Indirect Branch Obfuscation with LLVM — Building and Removing It
Indirect branch obfuscation with LLVM, replacing direct branches with indirect jumps to break static control-flow analysis of compiled binaries, and the internals laid out in detail.
Tag: llvm
Graph-Topology Software Watermarking with LLVM — Part 1: Leaf Node Injection and Locating
Graph-topology software watermarking with LLVM, part one: embedding watermarks in a program's control-flow graph to track piracy, with every step broken down clearly.
Writing and Removing LLVM Bogus Control Flow
Writing and removing LLVM bogus control flow, showing how the pass inserts junk blocks and opaque predicates, then how to strip them back out, and the mechanism explained clearly.
Writing and Defeating OLLVM Control-Flow Flattening
Writing and defeating OLLVM control-flow flattening, an offense-defense look at building the obfuscation pass and then reversing it back out, with the result and caveats spelled out.
Analyzing and Deobfuscating Polaris's BogusControlFlow Pass - Detecting Opaque Predicates with angr
Analyzing and deobfuscating Polaris's BogusControlFlow pass, using angr to detect opaque predicates and strip the bogus control flow, and the internals laid out in detail.
An OLLVM Survival Guide: Building, Understanding, and Defeating Control-Flow Obfuscation
An OLLVM survival guide, collecting practical techniques for navigating flattened control flow, bogus blocks, and instruction substitution, and the bypass logic broken down.
Obfuscation Pass Analysis — Flattening
Analyzing the control-flow flattening obfuscation pass, explaining how it breaks the CFG into a dispatcher loop and what it looks like in decompiled code.
Hikari Source Analysis — AntiDebug
Source analysis of Hikari's AntiDebug LLVM pass, how it injects randomized ptrace-based anti-debugging checks into iOS binaries at compile time, and the internals laid out in detail.
Hikari Source Analysis — AntiHook
Source analysis of Hikari's AntiHook LLVM pass, how it detects inline hooks, blocks fishhook rebinding, and guards the Objective-C runtime, for anyone reversing similar targets.
Hikari Source Analysis — AntiClassDump
Source analysis of Hikari's AntiClassDump LLVM pass, showing how it rewrites Objective-C method lists to defeat class-dump tooling entirely, with every step broken down clearly.