代码混淆——控制流扁平的开源实践和改进

孤挺花（Armariris）: 由上海交通大学密码与计算机安全实验室维护的LLVM混淆框架，支持多平台、多语言。目前支持的功能主要有控制流混淆、指令替换、字符串加密。https://github.com/GoSSIP-SJTU/Armariris#armariris

本文主要对Armariris的控制流混淆实现代码进行分析，了解Armariris的实现方式。并对混淆强度进行部分改进。

下面先看下混淆前后的对比

混淆前

混淆后

可以看到CFG的基本块变多了，控制流也变得复杂了。

Armariris脱胎于OLLVM，都是采用在LLVM中增加一个pass的方式来实现对源码的混淆处理。由于本身编译的混淆pass时静态库的形式存在的，不适合我们查看输出后的IR文件，也不适合调试，所以第一步我先对LLVM的编译方式进行修改。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
#add_llvm_library(LLVMObfuscation
#  CryptoUtils.cpp
#  StringObfuscation.cpp
#  Substitution.cpp
#  Flattening.cpp
#  Utils.cpp
#  )

#add_dependencies(LLVMObfuscation intrinsics_gen)

add_llvm_loadable_module( LLVMObfuscation
  CryptoUtils.cpp
  StringObfuscation.cpp
  Substitution.cpp
  Flattening.cpp
  Utils.cpp

  DEPENDS
  intrinsics_gen
  PLUGIN_TOOL
  opt
  )

这是Armariris/lib/Transforms/Obfuscation路径下的cmake文件修改情况，如此一来我们就可以通过opt来load生成的LLVMObfuscation，单独进行混淆，而不必完成整个编译过程。

当然除了这个文件还需要修改一些LLVMBuild.txt和PassManager的cpp，解除原来静态库的依赖关系。这里就不详说了。

修改完成后进行编译就可以在编译好的lib文件夹下发现LLVMObfuscation.dylib，然后我们准备一个样例文件，long.cpp

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
int main() 
{
    int Tom;
    int Jerry;
    int Dog;

    Jerry = 7;
    Dog = 5;
    Tom = Jerry ^ 13;
    
    if ( Jerry > Tom ) {
        int Cat;
        int Mouse;
        int Dog_;

        Cat = Jerry;
        Mouse = 0;
        Cat |= 5;
        Mouse |= 6;
        Cat += Mouse;
        Dog_ = Tom > Cat ? Cat : Mouse;
        Cat = Dog_ + Mouse;
    }
    
    int &eee = Dog;

    Tom = 3;
    Tom ^= (Dog + Jerry);
    Dog = Tom + Jerry;
    Dog += 3;
    Tom = Jerry | Dog;

    return 0;
}

在里面填入简单的代码。

然后依次执行命令

1
2
3
4
clang -S -emit-llvm long.cpp -o long.ll

./bin/opt -load ./lib/LLVMObfuscation.dylib -flattening long.ll -o long.bc --

第一步先用clang输出long.cpp的中间语言文件——long.ll

第二步通过opt加载LLVMObfuscation.dylib执行混淆，输出的是LLVM的bitcode文件，是二进制格式，通过相应的工具也可以转换成IR文件

1
llvm-dis long.bc -o long-ir.ll

然后我们查看混淆前的long.ll和混淆后的long-ir.ll有什么区别

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
; Function Attrs: noinline norecurse nounwind ssp uwtable
define i32 @main() #0 {
  %1 = alloca i32, align 4
  %2 = alloca i32, align 4
  %3 = alloca i32, align 4
  %4 = alloca i32, align 4
  %5 = alloca i32, align 4
  %6 = alloca i32, align 4
  %7 = alloca i32, align 4
  %8 = alloca i32*, align 8
  store i32 0, i32* %1, align 4
  store i32 7, i32* %3, align 4
  store i32 5, i32* %4, align 4
  %9 = load i32, i32* %3, align 4
  %10 = xor i32 %9, 13
  store i32 %10, i32* %2, align 4
  %11 = load i32, i32* %3, align 4
  %12 = load i32, i32* %2, align 4
  %13 = icmp sgt i32 %11, %12
  br i1 %13, label %14, label %35

