/2e59ab4ce18e5e82911880137d1285d95279981a/README.md#L174-L270>
3. <https://github.com/w00tzenheimer/d810-ng/blob/2e59ab4ce18e5e82911880137d1285d95279981a/samples/README.md>
4. <https://github.com/w00tzenheimer/d810-ng/blob/2e59ab4ce18e5e82911880137d1285d95279981a/samples/Makefile>
5. <https://github.com/w00tzenheimer/d810-ng/blob/2e59ab4ce18e5e82911880137d1285d95279981a/setup.py>
6. <https://github.com/w00tzenheimer/d810-ng/blob/2e59ab4ce18e5e82911880137d1285d95279981a/pyproject.toml>
7. <https://github.com/w00tzenheimer/d810-ng/blob/2e59ab4ce18e5e82911880137d1285d95279981a/LICENSE>

## More in Native binaries

- [Anvill](https://awesomerea.org/resources/anvill/index.md) · Tool
- [XRefer](https://awesomerea.org/resources/xrefer/index.md) · Tool
- [dsdump (paradiseduo wrapper)](https://awesomerea.org/resources/paradiseduo-dsdump/index.md) · Tool
- [Dr. Memory](https://awesomerea.org/resources/dr-memory/index.md) · Tool
- [Intel XED](https://awesomerea.org/resources/intel-xed/index.md) · Tool
- [Keystone](https://awesomerea.org/resources/keystone/index.md) · Tool

## About this entry

The description was reviewed against primary sources.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.