Mastering Reverse Engineering

Control flow flattening obfuscation

The aim of control flow flattening is to make a simple code look like a complicated set of conditional jumps. Let's consider this simple code:

    cmp byte ptr [esi], 0x20    jz loc_00EB100C    mov eax, 0    jmp loc_00EB1011loc_00EB100C:    mov eax, 1loc_00EB1011:    test eax, eax    ret

When obfuscated using the control flow flattening method, it would look something like this:

    mov ecx, 1    mov ebx, 0                ; initial value of control variableloc_00EB100A:    test ecx, ecx    jz loc_00EB103C           ; jump will never happen, an endless looploc_00EB100E:    cmp ebx, 0                ; is control variable equal to 0?    jnz loc_00EB102Bloc_00EB1013:    cmp byte ptr [esi], 0x20    jnz loc_00EB1024loc_00EB1018:    mov eax, 0    mov ebx, 2    jmp loc_00EB103Eloc_00EB1024: mov ebx, 1 ; ...