; <label>:14:                                     ; preds = %0
  %15 = load i32, i32* %3, align 4
  store i32 %15, i32* %5, align 4
  store i32 0, i32* %6, align 4
  %16 = load i32, i32* %5, align 4
  %17 = or i32 %16, 5
  store i32 %17, i32* %5, align 4
  %18 = load i32, i32* %6, align 4
  %19 = or i32 %18, 6
  store i32 %19, i32* %6, align 4
  %20 = load i32, i32* %6, align 4
  %21 = load i32, i32* %5, align 4
  %22 = add nsw i32 %21, %20
  store i32 %22, i32* %5, align 4
  %23 = load i32, i32* %2, align 4
  %24 = load i32, i32* %5, align 4
  %25 = icmp sgt i32 %23, %24
  br i1 %25, label %26, label %28

; <label>:26:                                     ; preds = %14
  %27 = load i32, i32* %5, align 4
  br label %30

; <label>:28:                                     ; preds = %14
  %29 = load i32, i32* %6, align 4
  br label %30

; <label>:30:                                     ; preds = %28, %26
  %31 = phi i32 [ %27, %26 ], [ %29, %28 ]
  store i32 %31, i32* %7, align 4
  %32 = load i32, i32* %7, align 4
  %33 = load i32, i32* %6, align 4
  %34 = add nsw i32 %32, %33
  store i32 %34, i32* %5, align 4
  br label %35

; <label>:35:                                     ; preds = %30, %0
  store i32* %4, i32** %8, align 8
  store i32 3, i32* %2, align 4
  %36 = load i32, i32* %4, align 4
  %37 = load i32, i32* %3, align 4
  %38 = add nsw i32 %36, %37
  %39 = load i32, i32* %2, align 4
  %40 = xor i32 %39, %38
  store i32 %40, i32* %2, align 4
  %41 = load i32, i32* %2, align 4
  %42 = load i32, i32* %3, align 4
  %43 = add nsw i32 %41, %42
  store i32 %43, i32* %4, align 4
  %44 = load i32, i32* %4, align 4
  %45 = add nsw i32 %44, 3
  store i32 %45, i32* %4, align 4
  %46 = load i32, i32* %3, align 4
  %47 = load i32, i32* %4, align 4
  %48 = or i32 %46, %47
  store i32 %48, i32* %2, align 4
  ret i32 0
}

long.ll

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
; Function Attrs: noinline norecurse nounwind ssp uwtable
define i32 @main() #0 {
  %.reg2mem2 = alloca i32
  %.reg2mem = alloca i32
  %1 = alloca i32, align 4
  %2 = alloca i32, align 4
  %3 = alloca i32, align 4
  %4 = alloca i32, align 4
  %5 = alloca i32, align 4
  %6 = alloca i32, align 4
  %7 = alloca i32, align 4
  %8 = alloca i32*, align 8
  store i32 0, i32* %1, align 4
  store i32 7, i32* %3, align 4
  store i32 5, i32* %4, align 4
  %9 = load i32, i32* %3, align 4
  %10 = xor i32 %9, 13
  store i32 %10, i32* %2, align 4
  %11 = load i32, i32* %3, align 4
  store i32 %11, i32* %.reg2mem
  %12 = load i32, i32* %2, align 4
  store i32 %12, i32* %.reg2mem2
  %switchVar = alloca i32
  store i32 -1905808842, i32* %switchVar
  %.reg2mem4 = alloca i32
  br label %loopEntry

loopEntry:                                        ; preds = %0, %loopEnd
  %switchVar1 = load i32, i32* %switchVar
  switch i32 %switchVar1, label %switchDefault [
    i32 -1905808842, label %first
    i32 985277384, label %15
    i32 -162188989, label %28
    i32 -1992348767, label %30
    i32 -705746547, label %32
    i32 -1653362465, label %36
  ]

switchDefault:                                    ; preds = %loopEntry
  br label %loopEnd

first:                                            ; preds = %loopEntry
  %.reload = load volatile i32, i32* %.reg2mem
  %.reload3 = load volatile i32, i32* %.reg2mem2
  %13 = icmp sgt i32 %.reload, %.reload3
  %14 = select i1 %13, i32 985277384, i32 -1653362465
  store i32 %14, i32* %switchVar
  br label %loopEnd

