Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
I recently heard about the "control-flow flattening" obfuscation which seems to be is used to break the structure of the CFG of the binary program (see Symbolic Execution and CFG Flattening).
Can somebody make an explanation of what is its basic principle and, also, how to produce such obfuscation (tools, programming technique, ...) ? And, it would be nice to know if there are ways to extract the real shape of the control-flow of the program.
For a good example of this obfuscation, check Apple's FairPlay code, e.g. iTunes or iOS libs. Here's a typical graph of a function which had this obfuscation applied:
As you can see, all edges between basic blocks - both conditional and unconditional - has been redirected to a dispatcher node which uses a new artificial variable to decide which block should be jumped to next. This variable is updated at the end of each separated basic block.
Here's the dispatcher node:
LDR R3, =0xF26A85D2
ADD R3, R2, R3
CMP R3, #0x40 ; switch 65 cases
ADDLS PC, PC, R3,LSL#2 ; switch jump
It uses R2 as the control value.
And here's one of the basic blocks:
LDR R2, =0x853FD863 ; jumptable 00532EFC case 33
LDR R1, [SP,#0x130+var_108]
STR R2, [SP,#0x130+var_134]
LDR R2, =0xD957A31
STR R1, [SP,#0x130+var_44]
B loc_532ED0
It updates R2 with the value which will be used to jump to the next block.
Recovering it shouldn't be too difficult in most cases - just track the control variable updates and replace jumps to the dispatcher node with jumps to the next block corresponding to the new control variable value.
From this paper by Timea Laszlo and Akos Kiss :
The basic method for flattening a function is the following.
First, we break up the body of the function to basic blocks, and then we put all these blocks, which were originally at different nesting levels, next to each other.
The now equal-leveled basic blocks are encapsulated in a selective structure (a switch statement in the C++ language) with each block in a separate case, and the selection is encapsulated in turn in a loop.
Finally, the correct flow of control is ensured by a control variable representing the state of the program, which is set at the end of each basic block and is used in the predicates of the enclosing loop and selection.
Image showing how control-flow flattening obfuscation alters code that contains loop structures.
A simple example:
int original()
{
print "Do"
print "you"
print "like"
print "milk?"
}
int obfuscated()
{
int ctrFlowVar = 1;
while(ctrFlowVar != 0)
{
switch(ctrFlowVar)
{
case 1:
print "do"
ctrFlowVar = 2;
break;
case 2:
print "you"
ctrFlowVar = 3;
break;
case 3:
print "like"
ctrFlowVar = 4;
break;
case 4:
print "milk?"
ctrFlowVar = 0;
break;
}
}
}
If you are familiar with how switch statements are written in assembly (i know 2 ways, the if-style and the jumptable one) then the above example is easy to de-obfuscate.The break; instruction is a jmp.You could make it jump to the block thats supposed to be next.
Control flow flattening is an obfuscation\transformation technique that can be applied to code for almost all languages in order to make it more difficult to understand and reverse engineer.
int gSDetETSDG119 = 1010545;
while (gSDetETSDG119 != 1010544)
{
switch (gSDetETSDG119) {
case 1010545:
{
if (n <= 0) {
gSDetETSDG119 = 1010546;
} else {
gSDetETSDG119 = 1010547;
}
break;
}
case 1010546:
{
return (0.000000e+000);
gSDetETSDG119 = 1010544;
break;
}
case 1010547:
{
gSDetETSDG119 = 1010544;
break;
}
}
}
}
int gSDetETSDG118 = 1010541;
while (gSDetETSDG118 != 1010540)
{
switch (gSDetETSDG118) {
case 1010541:
{
if (incx != 1 || incy != 1) {
gSDetETSDG118 = 1010542;
} else {
gSDetETSDG118 = 1010543;
}
break;
}
case 1010542:
{
{
ix = 0;
iy = 0;
{
int gSDetETSDG117 = 1010537;
while (gSDetETSDG117 != 1010536)
{
switch (gSDetETSDG117) {
case 1010537:
{
if (incx < 0) {
gSDetETSDG117 = 1010538;
} else {
gSDetETSDG117 = 1010539;
}
break;
}
case 1010538:
{
ix = (-n + 1) * incx;
gSDetETSDG117 = 1010536;
break;
}
case 1010539:
{
gSDetETSDG117 = 1010536;
break;
}
}
}
}
{
int gSDetETSDG116 = 1010533;
while (gSDetETSDG116 != 1010532)
{
switch (gSDetETSDG116) {
case 1010533:
{
if (incy < 0) {
gSDetETSDG116 = 1010534;
} else {
gSDetETSDG116 = 1010535;
}
break;
}
case 1010534:
{
iy = (-n + 1) * incy;
gSDetETSDG116 = 1010532;
break;
}
case 1010535:
{
gSDetETSDG116 = 1010532;
break;
}
}
}
}
{
i = 0;
{
int gSDetETSDG110 = 1010510;
while (gSDetETSDG110 != 1010509)
{
switch (gSDetETSDG110) {
case 1010510:
{
{
int gSDetETSDG115 = 1010529;
while (gSDetETSDG115 != 1010528)
{
switch (gSDetETSDG115) {
case 1010529:
{
if (i < n) {
gSDetETSDG115 = 1010530;
} else {
gSDetETSDG115 = 1010531;
}
break;
}
case 1010530:
{
gSDetETSDG110 = 1010511;
gSDetETSDG115 = 1010528;
break;
}
case 1010531:
{
gSDetETSDG110 = 1010509;
gSDetETSDG115 = 1010528;
break;
}
}
}
}
break;
}
case 1010511:
{
{
dtemp = dtemp + dx[ix] * dy[iy];
ix = ix + incx;
iy = iy + incy;
}
eTDGEyDg246:
{
i++;
}
eTDGEyDg251:
{
;
}
gSDetETSDG110 = 1010510;
break;
}
}
}
eTDGEyDg252:
{
;
}
}
}
return (dtemp);
}
gSDetETSDG118 = 1010540;
break;
}
case 1010543:
{
gSDetETSDG118 = 1010540;
break;
}
}
}
}
This technique involves transforming the control flow of a program in a way that makes it more difficult to trace\debug, while still preserving the same logic of the original program.
There are a number of different ways that control flow flattening can be implemented, but the basic idea is to take the control flow of the program and transform it into a series of nested if-then-else\while\switch statements.
This can be done by replacing all of the branches in the original code with conditional statements, and then nesting these statements so that the overall control flow becomes much more complex.
To avoid automatic code simplification and folding we can use opaque predicates technique with known conditions.
One of the biggest benefits of control flow flattening is that it can make it much more difficult for an attacker to understand the code and figure out how it works. This can be especially useful for protecting against reverse engineering and tampering attacks, as it can make it much more difficult for an attacker to modify the code or to understand its internal logic
