Indirect Branch Obfuscation with LLVM — Building and Removing It
Indirect branch obfuscation with LLVM, replacing direct branches with indirect jumps to break static control-flow analysis of compiled binaries, and the internals laid out in detail.
Tag: pass
Graph-Topology Software Watermarking with LLVM — Part 1: Leaf Node Injection and Locating
Graph-topology software watermarking with LLVM, part one: embedding watermarks in a program's control-flow graph to track piracy, with every step broken down clearly.
Writing and Defeating OLLVM Control-Flow Flattening
Writing and defeating OLLVM control-flow flattening, an offense-defense look at building the obfuscation pass and then reversing it back out, with the result and caveats spelled out.
Obfuscation Pass Analysis — Flattening
Analyzing the control-flow flattening obfuscation pass, explaining how it breaks the CFG into a dispatcher loop and what it looks like in decompiled code.
Hikari Source Analysis — AntiDebug
Source analysis of Hikari's AntiDebug LLVM pass, how it injects randomized ptrace-based anti-debugging checks into iOS binaries at compile time, and the internals laid out in detail.
Hikari Source Analysis — AntiHook
Source analysis of Hikari's AntiHook LLVM pass, how it detects inline hooks, blocks fishhook rebinding, and guards the Objective-C runtime, for anyone reversing similar targets.
Hikari Source Analysis — AntiClassDump
Source analysis of Hikari's AntiClassDump LLVM pass, showing how it rewrites Objective-C method lists to defeat class-dump tooling entirely, with every step broken down clearly.