- disassemble with capstone- identify each function as one of 5 templates- parse our template variables- substitute template variables into Z3 reimplementations of each template- run the solution from instance in Japan to speed things up- 12 byte shellcode to read more shellcode- win