A method for obfuscating complex control flow during the LLVM compilation optimization stage

Abstract

This invention relates to the field of software protection technology, specifically to a complex control flow obfuscation method based on the LLVM compilation optimization stage. The method includes: obtaining source code and corresponding compilation parameters; translating the source code into source expressions; checking if obfuscation parameters are present in the compilation parameters; if no obfuscation parameters are present, performing optimization; if obfuscation parameters are present, using obfuscation PASS to obfuscate the source expressions and constructing opaque predicates based on two-dimensional chaotic mappings; performing control flow irreducibility obfuscation on the opaque predicates to strengthen branch path construction, obtaining a transformation result; repeating the obfuscation steps until the number of iterations reaches a preset value, obtaining a preliminary result; performing control flow flattening obfuscation on the preliminary result, obtaining a final result; performing expression substitution on the final result, obtaining a final expression; and using an optimization layer to optimize intermediate or final expressions, obtaining corresponding optimization parameters.

Description

Technical Field

[0001] This invention relates to the field of software protection technology, and in particular to a complex control flow obfuscation method based on the LLVM compilation optimization stage. Background Technology

[0002] Because programming statements are structured, the control flow of a program is usually reducible, allowing for semantic understanding and code decompilation through control flow analysis. In recent years, program control flow analysis has become one of the mainstream methods in software analysis, with techniques based on symbolic execution, program slicing, and formal reasoning proposed, significantly improving the completeness and accuracy of program control flow analysis.

[0003] However, some reverse engineers use reverse engineering to analyze the control flow of software, thereby obtaining important information in the software, such as plagiarizing and copying the core algorithm, stealing and deciphering keys, which poses a huge threat to software security. Summary of the Invention

[0004] The purpose of this invention is to provide a complex control flow obfuscation method based on the LLVM compilation optimization stage, which aims to solve the problem that the control flow of software is easily reverse-analyzed, leading to a decrease in software security.

[0005] To achieve the above objectives, this invention provides a complex control flow obfuscation method based on the LLVM compilation optimization stage, comprising the following steps:

[0006] S1 obtains the source code and the compilation parameters corresponding to the source code;

[0007] S2 translates the source code into a source expression;

[0008] S3 checks whether there are obfuscation parameters in the compilation parameters. If there are no obfuscation parameters, proceed to step S10. If there are obfuscation parameters, proceed to step S4.

[0009] S4 uses the obfuscation PASS to obfuscate the source expression, obtaining the obfuscated result;

[0010] S5 uses the confusion result to construct an opaque predicate based on a two-dimensional chaotic mapping;

[0011] S6 performs control flow irreducibility obfuscation on the opaque predicate to strengthen the branch path construction, and obtains the transformation result;

[0012] S7 repeats steps S4 to S6 until the number of iterations reaches a preset value, and a preliminary result is obtained;

[0013] S8 performs control flow flattening and obfuscation on the preliminary results to obtain the final results;

[0014] S9 performs expression substitution on the final result to obtain the final expression;

[0015] S10 uses an optimization layer to optimize the intermediate expression or the final expression to obtain the corresponding optimization parameters.

[0016] The specific method for obfuscating the source expression using obfuscation PASS to obtain the obfuscated result is as follows:

[0017] S41 utilizes the LLVM compiler framework and follows the LLVMPASS writing standard to declare the obfuscated PASS as a control flow flattening obfuscated PASS and an enhanced path branch transformation PASS. After the declaration is completed, the obfuscated PASS itself is registered to obtain the designed obfuscated PASS.

[0018] S42 uses the obfuscation PASS designed above to obfuscate the source expression and obtain the obfuscated result.

[0019] The specific method for constructing opaque predicates based on binary chaotic mapping using the confusion result is as follows:

[0020] S51 selects a random basic block from the confusion result;

[0021] S52 selects the target basic block from the random basic blocks;

[0022] S53 inserts a perpetually true opaque predicate, a perpetually false opaque predicate, and a perpetually true / false opaque predicate before the target basic block based on a two-dimensional chaotic mapping.

