Control Flow Flattening

Control flow flattening is a powerful obfuscation technique that transforms the natural structure of code into a state machine-like representation, making the original program logic extremely difficult to understand.

What is Control Flow Flattening?

Control flow flattening transforms code by:

Breaking Down Control Flow

The original program is divided into basic blocks (sequences of instructions with no branches).

Adding a Dispatcher

A central switch statement acts as a dispatcher that determines which block executes next.

Flattening the Structure

All blocks are placed at the same nesting level, hiding the original hierarchical structure.

Using State Variables

A variable tracks the current state, controlling which block the dispatcher executes.

This technique is also known as control flow obfuscation or dispatcher-based obfuscation.

How It Works

Before Flattening

func calculateDiscount(price: Double, memberLevel: Int) -> Double {
    var discount = 0.0
    
    if memberLevel >= 3 {
        discount = 0.20
    } else if memberLevel == 2 {
        discount = 0.10
    } else {
        discount = 0.05
    }
    
    return price * (1.0 - discount)
}

After Flattening

func calculateDiscount(price: Double, memberLevel: Int) -> Double {
    var state = 0
    var discount = 0.0
    var result = 0.0
    
    while true {
        switch state {
        case 0:
            // Check member level >= 3
            if memberLevel >= 3 {
                state = 1
            } else {
                state = 2
            }
            
        case 1:
            // Set premium discount
            discount = 0.20
            state = 4
            
        case 2:
            // Check member level == 2
            if memberLevel == 2 {
                state = 3
            } else {
                state = 5
            }
            
        case 3:
            // Set standard discount
            discount = 0.10
            state = 4
            
        case 4:
            // Calculate final price
            result = price * (1.0 - discount)
            state = 6
            
        case 5:
            // Set basic discount
            discount = 0.05
            state = 4
            
        case 6:
            // Exit
            return result
            
        default:
            return 0.0
        }
    }
}

The flattened version has the same functionality but is significantly harder to understand at a glance. The natural if-else structure is completely obscured.

Advanced Techniques

Opaque Predicates
State Encoding
Multiple Dispatchers
State Computation

Adding conditions that always evaluate to true or false, but aren’t obviously so:

// Always true, but not obvious
if (x * x) >= 0 {
    state = nextState
}

// Always false for integers
if (x * x) < 0 {
    state = dummyState  // Never executed
}

Using non-sequential or encoded state values:

// Instead of 0, 1, 2, 3...
case 0x4A3B:
    // Block 1
    state = 0x7F2E
case 0x7F2E:
    // Block 2
    state = 0x1C94

Nesting multiple switch statements:

while true {
    switch dispatcher {
    case 0:
        switch state {
        case 0: /* ... */
        case 1: /* ... */
        }
    case 1:
        switch state {
        case 2: /* ... */
        case 3: /* ... */
        }
    }
}

Computing next state instead of hardcoding:

// Next state is computed, not a constant
state = (state ^ 0x5A) + memberLevel * 7

Identifying Flattened Code

Look for these patterns when analyzing binaries:

Assembly Patterns

; Typical flattened code in ARM64
.loop:
    ldr     w8, [sp, #state]     ; Load state variable
    cmp     w8, #0               ; Compare with case value
    b.ne    .case1               ; Jump if not equal
    
.case0:
    ; Block 0 code
    mov     w8, #1               ; Next state
    str     w8, [sp, #state]     ; Store state
    b       .loop                ; Back to dispatcher
    
.case1:
    cmp     w8, #1
    b.ne    .case2
    ; Block 1 code
    ...

Control Flow Graph

Star topology: All basic blocks connect back to a central dispatcher
Flat structure: No natural hierarchical nesting
High indegree: Dispatcher block has edges from all other blocks
Low cohesion: Unrelated code blocks at same level

Code Metrics

High cyclomatic complexity: Many paths through code
Deep nesting: Multiple levels of switches or computed jumps
Long functions: Many lines with repetitive structure
Low readability: Decompiled code is difficult to understand

Example Analysis: ControlFlowFlattening.ipa

The example file is located at: /home/daytona/workspace/source/ObfuscatedAppExamples/ControlFlowFlattening.ipa

Extracting the Binary

# Extract the IPA file
unzip ControlFlowFlattening.ipa -d ControlFlowFlattening

# Navigate to the app bundle
cd ControlFlowFlattening/Payload/*.app

# Identify the main binary
ls -la

Analyzing with Hopper/IDA

Load the Binary

Open the binary in Hopper Disassembler or IDA Pro.

