{
  "added_at": "2026-11-09",
  "additional_evidence_urls": [
    "https://github.com/w00tzenheimer/d810-ng/blob/2e59ab4ce18e5e82911880137d1285d95279981a/README.md#L174-L270",
    "https://github.com/w00tzenheimer/d810-ng/blob/2e59ab4ce18e5e82911880137d1285d95279981a/samples/README.md",
    "https://github.com/w00tzenheimer/d810-ng/blob/2e59ab4ce18e5e82911880137d1285d95279981a/samples/Makefile",
    "https://github.com/w00tzenheimer/d810-ng/blob/2e59ab4ce18e5e82911880137d1285d95279981a/setup.py",
    "https://github.com/w00tzenheimer/d810-ng/blob/2e59ab4ce18e5e82911880137d1285d95279981a/pyproject.toml",
    "https://github.com/w00tzenheimer/d810-ng/blob/2e59ab4ce18e5e82911880137d1285d95279981a/LICENSE"
  ],
  "category": "native-analysis",
  "description_en": "A refactored, updated fork of Boris Batteux's D-810 IDA Pro plugin that deobfuscates code at decompilation time by rewriting Hex-Rays microcode. Z3-verified instruction rules simplify mixed-boolean-arithmetic, opaque predicates and constant obfuscation across maturity levels, while control-flow unflatteners restore natural flow from O-LLVM, Tigress, Approov and Hodur (PlugX) dispatcher patterns. Rules are declared in a configurable DSL and project JSON, so new patterns can be added without editing the source, and optional Cython extensions speed up the hot paths with pure-Python fallbacks.",
  "description_zh": "对 Boris Batteux 的 D-810 IDA Pro 插件进行重构和更新的分支，在反编译时通过改写 Hex-Rays 微码来反混淆代码。经 Z3 验证的指令规则可在多个成熟度层级上简化混合布尔算术、不透明谓词和常量混淆，控制流反扁平化器则可从 O-LLVM、Tigress、Approov 和 Hodur（PlugX）等分发器模式中还原自然控制流。规则以可配置的 DSL 和项目 JSON 声明，无需修改源码即可添加新模式；可选的 Cython 扩展用于加速热点路径，并提供纯 Python 回退实现。",
  "entry_url": "https://awesomerea.org/resources/d810-ng/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/d810-ng/",
  "evidence_url": "https://github.com/w00tzenheimer/d810-ng/blob/2e59ab4ce18e5e82911880137d1285d95279981a/README.md",
  "group": "tools",
  "id": "d810-ng",
  "json_url": "https://awesomerea.org/resources/d810-ng/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/d810-ng/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/d810-ng/index.md",
  "name": "D-810 ng",
  "name_zh": "D-810 ng IDA 反混淆插件",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "IDA 9 or later with Python 3.10+ is required. Copy the repository into IDA’s plugins directory and load it with Ctrl-Shift-D. The README warns that incorrect microcode edits can crash IDA.",
    "The pure-Python install uses pip install -e .; optional Cython speedups clone the public MIT-licensed Hex-Rays IDA SDK unless IDA_SDK names an existing copy. The z3-solver helper installs into an isolated user directory, configurable with D810_SPEEDUPS_DIR.",
    "The committed LICENSE is AGPL-3.0, while the README states LGPL v3. The project credits Boris Batteux’s D-810 and Rolf Rolles’s HexRaysDeob."
  ],
  "requirements_zh": [
    "需要 IDA 9 或更新版本及 Python 3.10+。将仓库复制到 IDA 的 plugins 目录，再用 Ctrl-Shift-D 加载。README 提醒，错误的微码修改可能使 IDA 崩溃。",
    "纯 Python 安装使用 pip install -e .；可选 Cython 加速扩展会克隆公开、MIT 许可的 Hex-Rays IDA SDK，除非 IDA_SDK 指向现有副本。z3-solver 辅助程序安装到隔离的用户目录，可用 D810_SPEEDUPS_DIR 配置。",
    "提交的 LICENSE 是 AGPL-3.0，而 README 写 LGPL v3。项目致谢 Boris Batteux 的 D-810 和 Rolf Rolles 的 HexRaysDeob。"
  ],
  "targets": [
    "binary"
  ],
  "url": "https://github.com/w00tzenheimer/d810-ng",
  "verification": "source-reviewed",
  "verified_at": "2026-10-27"
}