[0023] The enhanced branch path construction includes a branch path with a false path pointing to a predecessor basic block, a branch path with a false path pointing to a successor basic block, a branch path with a false path pointing to an equivalent clone basic block, a branch path with a false path pointing to a non-equivalent clone basic block, and a branch path with a false path pointing to a split basic block.

[0024] The specific method for performing control flow flattening and obfuscation on the preliminary results to obtain the final results is as follows:

[0025] S81 constructs a set of redundant code basic blocks;

[0026] S82 constructs the basic block for scheduling and control;

[0027] S83 performs control flow flattening and obfuscation on the preliminary result based on the set of redundant code basic blocks and the scheduling control basic block to obtain the final result.

[0028] The specific method for performing expression substitution on the final result to obtain the final expression is as follows:

[0029] Replace the binary operations in the final result with multivariate equivalence operations to obtain the final expression.

[0030] This invention discloses a complex control flow obfuscation method based on the LLVM compilation optimization stage. The method involves: obtaining source code and corresponding compilation parameters; translating the source code into source expressions; checking if obfuscation parameters are present in the compilation parameters; if not, performing optimization; if present, proceeding to the next step; obfuscating the source expressions using obfuscation PASS to obtain an obfuscation result; constructing an opaque predicate based on a two-dimensional chaotic mapping using the obfuscation result; performing control flow irreducibility obfuscation on the opaque predicate using enhanced branch path construction to obtain a transformation result; repeating the obfuscation steps until the number of iterations reaches a preset value to obtain a preliminary result; performing control flow flattening obfuscation on the preliminary result to obtain a final result; performing expression replacement on the final result to obtain a final expression; and using an optimization layer to optimize the intermediate or final expression to obtain corresponding optimization parameters. This invention solves the problem of software control flow being easily reverse-engineered, leading to reduced software security, by optimizing the source code after obfuscating it. Attached Figure Description

[0031] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0032] Figure 1 This is a flowchart of a complex control flow obfuscation method based on the LLVM compilation optimization stage provided by the present invention.

[0033] Figure 2 This is a linear graph of a complex control flow obfuscation method based on the LLVM compilation optimization stage provided by the present invention.

[0034] Figure 3 This is a diagram illustrating the insertion of redundant code blocks.

[0035] Figure 4 This is a schematic diagram of constructing an opaque predicate.

[0036] Figure 5 This is a diagram illustrating the construction of enhanced branch paths.

[0037] Figure 6 This is a schematic diagram of the loop framework. Detailed Implementation

[0038] Embodiments of the present invention are described in detail below, examples of which are illustrated in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain the present invention, and should not be construed as limiting the present invention.

[0039] Please see Figures 1 to 6 This invention provides a method for obfuscating complex control flow during the LLVM compilation optimization stage, comprising the following steps:

[0040] S1 obtains the source code and the compilation parameters corresponding to the source code;

[0041] Specifically, the source code and the corresponding compilation parameters are obtained through the front end.

[0042] S2 translates the source code into a source expression;

[0043] Specifically, the source code is translated into a source expression by the front end, and the source expression is LLVMIR.

[0044] S3 checks whether there are obfuscation parameters in the compilation parameters. If there are no obfuscation parameters, proceed to step S10. If there are obfuscation parameters, proceed to step S4.

[0045] Specifically, after receiving the parameters from the front end, LLVMOPT calls the optimizer PASS to operate on LLVMIR. The obfuscation parameters can specify the frequency of basic block selection and the number of obfuscation rounds; if not specified, the default frequency and number of rounds are used.

[0046] S4 uses the obfuscation PASS to obfuscate the source expression, obtaining the obfuscated result;

[0047] The specific method is as follows:

[0048] S41 utilizes the LLVM compiler framework and follows the LLVMPASS writing standard to declare the obfuscated PASS as a control flow flattening obfuscated PASS and an enhanced path branch transformation PASS. After the declaration is completed, the obfuscated PASS itself is registered to obtain the designed obfuscated PASS.

