# Site

## Pages

- [Nothing here](https://comp4020-agentic-coding-studio.github.io/comp4020-ass2-Ky787/404/): That page does not exist, or it moved. Which is itself a small lesson about trusting a name.
- [Assessment](https://comp4020-agentic-coding-studio.github.io/comp4020-ass2-Ky787/assessments/): Three pieces of work, adding to 100%. All three mark the same thing — whether you can say what your evidence supports — and each of them puts a quarter of its marks on what you decline to conclude.
- [A1 — Trace the transformation](https://comp4020-agentic-coding-studio.github.io/comp4020-ass2-Ky787/assessments/a1-trace-the-transformation/): Follow one operation from C to IR to x64 across a clean/obfuscated pair you have not seen, and write down what you established and what you did not.
- [A2 — Recover the semantics](https://comp4020-agentic-coding-studio.github.io/comp4020-ass2-Ky787/assessments/a2-recover-the-semantics/): Given a flattened or gated function, a recovered graph and a set of solver results, decide what has been established — and defend the boundary you draw.
- [Capstone — Seeing through an unfamiliar binary](https://comp4020-agentic-coding-studio.github.io/comp4020-ass2-Ky787/assessments/capstone-unfamiliar-binary/): One sample, withheld identity, every method you have. Choose an approach, justify it, validate whatever you conclude, and state the boundary of your own result.
- [Four spine lectures](https://comp4020-agentic-coding-studio.github.io/comp4020-ass2-Ky787/lectures/): Not one lecture a week. Four, at the points where the argument turns — each opening a block of three studios and each delivered from a real deck.
- [Same program, four stories](https://comp4020-agentic-coding-studio.github.io/comp4020-ass2-Ky787/lectures/spine-01/): Why a compiler already makes a program harder to read before anyone tries to, and what it means to say that two very different listings are the same function.
- [Something always simplifies it for you](https://comp4020-agentic-coding-studio.github.io/comp4020-ass2-Ky787/lectures/spine-02/): Three different things reduce obfuscated arithmetic — the algebra, the compiler backend, and your own reading — and confusing them is how people come to believe a simplifier recovered something it never touched.
- [What a proof is worth](https://comp4020-agentic-coding-studio.github.io/comp4020-ass2-Ky787/lectures/spine-03/): A solver can show that a branch has only one reachable outcome. Turning that into a working executable takes a separate tool, and neither step is the same as knowing the program is still correct.
- [The smaller graph problem](https://comp4020-agentic-coding-studio.github.io/comp4020-ass2-Ky787/lectures/spine-04/): Two results in this corpus look like successes and are not. Both were caught by running the program; neither would have been caught by looking at the output. That is the course's conclusion, and this is where it gets argued.
- [Course information](https://comp4020-agentic-coding-studio.github.io/comp4020-ass2-Ky787/policies/): What you need before week 1, how the teaching runs, what you may and may not run in the lab, and how the evidence is made readable.
- [From C to machine code](https://comp4020-agentic-coding-studio.github.io/comp4020-ass2-Ky787/sessions/week-01/): One computation, four truthful descriptions of it, and the beginning of a habit — saying which description you are looking at before you say what it means.
- [What is obfuscation?](https://comp4020-agentic-coding-studio.github.io/comp4020-ass2-Ky787/sessions/week-02/): Five tools, one program, and a definition strong enough to be useful — which means a definition that tells you what evidence would show whether anything happened.
- [Instruction substitution](https://comp4020-agentic-coding-studio.github.io/comp4020-ass2-Ky787/sessions/week-03/): The oldest trick in the book, applied to twenty-four sites, and largely undone by the compiler backend before anyone tried to analyse it.
- [MBA and semantic simplification](https://comp4020-agentic-coding-studio.github.io/comp4020-ass2-Ky787/sessions/week-04/): Mixed Boolean-arithmetic, the tools that reduce it, and the difference between a shorter expression and a proved one. The honest scoreboard is in here.
- [Optimization versus obfuscation](https://comp4020-agentic-coding-studio.github.io/comp4020-ass2-Ky787/sessions/week-05/): The compiler flag is part of the experiment. Change it and a transformation can halve, double, or vanish — while the obfuscator's own output file stays exactly the same.
- [Bogus control flow and opaque predicates](https://comp4020-agentic-coding-studio.github.io/comp4020-ass2-Ky787/sessions/week-06/): Four branches the programmer wrote, twenty-two a tool injected, and the question of how you tell them apart when you do not have the source.
- [Symbolic execution and SMT](https://comp4020-agentic-coding-studio.github.io/comp4020-ass2-Ky787/sessions/week-07/): One branch, two queries, and a solver that answers one of them with a witness and the other with nothing at all. Plus the assumption that turns zero proofs into three.
- [From proof to a working binary](https://comp4020-agentic-coding-studio.github.io/comp4020-ass2-Ky787/sessions/week-08/): Six bytes, of which four differ. The audit that reconciles seventy blocks with thirty-seven. And 4,591 test triples, which is a great many inputs and not all of them.
- [Control-flow flattening](https://comp4020-agentic-coding-studio.github.io/comp4020-ass2-Ky787/sessions/week-09/): The dispatcher, the state variable, and why the thing being hidden here is not a value but a relationship — which block runs next.
- [Unflattening and hidden assumptions](https://comp4020-agentic-coding-studio.github.io/comp4020-ass2-Ky787/sessions/week-10/): Four runs of one unmodified tool. Two working rewrites, one valid executable that returns the wrong answer, and one failure that never reached the part of the tool everybody talks about.
- [Lifting machine code back to LLVM IR](https://comp4020-agentic-coding-studio.github.io/comp4020-ass2-Ky787/sessions/week-11/): One tool, one afternoon, two verdicts. Sixty-eight verifier-clean LLVM modules, one of which miscomputes 3,917 of 4,118 inputs — and the fold that did it is four operators long.
- [How generic can deobfuscation be?](https://comp4020-agentic-coding-studio.github.io/comp4020-ass2-Ky787/sessions/week-12/): The one week with no new evidence. What transferred between implementations, what did not, and the protocol for choosing a method when nobody tells you what was done to the binary.