; <label>:15:                                     ; preds = %loopEntry
  %16 = load i32, i32* %3, align 4
  store i32 %16, i32* %5, align 4
  store i32 0, i32* %6, align 4
  %17 = load i32, i32* %5, align 4
  %18 = or i32 %17, 5
  store i32 %18, i32* %5, align 4
  %19 = load i32, i32* %6, align 4
  %20 = or i32 %19, 6
  store i32 %20, i32* %6, align 4
  %21 = load i32, i32* %6, align 4
  %22 = load i32, i32* %5, align 4
  %23 = add nsw i32 %22, %21
  store i32 %23, i32* %5, align 4
  %24 = load i32, i32* %2, align 4
  %25 = load i32, i32* %5, align 4
  %26 = icmp sgt i32 %24, %25
  %27 = select i1 %26, i32 -162188989, i32 -1992348767
  store i32 %27, i32* %switchVar
  br label %loopEnd

; <label>:28:                                     ; preds = %loopEntry
  %29 = load i32, i32* %5, align 4
  store i32 -705746547, i32* %switchVar
  store i32 %29, i32* %.reg2mem4
  br label %loopEnd

; <label>:30:                                     ; preds = %loopEntry
  %31 = load i32, i32* %6, align 4
  store i32 -705746547, i32* %switchVar
  store i32 %31, i32* %.reg2mem4
  br label %loopEnd

; <label>:32:                                     ; preds = %loopEntry
  %.reload5 = load i32, i32* %.reg2mem4
  store i32 %.reload5, i32* %7, align 4
  %33 = load i32, i32* %7, align 4
  %34 = load i32, i32* %6, align 4
  %35 = add nsw i32 %33, %34
  store i32 %35, i32* %5, align 4
  store i32 -1653362465, i32* %switchVar
  br label %loopEnd

; <label>:36:                                     ; preds = %loopEntry
  store i32* %4, i32** %8, align 8
  store i32 3, i32* %2, align 4
  %37 = load i32, i32* %4, align 4
  %38 = load i32, i32* %3, align 4
  %39 = add nsw i32 %37, %38
  %40 = load i32, i32* %2, align 4
  %41 = xor i32 %40, %39
  store i32 %41, i32* %2, align 4
  %42 = load i32, i32* %2, align 4
  %43 = load i32, i32* %3, align 4
  %44 = add nsw i32 %42, %43
  store i32 %44, i32* %4, align 4
  %45 = load i32, i32* %4, align 4
  %46 = add nsw i32 %45, 3
  store i32 %46, i32* %4, align 4
  %47 = load i32, i32* %3, align 4
  %48 = load i32, i32* %4, align 4
  %49 = or i32 %47, %48
  store i32 %49, i32* %2, align 4
  ret i32 0

loopEnd:                                          ; preds = %32, %30, %28, %15, %first, %switchDefault
  br label %loopEntry
}

long-ir.ll

下面我们来分析Armariris的代码，看看它是如何实现的。控制流扁平化的伪算法在前一篇中已经介绍过了。当然由于实现方式方法有小小的不同，过程会略有差异，但是目标和大致过程都是相同的。

首先是入口函数

1
2
3
4
5
6
7
8
9
10
11
12
13
bool Flattening::runOnFunction(Function &F) {
    Function *tmp = &F;

    // Do we obfuscate
    if (toObfuscate(flag, tmp, "fla") && ((int) llvm::cryptoutils->get_range(100) <= Percentage)) {
        //errs() << "fla " + F.getName() +"\n";
        if (flatten(tmp)) {
            ++Flattened;
        }
    }

    return false;
}

Flattening是执行的混淆的主要类，我们在混淆命令中加入的 -flattening 就是为了指定调用Flattening。

为什么说runOnFunction是入口函数呢，这是由Pass的调用过程决定的。首先，opt会生成PassManager。PassManager有一个成员PM

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
/// PassManager manages ModulePassManagers
class PassManager : public PassManagerBase {
public:

  PassManager();
  ~PassManager() override;

  void add(Pass *P) override;