[0049] Specifically, obfuscation is performed within the LLVM compiler framework and must adhere to the LLVMPASS writing standard. Each Pass needs to declare itself as a Pass in order to be recognized as a Pass by the compiler framework's optimizer, and then register itself so that it can be used by the optimizer. This requires providing the Pass's ID, entry function, and parameter tagging information in the anonymous space.

[0050] Declare an encrypted scheduling variable and randomly execute a control flow flattening obfuscation pass. Write an entry function, register the pass, and declare the parameter fla. There is an optional parameter fla_prob, which represents the ratio of redundant basic block construction; its default value is set to 30.

[0051] This code declares an enhanced path branch transformation `pass` based on an opaque predicate constructed using a two-dimensional chaotic map. It then writes an entry function, registers `pass`, and declares the parameter `bcf`. There are two obfuscation parameters: obfuscation probability `bcf_rate` (default value 30) and obfuscation loop number `bcf_loop` (default value 1).

[0052] S42 uses the obfuscation PASS designed above to obfuscate the source expression and obtain the obfuscated result.

[0053] S5 uses the confusion result to construct an opaque predicate based on a two-dimensional chaotic mapping;

[0054] Specifically, opaque predicates are constructed based on two-dimensional chaotic mappings:

[0055] The Arnold cat two-dimensional chaotic mapping expression is: x0, y0∈Q + , N∈N + When A takes When this is called the Arnold cat mapping, the real number sequence constructed by this expression in the range x0, y0∈(0,1) exhibits chaotic characteristics. A triplet (A, x0, y0) is constructed as input to the two-dimensional chaotic expression, with random values ​​(a, b) in the confusion function, and A taking... Construct the Arnold cat mapping. Figure 3 As shown,

[0056] Take the nth round of mapping If x, y∈(0,1), then construct a tautologically opaque predicate P. T ;

[0057] Take the nth round of mapping The predicate constructed for x, y∈(0,1) is a perpetually false opaque predicate p. F ;

[0058] Pick rand x =x n-1 ±Δ, rand y =y n-1 ±Δ, Δ→0. Due to the precision loss in floating-point operations in computers, the calculation result is uncertain when Δ takes a small value. The constructed predicate is an opaque predicate P with uncertain truth value. R .

[0059] The specific method for constructing an opaque predicate based on a binary chaotic mapping using the confusion result is as follows:

[0060] S51 selects a random basic block from the confusion result;

[0061] S52 selects the target basic block from the random basic blocks;

[0062] S53 inserts a perpetually true opaque predicate, a perpetually false opaque predicate, and a perpetually true / false opaque predicate before the target basic block based on a two-dimensional chaotic mapping.

[0063] Specifically, the construction of opaque predicates uses a two-dimensional chaotic mapping, expressed as: Construct a triple (A, x0, y0) as input to a two-dimensional chaotic expression, where A is fixed. Construct the Arnold cat mapping. Set the variable tuple (n, x0, y0) to the random numbers generated when the obfuscation function is called.

[0064] Take the nth round of mapping Then construct a tautologically opaque predicate P. T ;

[0065] Take the nth round of mapping The constructed predicate is a perpetually hypothetical opaque predicate P. F ;

[0066] Pick rand x =x n-1 ±Δ, rand y =y n-1 ±Δ, Δ→0, the constructed predicate is an opaque predicate P with uncertain truth value. R .

[0067] S6 performs control flow irreducibility obfuscation on the opaque predicate to strengthen the branch path construction, and obtains the transformation result;

[0068] Specifically, such as Figure 5 As shown, the enhanced branch path construction includes Figure 5 A spurious path points to a branch path of the predecessor basic block. Figure 5 .B. A spurious path pointing to a branch path of a successor basic block. Figure 5 .C spurious paths point to branch paths of equivalent cloned basic blocks. Figure 5 .D spurious paths pointing to branch paths of non-equivalent clone basic blocks and Figure 5 .E. False paths point to branch paths of split basic blocks. The complexity of the control flow graph is increased by randomly inserting branch paths over multiple rounds.

