Deobfuscation of Control Flow Flattening Based on Abstract Interpretation

Control Flow Flattening (CFF) is one of the control flow obfuscation techniques. It flattens control flows to conceal the sequential flow of programs. Researchers have utilized both static and dynamic approaches to deobfuscate CFF. Static methods primarily rely on symbolic execution, which leverages pattern-based information from CFF to perform effective analysis. However, these patterns can vary depending on the obfuscation tools used, and the deobfuscation techniques may only work for certain obfuscation tools. Dynamic approaches, on the other hand, face limitations as they may not cover all possible execution paths. We propose a static deobfuscation technique that is independent of obfuscation patterns. Our technique adopts abstract interpretation, which is a theoretical static analysis framework covering all execution paths. We define k-switch context sensitivity for the deobfuscation of CFF, which enables path-sensitive analysis to accurately identify the order of each execution path in obfuscated programs. Our approach utilizes the k-switch context sensitive analysis result to divide an obfuscated program into small fragments of sequentially executable blocks and reassemble the blocks to reconstruct the program’s original control flows. We demonstrate that our technique effectively reduces control flow complexity while preserving the semantics of the obfuscated program. Furthermore, by utilizing a binary lifter, we show that our method is also applicable to obfuscated binary code.