From "Unveiling the dark side of set-top boxes: the Bigpanzi cybercrime syndicate" @VirusBulletin
"Regarding de-flattening, the community has developed many methods and tools, such as unicorn for emulation, angr for
symbolic execution, and IDA’s d810 plugin. However, we recommend a ‘best approach’: finding an unflattened version.
LOL"
Ha ha indeed :)
https://blog.xlab.qianxin.com/bigpanzi-exposed-hidden-cyber-threat-behind-your-stb/