[0069] For spurious paths, execution will proceed to the construction block, and the successor of the construction block is the successor of the obfuscated block. The successors of the construction block include:

[0070] 6.1 Construct a basic block that is empty;

[0071] 6.2 Construct a basic block that is an equivalent clone of the obfuscated basic block. Randomly add irrelevant instructions to the basic block and make equivalent substitutions for arithmetic and logical operations in the expression.

[0072] 6.3 Construct a basic block that is a non-equivalent clone of the obfuscated basic block. In this basic block, some instructions are randomly deleted, and arithmetic and logical operations in the expression are randomly replaced.

[0073] 6.4 The constructing basic block is a split part of the obfuscated basic block. The obfuscated basic block is divided into two parts, Sub1 and Sub2, both of which are constructing basic blocks.

[0074] Check the irreducibility of the control flow after the obfuscated basic block is obfuscated, that is, whether the local control flow satisfies the following condition: G′=<V′,E′> , If |{b|a∈VV′∧b∈V′∧<a,b> ∈EE′}|>2, and All

[0075] If the conditions are not met, an opaque predicate is added in S6, and then the enhanced branch path is constructed using 6.1 and 6.5.

[0076] By performing irreducible obfuscation on the control flow graph, let the control flow graph G =<V,E> Where V represents the node set and E represents the edge set, the local control flow graph constructed by randomly combining reinforced branch paths through the insertion of opaque predicates satisfies the following condition: G′=<V′,E′> , If |{b|a∈VV′∧b∈v′∧<a,b> ∈EE′}|>2, and All This constructs an unreducible and obfuscated control flow.

[0077] Confusion intensity analysis: Let the probability of constructing the five branch paths in this stage be P. bp =p bc = The three types of opaque predicates have the same probability of being constructed. The probability of confusing the basic block selection is p s The original set of basic blocks B = {B x |x∈[0,n),x∈Z,B x ∈G}, the number of original basic block edges is e, and the total number of instructions is c. oConstruct a set B of m redundant basic code blocks. R ={B R，x |x∈[0, m), x∈Z}, m=n*p s The equivalent basic block set B RE The set of non-equivalent basic blocks B RN B R ={B RE B RN}, B R The number of instructions in each redundant code block is c. R，i 0 < i < m, the number of opaque predicate instructions is c l , where the random opaque predicate approximates the quantity Δ.

[0078] Let the complexity of the control flow loop be denoted as V(G) = e^(-n+2), then the rate of increase in loop complexity after confusion is...

[0079] Average effective instruction execution rate:

[0080] After this stage of confusion, the control flow becomes irreducible. Let the number of confusion rounds in this stage be α, and the maximum nested depth of the original control flow be β. Then, after α rounds of confusion in this stage, the theoretical maximum nested depth of the loop is: η max =α+β.

[0081] S7 repeats steps S4 to S6 until the number of iterations reaches a preset value, and a preliminary result is obtained;

[0082] Specifically, the preset value is the required number of obfuscation rounds. After each round of obfuscation, it is checked whether the required number of obfuscation rounds has been achieved. If the requirement is met, S8 is executed; otherwise, S4 is executed.

[0083] S8 performs control flow flattening and obfuscation on the preliminary results to obtain the final results;

[0084] Specifically, the control flow flattening obfuscation is performed as an encrypted scheduling variable and randomly executed control flow flattening obfuscation:

[0085] Control flow flattening is intuitively represented by placing multi-layered basic block nodes at the control flow level within the same layer of the control flow by changing their jump relationships, and using scheduling variables to guide their execution. Traditional control flow flattening, due to its obvious regularity ("main dispatcher-code block-pre-dispatcher"), allows for the acquisition of the actual code block execution logic through dynamic debugging, symbolic execution, and program simulation to reconstruct the program control flow. However, the control flow flattening proposed in this scheme, with its encrypted scheduling variables and random execution, obfuscates... Figure 1As shown, the main tasks performed were as follows: 1) Constructing redundant basic blocks of code that can be executed randomly; 2) Constructing random scheduling variables; 3) Dynamically decrypting jump addresses.

