I recently heard about the control-flow flattening obfuscation which seems to be is used to break the structure of the CFG of the binary program (see Diablo obfuscation module and Symbolic Execution and CFG Flattening). Can somebody make an explanation of what is its basic principle and, also, how to produce such obfuscation (tools, programming technique, ...) ? And, it would be nice to know if there are ways to extract the real shape of the control-flow of the program.
What is a control-flow flattening obfuscation technique?
obfuscation
For a good example of this obfuscation, check Apple's FairPlay code, e.g. iTunes or iOS libs. Here's a typical graph of a function which had this obfuscation applied:As you can see, all edges between basic blocks - both conditional and unconditional - has been redirected to a dispatcher node which uses a new artificial variable to decide which block should be jumped to next. This variable is updated at the end of each separated basic block.Here's the dispatcher node:LDR    R3, =0xF26A85D2ADD    R3, R2, R3CMP    R3, #0x40 ; switch 65 casesADDLS  PC, PC, R3,LSL#2 ; switch jumpIt uses R2 as the control value.And here's one of the basic blocks:LDR  R2, =0x853FD863 ; jumptable 00532EFC case 33LDR  R1, [SP,#0x130+var_108]STR  R2, [SP,#0x130+var_134]LDR  R2, =0xD957A31STR  R1, [SP,#0x130+var_44]B    loc_532ED0It updates R2 with the value which will be used to jump to the next block.Recovering it shouldn't be too difficult in most cases - just track the control variable updates and replace jumps to the dispatcher node with jumps to the next block corresponding to the new control variable value.