  /// run - Execute all of the passes scheduled for execution.  Keep track of
  /// whether any of the passes modifies the module, and if so, return true.
  bool run(Module &M);

private:
  /// PassManagerImpl_New is the actual class. PassManager is just the
  /// wraper to publish simple pass manager interface
  PassManagerImpl *PM;
};

PM是PassManagerImpl类型，主要的执行类，启动通过内部的run函数启动PassManagerImpl。

1
2
3
4
for (unsigned Index = 0; Index < getNumContainedManagers(); ++Index) {
    Changed |= getContainedManager(Index)->runOnModule(M);
    M.getContext().yield();
  }

PassManagerImpl会选择相对应的内容管理者。getContainedManager返回FunctionPass的管理者MPPassManager

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
MPPassManager::runOnModule(Module &M) {
  bool Changed = false;

  ...

  // Initialize module passes
  for (unsigned Index = 0; Index < getNumContainedPasses(); ++Index)
    Changed |= getContainedPass(Index)->doInitialization(M);

  for (unsigned Index = 0; Index < getNumContainedPasses(); ++Index) {
    ModulePass *MP = getContainedPass(Index);
    ...
    {
      PassManagerPrettyStackEntry X(MP, M);
      TimeRegion PassTimer(getPassTimer(MP));

      LocalChanged |= MP->runOnModule(M);
    }
    ...

通过多态，MP选择FPPassManager::runOnModule进入下一步

1
2
3
4
5
6
7
8
bool FPPassManager::runOnModule(Module &M) {
  bool Changed = false;

  for (Function &F : M)
    Changed |= runOnFunction(F);

  return Changed;
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
bool FPPassManager::runOnFunction(Function &F) {
  ...

  // 迭代取出每一个FunctionPass
  for (unsigned Index = 0; Index < getNumContainedPasses(); ++Index) {
    FunctionPass *FP = getContainedPass(Index);
    ...

    {
      PassManagerPrettyStackEntry X(FP, F);
      TimeRegion PassTimer(getPassTimer(FP));

      LocalChanged |= FP->runOnFunction(F);//调用每一个FunctionPass的runOnFunction
    }

而Flattening也是继承于FunctionPass，所以runOnFunction也就成了Flattening的入口，从这里进入混淆函数flatten

到了这里，就正式进入了混淆的流程。我们先回顾一下上一篇代码混淆之道（二）中我们抽象出来的控制流扁平化算法：

标识符重命名（解决变量名冲突）——>控制语句展开（全变成if）——>变量声明提前——>控制流压扁

在IR文件中，由于LLVM的IR是SSA（静态单赋值形式）形式的，标识符重命名和变量声明提前这两步可以省略。而第二步中的控制语句的展开，高级语言中的For、While等循环结构已经都变成了条件判断+Branch的形式，可以理解为通常所说的if-goto的方式。只有switch的方式还保存着，所以只需要将仍然保存的switch也改写成条件判断+br跳转的形式即可。从这里也可以看出在IR层进行混淆的好处，大量的工作前端在生成IR的同时已经由编译器帮我们搞定了。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
bool Flattening::flatten(Function *f) {
    vector<BasicBlock *> origBB;
    BasicBlock *loopEntry;
    BasicBlock *loopEnd;
    LoadInst *load;
    SwitchInst *switchI;
    AllocaInst *switchVar;

    // SCRAMBLER
    char scrambling_key[16];
    llvm::cryptoutils->get_bytes(scrambling_key, 16);
    // END OF SCRAMBLER

    // Lower switch
    FunctionPass *lower = createLowerSwitchPass();
    lower->runOnFunction(*f);

flatten函数开始的时候执行各种声明，并且调用LowerSwitchPass。这个pass负责将IR文件中目前仍然存在的switch结构转化成if结构。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
// Save all original BB
    for (Function::iterator i = f->begin(); i != f->end(); ++i) {
        BasicBlock *tmp = &*i;
        origBB.push_back(tmp);

        BasicBlock *bb = &*i;
        if (isa<InvokeInst>(bb->getTerminator())) {
            return false;
        }
    }