[0086] Construct m redundant code basic blocks B′ x The set B′: {B′ x The redundant code constructed for |x∈[0,m-1]} does not affect the logical function of the normal program.

[0087] During control flow flattening, assuming the original number of basic blocks is n, in the original control flow graph G, basic block B x Set B: {B x |x∈[0,n-1],B x ∈G}, any basic block B x ∈B has a label value As a scheduling variable representing the scheduling destination, it is initialized to a random value. The label value of the scheduling control basic block is initialized to TC, and then all original basic block jump addresses are constructed. Execution state before basic block jump For B x The label value of the successor basic block.

[0088] Set a threshold p (0 < p < 1). The scheduling control basic block generates a random number c (0 < c < 1). If c < p, redundant code is not executed, the jump address JMP = D(St, key) is decrypted, and the program jumps to the normally executing basic block. If c > p, the random redundant code basic block B′ is retrieved. r B′ r ∈B′, its label value is but When r∈[0, m-1], the program jumps to the redundant code block for execution.

[0089] Obfuscation Strength Analysis: Suppose that the obfuscation in this stage constructs a set B of m redundant code basic blocks. R ={B R，x |x∈[0,m), x∈Z}, the number of instructions in each redundant code basic block is c. R，i , 0 < i < m, the number of edges is e, the original set of basic blocks B = {B x |x∈[0,n),x∈Z,B x ∈G}, the total number of original basic block instructions is c o The number of loop instructions is c l The threshold p for executing redundant code blocks, (0 < p < 1).

[0090] The probability of redundant code being executed is: P(B)R )=1-p

[0091] Let the complexity of the control flow loop be denoted as V(G) = e^(-n+2), then the rate of increase in loop complexity after confusion is...

[0092] Average effective instruction execution rate:

[0093] The specific method for performing control flow flattening and obfuscation on the preliminary results to obtain the final results is as follows:

[0094] S81 constructs a set of redundant code basic blocks;

[0095] Specifically, construct a set B of m redundant code basic blocks. R ={B R，x |x∈[0,m-1]}, constructing redundant code does not affect the logical function of the normal program.

[0096] S82 constructs the basic block for scheduling and control;

[0097] S83 performs control flow flattening and obfuscation on the set of redundant code basic blocks and the preliminary results of the scheduling control basic block to obtain the final result.

[0098] Specifically, during control flow leveling, assuming the number of original basic blocks is n, and each original basic block B... x :{B x |x∈[0,n-1],B x Scheduling variable B ∈G} x，T Initialized to a random value B x，T =rand, (0x0≤rand≤0xFFFFFFFF), the label value of the scheduling control basic block is initialized to B. C Then construct the original basic block jump address as B. x，j =B c Calculate the execution state St = E(B) before the basic block jump. next，T (key).

[0099] Set a threshold p (0 < p < 1). The scheduling control basic block generates a random number c (0 < c < 1). If c < p, redundant code is not executed, the jump address is decrypted, and JMP = D(St, key). The program jumps to the normally executing basic block. If c > p, then JMP = D(B R，r，T If r∈[0, m-1], the program jumps to the redundant code block for execution.

[0100] Create a loop skeleton, which is the main framework of the switch structure, such as... Figure 6As shown, the loop skeleton includes the loop's entrance and exit. The first basic block is placed on top, followed by `loopEntry`. `loopEnd` is set to `loopEntry`. `switch default` is set to `loopEnd`.

[0101] Add all the basic blocks to the switch skeleton.

[0102] S9 performs expression substitution on the final result to obtain the final expression;

[0103] Specifically, the binary operations in the final result are replaced with multivariate equivalence operations to obtain the final expression.

[0104] S10 uses an optimization layer to optimize the intermediate expression or the final expression to obtain the corresponding optimization parameters.

