Research And Implementation Of A Code Obfuscation Algorithm Based On Control Flow Flattening

Software protection technique against malicious host is one of the major branches in the computer security field. It contains hardware-based protection methods and software-based protection methods. Code obfuscation which is an effective and practical software-based protection technique transforms the program codes under the condition of preserving semantics. Cracker can't get valuable information from obfuscated program which has poor readability, so the objects of software protection and piracy prevention can be achieved. Currently, the research of code obfuscation mostly has been focused on the control obfuscation and data obfuscation. The transformations of control obfuscation and data obfuscation have strong potency and resilience, but they lead to increasing cost in time and space as well.A new control flow flattening obfuscation algorithm is proposed, which can increase the complexity and ability to resist attacking from cracker and make the execution cost in a proper level, so this obfuscation algorithm achieve a balance between obfuscation potency and execution cost. A C# source code obfuscator is designed and implemented in this paper. The main work of this paper is as following:1. Existing control flow flattening obfuscation algorithms have a serious defect that is overloading performance with high obfuscation potency, so improvements against this defect is made in this paper. Improved algorithm which employs randomly obfuscation techniques to achieve diversity of obfuscation observably raises the obfuscation potency of existing control flow flattening obfuscation algorithms. Furthermore, improved algorithm which realizes the combination of obfuscation potency and execution cost through controlling obfuscation depth, guarantees high obfuscation potency with lower execution cost.2. A C# source code obfuscator CFFO (Control Flow Flattening Obfuscator) is designed and implemented. The design object, system structure and work flow of the obfuscator are illuminated in this paper. An example of CFFO operation which can demonstrate the practicability and accurate of improved algorithm also is introduced.3. The function and performance tests of CFFO are performed, and white-box testing suggests that there isn't any bug which can affect the correctness of obfuscation transforms in CFFO. Attack analyses and tests are carried out from correctness, potency, resilience and cost of CFFO obfuscation in performance. It's proved that CFFO has correct obfuscation, high potency, strong resilience and lower cost with experiment data. Finally, comparative analysis is made between CFFO and another.NET obfuscator Xencode, and then analysis result suggests that obfuscation potency of CFFO is higher than Xencode.