    // Nothing to flatten
    if (origBB.size() <= 1) {
        return false;
    }

    // Remove first BB
    origBB.erase(origBB.begin());

origBB保存除第一个BasicBlock之外的所有BasicBlock。这里的BasicBlock就是IR层CFG的block，我们的FunctionPass所获得的Function都是以CFG的形式存在的。之所以第一个BasicBlock不保存是因为需要对它进行大刀阔斧的改动，包括分配用于switch判断的变量的内存和跳转如循环。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
// If main begin with an if
    BranchInst *br = NULL;
    if (isa<BranchInst>(insert->getTerminator())) {
        br = cast<BranchInst>(insert->getTerminator());
    }

    if ((br != NULL && br->isConditional()) ||
        insert->getTerminator()->getNumSuccessors() > 1) {
        BasicBlock::iterator i = insert->back().getIterator();

        if (insert->size() > 1) {
            i--;
        }

        BasicBlock *tmpBB = insert->splitBasicBlock(i, "first");
        origBB.insert(origBB.begin(), tmpBB);
    }

    // Remove jump
    insert->getTerminator()->eraseFromParent();

将第一个块尾部的跳转内容（如果有的话）提取到一个新的BasicBlock中，并且放入到origBB中。

1
2
3
4
5
6
7
8
9
10
11
// Create switch variable and set as it
    switchVar =
            new AllocaInst(Type::getInt32Ty(f->getContext()), 0, "switchVar", insert);
    new StoreInst(
            ConstantInt::get(Type::getInt32Ty(f->getContext()),
                             llvm::cryptoutils->scramble32(0, scrambling_key)),
            switchVar, insert);

    // Create main loop
    loopEntry = BasicBlock::Create(f->getContext(), "loopEntry", f, insert);
    loopEnd = BasicBlock::Create(f->getContext(), "loopEnd", f, insert);

接下来为switch所需要的变量switchVar分配内存，并产生两个新BasicBlock，loopEntry和loopEnd。在loopEntry中通过switch结构来判断接下来执行哪个BasicBlock，所有的BasicBlock最后都会将switchVar的值修改为再下一个BasicBlock对应的值，并且跳转到loopEnd，再由loopEnd重新回到loopEntry。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
// Create switch instruction itself and set condition
    switchI = SwitchInst::Create(&*(f->begin()), swDefault, 0, loopEntry);
    switchI->setCondition(load);

    // Remove branch jump from 1st BB and make a jump to the while
    f->begin()->getTerminator()->eraseFromParent();

    BranchInst::Create(loopEntry, &*(f->begin()));

    // Put all BB in the switch
    for (vector<BasicBlock *>::iterator b = origBB.begin(); b != origBB.end();
         ++b) {
        BasicBlock *i = *b;
        ConstantInt *numCase = NULL;

        // Move the BB inside the switch (only visual, no code logic)
        i->moveBefore(loopEnd);

        // Add case to switch
        numCase = cast<ConstantInt>(ConstantInt::get(
                switchI->getCondition()->getType(),
                llvm::cryptoutils->scramble32(switchI->getNumCases(), scrambling_key)));
        switchI->addCase(numCase, i);
    }

生成新的switch结构，并且将origBB中的BasicBlock一一放入其中，每个BasicBlock所需要的switchVar则随机生成。

接下来就是对每个BasicBlock的尾巴部分进行修改，这里要分两种情况

第一种是无条件跳转，也就是上一个BasicBlock会直接跳转到下一个BasicBlock，或者说是它只有一个后继节点

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
// If it's a non-conditional jump
       if (i->getTerminator()->getNumSuccessors() == 1) {
           // Get successor and delete terminator
           BasicBlock *succ = i->getTerminator()->getSuccessor(0);
           i->getTerminator()->eraseFromParent();

           // Get next case
           numCase = switchI->findCaseDest(succ);

           // If next case == default case (switchDefault)
           if (numCase == NULL) {
               numCase = cast<ConstantInt>(
                       ConstantInt::get(switchI->getCondition()->getType(),
                                        llvm::cryptoutils->scramble32(
                                                switchI->getNumCases() - 1, scrambling_key)));
           }