[0105] Specifically, IR control is handed over to LLVM, which handles the IR-to-machine code conversion. The final output is executable code with complex control flow obfuscation.

[0106] Beneficial effects:

[0107] 1. In traditional control flow flattening obfuscation, scheduling variables are easily traced and the original program control flow restored through static analysis, simulated execution, or dynamic debugging. This solution's control flow flattening obfuscation, which encrypts scheduling variables and executes randomly, effectively resists static control flow analysis, and simulated execution or dynamic debugging cannot restore the code to understandable semantics.

[0108] 2. Constructing opaque predicates based on two-dimensional chaotic mappings: The real number sequences generated by the Arnold Cat two-dimensional chaotic mapping have dependence on initial parameters, pseudo-randomness, and finite truth values. Therefore, the opaque predicates constructed based on this mapping have high security performance.

[0109] 3. The control flow graph generated by the enhanced branch path construction is irreducible and highly random, with strong obfuscation strength and elasticity. At the same time, the predicate expression is constructed based on a two-dimensional chaotic mapping, and the false path contains redundant code of equivalent and non-equivalent clones, which makes the obfuscation highly covert.

[0110] The above-disclosed embodiments are merely preferred embodiments of a complex control flow obfuscation method based on the LLVM compilation optimization stage of the present invention. Of course, they should not be construed as limiting the scope of the present invention. Those skilled in the art can understand that implementing all or part of the above embodiments and making equivalent changes in accordance with the claims of the present invention are still within the scope of the invention.