Locate Dispatcher Functions

Look for functions with:

Large switch statements
Loops at the beginning
Many basic blocks at the same level

Identify State Variables

Track variables that:

Are loaded at the beginning of loops
Control switch/branch decisions
Are updated at the end of basic blocks

Map Control Flow

Create a state transition diagram showing:

Each state value
Which block executes for each state
Conditions for state transitions

Using Frida for Dynamic Analysis

// Hook the obfuscated function to trace state transitions
Interceptor.attach(Module.findExportByName(null, "_obfuscatedFunction"), {
    onEnter: function(args) {
        console.log("[+] Function called");
        
        // Trace state variable changes
        var stateAddr = this.context.sp.add(0x10); // Adjust offset
        
        this.interval = setInterval(function() {
            var state = stateAddr.readU32();
            console.log("    State: " + state);
        }, 10);
    },
    onLeave: function(retval) {
        clearInterval(this.interval);
        console.log("[+] Function returned: " + retval);
    }
});

Recording state transitions during execution can help you understand the original control flow and create a state transition diagram.

Deobfuscation Strategies

Manual Reconstruction

Manually trace execution paths and rebuild the original control flow structure by analyzing state transitions.

Symbolic Execution

Use tools like angr or Triton to symbolically execute the flattened code and extract path constraints.

Pattern Matching

Identify common patterns in the flattened structure and apply automated transformations to simplify.

Dynamic Tracing

Record actual execution paths using Frida or LLDB, then reconstruct the simplified flow.

Automated Tools

D810 (IDA Plugin)
LLVM Deobfuscator
Angr

D810 is an IDA Pro plugin that attempts to deobfuscate control flow flattening:

# Install D810
git clone https://github.com/eshard/d810
cp -r d810 ~/idapro/plugins/

# Use in IDA: Edit -> Plugins -> D810

Custom LLVM passes can simplify flattened IR:

# Compile with LLVM bitcode
clang -emit-llvm -c obfuscated.c -o obfuscated.bc

# Apply deobfuscation pass
opt -load DeobfuscatorPass.so -deobfuscate obfuscated.bc -o clean.bc

Symbolic execution to recover control flow:

import angr

# Load binary
proj = angr.Project('ControlFlowFlattening')

# Create state
state = proj.factory.entry_state()

# Symbolically execute
simgr = proj.factory.simulation_manager(state)
simgr.explore()

# Analyze paths
for path in simgr.deadended:
    print(path.history)

Best Practices for Analysis

Start with High-Level View

Don’t dive into details immediately. First understand the overall structure and identify the dispatcher pattern.

Focus on Critical Paths

Not all code paths are equally important. Identify and analyze paths that handle sensitive operations first.

Use Dynamic Analysis

Static analysis alone is insufficient. Combine it with runtime tracing to validate your understanding.

Document State Transitions

Keep a detailed map of state values, their corresponding blocks, and transition conditions.

Leverage Automation

Use scripts and tools to automate repetitive tasks like state tracking and path enumeration.

Deobfuscating control flow flattening is time-intensive. Budget adequate time and consider whether full deobfuscation is necessary for your analysis goals.

Detection Techniques

Learn systematic approaches to detecting obfuscation patterns.

String Encryption

Explore another common obfuscation technique often used alongside control flow flattening.

Get Started

Fundamentals

Analysis Tools

Analysis Techniques

Swift & Objective-C

Obfuscation

What is Control Flow Flattening?

How It Works

Before Flattening

After Flattening

Advanced Techniques

Identifying Flattened Code

Example Analysis: ControlFlowFlattening.ipa

Extracting the Binary

Analyzing with Hopper/IDA

Using Frida for Dynamic Analysis

Deobfuscation Strategies

Manual Reconstruction

Symbolic Execution

Pattern Matching

Dynamic Tracing

Automated Tools

Best Practices for Analysis

Further Reading

Detection Techniques

String Encryption

Build docs developers (and LLMs) love

Get Started

Fundamentals

Analysis Tools

Analysis Techniques

Swift & Objective-C

Obfuscation

​What is Control Flow Flattening?

​How It Works

​Before Flattening

​After Flattening

​Advanced Techniques

​Identifying Flattened Code

​Example Analysis: ControlFlowFlattening.ipa

​Extracting the Binary

​Analyzing with Hopper/IDA

​Using Frida for Dynamic Analysis

​Deobfuscation Strategies

Manual Reconstruction

Symbolic Execution

Pattern Matching

Dynamic Tracing

​Automated Tools

​Best Practices for Analysis

​Further Reading

Detection Techniques

String Encryption

Build docs developers (and LLMs) love

What is Control Flow Flattening?

How It Works

Before Flattening

After Flattening

Advanced Techniques

Identifying Flattened Code

Example Analysis: ControlFlowFlattening.ipa

Extracting the Binary

Analyzing with Hopper/IDA

Using Frida for Dynamic Analysis

Deobfuscation Strategies

Automated Tools

Best Practices for Analysis

Further Reading