           // Update switchVar and jump to the end of loop
           new StoreInst(numCase, load->getPointerOperand(), i);
           BranchInst::Create(loopEnd, i);
           continue;
       }

这种情况比较好办。我们只需要给switchVar赋后继BasicBlock的case number，然后将br loopEnd添加到结尾就好。

第二种情况是有条件跳转，也就是该BasicBlock有多个后继节点

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
// If it's a conditional jump
        if (i->getTerminator()->getNumSuccessors() == 2) {
            // Get next cases
            ConstantInt *numCaseTrue =
                    switchI->findCaseDest(i->getTerminator()->getSuccessor(0));
            ConstantInt *numCaseFalse =
                    switchI->findCaseDest(i->getTerminator()->getSuccessor(1));

            // Check if next case == default case (switchDefault)
            if (numCaseTrue == NULL) {
                numCaseTrue = cast<ConstantInt>(
                        ConstantInt::get(switchI->getCondition()->getType(),
                                         llvm::cryptoutils->scramble32(
                                                 switchI->getNumCases() - 1, scrambling_key)));
            }

            if (numCaseFalse == NULL) {
                numCaseFalse = cast<ConstantInt>(
                        ConstantInt::get(switchI->getCondition()->getType(),
                                         llvm::cryptoutils->scramble32(
                                                 switchI->getNumCases() - 1, scrambling_key)));
            }

            // Create a SelectInst
            BranchInst *br = cast<BranchInst>(i->getTerminator());
            SelectInst *sel =
                    SelectInst::Create(br->getCondition(), numCaseTrue, numCaseFalse, "",
                                       i->getTerminator());

            // Erase terminator
            i->getTerminator()->eraseFromParent();

            // Update switchVar and jump to the end of loop
            new StoreInst(sel, load->getPointerOperand(), i);
            BranchInst::Create(loopEnd, i);
            continue;
        }

这里就需要将switchVar的case number赋值改为选择性的select指令。

基本整个流程都遵循了上一篇我们所讲到的控制流扁平化算法。但是这里我们仍然可以看出一些问题。比如对于一些较大的block，混淆过后仍然是巨大的一整块

混淆前

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
; <label>:35:                                     ; preds = %30, %0
  store i32* %4, i32** %8, align 8
  store i32 3, i32* %2, align 4
  %36 = load i32, i32* %4, align 4
  %37 = load i32, i32* %3, align 4
  %38 = add nsw i32 %36, %37
  %39 = load i32, i32* %2, align 4
  %40 = xor i32 %39, %38
  store i32 %40, i32* %2, align 4
  %41 = load i32, i32* %2, align 4
  %42 = load i32, i32* %3, align 4
  %43 = add nsw i32 %41, %42
  store i32 %43, i32* %4, align 4
  %44 = load i32, i32* %4, align 4
  %45 = add nsw i32 %44, 3
  store i32 %45, i32* %4, align 4
  %46 = load i32, i32* %3, align 4
  %47 = load i32, i32* %4, align 4
  %48 = or i32 %46, %47
  store i32 %48, i32* %2, align 4
  ret i32 0

混淆后

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
; <label>:36:                                     ; preds = %loopEntry
  store i32* %4, i32** %8, align 8
  store i32 3, i32* %2, align 4
  %37 = load i32, i32* %4, align 4
  %38 = load i32, i32* %3, align 4
  %39 = add nsw i32 %37, %38
  %40 = load i32, i32* %2, align 4
  %41 = xor i32 %40, %39
  store i32 %41, i32* %2, align 4
  %42 = load i32, i32* %2, align 4
  %43 = load i32, i32* %3, align 4
  %44 = add nsw i32 %42, %43
  store i32 %44, i32* %4, align 4
  %45 = load i32, i32* %4, align 4
  %46 = add nsw i32 %45, 3
  store i32 %46, i32* %4, align 4
  %47 = load i32, i32* %3, align 4
  %48 = load i32, i32* %4, align 4
  %49 = or i32 %47, %48
  store i32 %49, i32* %2, align 4
  ret i32 0