Claims

1. A complex control flow obfuscation method based on the LLVM compilation optimization stage, characterized in that, Includes the following steps: S1 obtains the source code and the compilation parameters corresponding to the source code; S2 translates the source code into a source expression; S3 checks whether there are obfuscation parameters in the compilation parameters. If there are no obfuscation parameters, proceed to step S10. If there are obfuscation parameters, proceed to step S4. S4 uses the obfuscation PASS to obfuscate the source expression, obtaining the obfuscated result; S5 uses the confusion result to construct an opaque predicate based on a two-dimensional chaotic mapping; S6 performs control flow irreducibility obfuscation on the opaque predicate to strengthen the branch path construction, and obtains the transformation result; S7 repeats steps S4 to S6 until the number of iterations reaches a preset value, and a preliminary result is obtained; S8 performs control flow flattening and obfuscation on the preliminary results to obtain the final results; S9 replaces the binary operations in the final result with multivariate equivalence operations to obtain the final expression; S10 uses an optimization layer to optimize the final expression to obtain the corresponding optimization parameters; The enhanced branch path construction includes a branch path with a false path pointing to a predecessor basic block, a branch path with a false path pointing to a successor basic block, a branch path with a false path pointing to an equivalent clone basic block, a branch path with a false path pointing to a non-equivalent clone basic block, and a branch path with a false path pointing to a split basic block. The control flow is irreducibly obfuscated by strengthening the branch path construction of the opaque predicate to obtain the transformation result, including: S61 constructs an empty basic block; The S62 construct basic block is an equivalent clone of the obfuscated basic block. Irrelevant instructions are randomly added to the construct basic block, and arithmetic and logical operations in the expression are equivalently replaced. The S63 constructs a basic block that is a non-equivalent clone of the obfuscated basic block. Some instructions are randomly deleted from the basic block, and arithmetic and logical operations in the expression are randomly replaced. The S64 construct basic block is a split part of the obfuscated basic block, which is divided into two parts, Sub1 and Sub2, and both Sub1 and Sub2 are construct basic blocks. Check the irreducibility of the control flow after the obfuscated basic block is obfuscated, that is, whether the local control flow satisfies the following conditions: If |{b|a∈V-V'∧b∈v'∧<a,b> ∈E-E'}|>2, and All have e1d; If the condition is not met, add an opaque predicate and then construct a reinforced branch path; By performing irreducible obfuscation on the control flow graph, let the control flow graph G =<V,E> Where V represents the set of nodes and E represents the set of edges, the local control flow graph constructed by randomly combining reinforced branch paths through the insertion of opaque predicates satisfies the following conditions: If |{b|a∈V-V'∧b∈v'∧<a,b> ∈E-E'}|>2, and If both have e1d, then an unreducible and obfuscated control flow is constructed; Confusion intensity analysis: Assume that the construction probabilities of the five branch paths confused in this stage are respectively The construction probabilities of the three opaque predicates are the same, which is The probability of selecting the confused basic block is p s , the original basic block set B = {B x |x ∈ [0, n), x ∈ Z, B x ∈ G}, the number of edges of the original basic block is e, and the total number of instructions is c o , construct a set B R of m redundant code basic blocks = {B R,x |x ∈ [0, m), x ∈ Z}, m = n * p s , where the equivalent basic block set B RE , the non - equivalent basic block set B RN , B R = {B RE , B RN}, the number of instructions of each redundant code basic block in B R is c R,i , 0 < i < m, the number of opaque predicate instructions is c l , where the approximate amount of the random opaque predicate is taken as Δ; Let the complexity of the control flow loop be denoted as V(G) = e^(-n+2), then the rate of increase in loop complexity after confusion is... Average effective instruction execution rate: After this stage of confusion, the control flow becomes irreducible. Let the number of confusion rounds in this stage be α, and the maximum nested depth of the original control flow be β. Then, after α rounds of confusion in this stage, the theoretical maximum nested depth of the loop is: η max =α+β; The preliminary results are subjected to control flow flattening and obfuscation to obtain the final results, including: S81 constructs a set of redundant code basic blocks; S82 constructs the basic block for scheduling and control; S83 performs control flow flattening and obfuscation on the preliminary result based on the set of redundant code basic blocks and the scheduling control basic blocks to obtain the final result. During control flow flattening, the original number of basic blocks is n, and each original basic block B... x :{B x |x∈[0,n-1],B x Scheduling variable B ∈G} x,T Initialized to a random value B x,T =rand, (0x0≤rand≤0xFFFFFFFF), the label value of the scheduling control basic block is initialized to B. C Then construct the original basic block jump address as B. x,j =B c Calculate the execution state St = E(B) before the basic block jump. next,T ,key); Set a threshold p, where (0 < p < 1). The scheduling control basic block generates a random number c, where c(0 < c < 1). If c < p, the redundant code is not executed, the decrypted jump address JMP = D(St, key), and the program jumps to the basic block for normal execution; if c > p, then JMP = D(B R,r,T , key), r ∈ [0, m - 1], and the program jumps to the basic block of the redundant code for execution; Create a loop skeleton, which is the main framework of the switch structure. The loop skeleton includes the loop's entrance and exit. Place the first basic block on top, place loopEntry after it, point loopEnd to loopEntry, and point switchdefault to loopEnd. Add all the basic blocks to the switch skeleton.

2. The complex control flow obfuscation method based on the LLVM compilation optimization stage as described in claim 1, characterized in that, The specific method for obfuscating the source expression using obfuscation PASS to obtain the obfuscated result is as follows: S41 utilizes the LLVM compiler framework and follows the LLVM PASS writing standard to declare the obfuscated PASS as a control flow flattening obfuscated PASS and an enhanced path branch transformation PASS. After the declaration is completed, the obfuscated PASS itself is registered to obtain the designed obfuscated PASS. S42 uses the obfuscation PASS designed above to obfuscate the source expression and obtain the obfuscated result.

3. The complex control flow obfuscation method based on the LLVM compilation optimization stage as described in claim 2, characterized in that, The specific method for constructing an opaque predicate based on a binary chaotic mapping using the confusion result is as follows: S51 selects a random basic block from the confusion result; S52 selects the target basic block from the random basic blocks; S53 inserts a perpetually true opaque predicate, a perpetually false opaque predicate, and a perpetually true / false opaque predicate before the target basic block based on a two-dimensional chaotic mapping.

Images