Workshop: Analyzing Control Flow Flattening
· 7:20 · Watch on YouTube ↗
Summary
A reverse-engineering workshop explains how control flow flattening obscures program logic and demonstrates manual analysis, breakpoint use, and deobfuscation with de4dot.
Key points
- Control flow flattening divides program logic into blocks and uses a state variable and switch statements to disrupt sequential analysis.
- The technique can add dead or low-impact states and increase code volume, making manual state tracking more difficult.
- Breakpoints can help analysts locate important calls and follow transitions to the next stage.
- When manual analysis is impractical, a tool can track states to reconstruct the original control flow.
- The presenter says a more recent version of de4dot successfully detects and removes the flattening in the demonstrated binary; older-version support was not tested.
- Cross-references can help locate calls to important functions, while anti-debugging can further complicate analysis and sandbox execution.
Article Details
- Topics
- [00:00] Control flow flattening: how state variables, loops, and switches scatter program logic
- [02:53] Manual analysis using breakpoints to identify important calls and stage transitions
- [03:50] Defeating flattening by tracking state and reconstructing the original control flow
- [04:44] Demonstration of de4dot removing flattening, with older-version support left untested
- [05:43] Cross-reference analysis and how anti-debugging can complicate analysis