如果被混淆的代码大多数都是这种大块大块的顺序语句的话，那混淆的意义就不是很明显。所以对于这种大块，我们需要把他们切割成小块。

可以添加如下代码

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
std::vector<BasicBlock *> needSplite;
   unsigned instSum = 0;
   for ( Function::iterator I = std::next(f->begin()); I != f->end(); I++ ) {
       instSum += I->size();
   }
   for ( Function::iterator I = std::next(f->begin()); I != f->end(); I++ ) {
       if ( I->size() > instSum / f->size() ) {
           needSplite.push_back(&*I);
       }
   }
   for ( auto I = needSplite.begin(); I != needSplite.end(); I++ ) {
       BasicBlock::iterator j = (*I)->begin();
       for ( unsigned step = 0; step < (*I)->size() / 2; step++ ) {
           j++;
       }
       BasicBlock *next = (*I)->splitBasicBlock(j);
   }

首先计算下所有BasicBlock包含指令的数量，对与指令数量大于平均值的，我们对它进行split。

实现对于大块的切割后我们还可以在添加虚假的控制流结构，来增加混淆的复杂性。

将上面第三个for循环的内容稍微更改一下，就可以变成一个非常简陋版本的虚假控制流。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
for ( auto I = needSplite.begin(); I != needSplite.end(); I++ ) {
        //std::string tw = "split_" + std::to_string(++index);
        BasicBlock::iterator j = (*I)->begin();
        for ( unsigned step = 0; step < (*I)->size() / 2; step++ ) {
            j++;
        }
        BasicBlock *next = (*I)->splitBasicBlock(j/*, tw*/);

        Instruction *back = &(*I)->back();
        if ( isa<BranchInst>(back) ) {
            BranchInst *BI = dyn_cast<BranchInst>(back);
            BI->eraseFromParent();
            AllocaInst *tmpBool = new AllocaInst(Type::getInt32Ty(f->getContext()), 0, "tmp", *I);
            new StoreInst(
                    ConstantInt::get(Type::getInt32Ty(f->getContext()), 1), tmpBool, *I);
            LoadInst *loadInst = new LoadInst(tmpBool, "tmp", *I);
            ICmpInst *ICmp = new ICmpInst(**I, ICmpInst::ICMP_EQ, loadInst, loadInst);
            BranchInst::Create(next, (*I)->getPrevNode(), ICmp, *I);
        }
    }

这里我们将原本BasicBlock末尾的br指令删除，换成一个icmp+br的形式，只需要将保证每次跳转都能跳转到正确的block上，就可以了。

进化后的block变成如下情况

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
; <label>:39:                                     ; preds = %loopEntry
  store i32* %4, i32** %8, align 8
  store i32 3, i32* %2, align 4
  %40 = load i32, i32* %4, align 4
  %41 = load i32, i32* %3, align 4
  %42 = add nsw i32 %40, %41
  %43 = load i32, i32* %2, align 4
  %44 = xor i32 %43, %42
  store i32 %44, i32* %2, align 4
  %45 = load i32, i32* %2, align 4
  store i32 %45, i32* %.reg2mem9
  %46 = load i32, i32* %3, align 4
  store i32 %46, i32* %.reg2mem11
  %tmp2 = alloca i32
  store i32 1, i32* %tmp2
  %tmp3 = load i32, i32* %tmp2
  %47 = icmp eq i32 %tmp3, %tmp3
  %48 = select i1 %47, i32 1569018260, i32 -2145809682
  store i32 %48, i32* %switchVar
  br label %loopEnd

; <label>:49:                                     ; preds = %loopEntry
  %.reload10 = load volatile i32, i32* %.reg2mem9
  %.reload12 = load volatile i32, i32* %.reg2mem11
  %50 = add nsw i32 %.reload10, %.reload12
  store i32 %50, i32* %4, align 4
  %51 = load i32, i32* %4, align 4
  %52 = add nsw i32 %51, 3
  store i32 %52, i32* %4, align 4
  %53 = load i32, i32* %3, align 4
  %54 = load i32, i32* %4, align 4
  %55 = or i32 %53, %54
  store i32 %55, i32* %2, align 4
  ret i32 0

上述的修改全部保存到github中 https://github.com/penguin-wwy/Armariris.git

clone到本地，checkout到dev_0分支即可查看，可直接编译运行、调试。