Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Feature Request] Undo switch case control flow obfuscation #18

Open
vikramambrose opened this issue Jan 27, 2018 · 0 comments
Open

[Feature Request] Undo switch case control flow obfuscation #18

vikramambrose opened this issue Jan 27, 2018 · 0 comments

Comments

@vikramambrose
Copy link

Not sure if this is within scope, but I've noticed that some code obfuscators try to obfuscate the control flow by turning every function into a giant switch statement with non-sequentially selected cases

e.g.

public void foo(string foo)
{
	IL_06:
	uint num = 2346910876u;
	for (;;)
	{
		uint num2;
		switch ((num2 = (num ^ 3075522388u)) % 5u)
		{
		case 1u:
		// do stuff
		num = (num2 * 3623258486u ^ 573975171u);
		continue;
		case 2u:
		// do stuff
		num = (num2 * 2623783498u ^ 3053144548u);
		continue;

This looks like it can be easily reverted by static analysis of the switch case math. So I guess this is a feature request.

Thanks for the great software and keep up the good work.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant