Executable Control Flow Reconstruction for Flattened Malware

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing malware detection systems struggle to identify malicious executables that employ control flow flattening to obscure their true operation, making it difficult to analyze and detect such malware.

Innovation Solution

A deobfuscation engine analyzes executable images to categorize instruction codes into dispatcher, conditional function, and unconditional function blocks, reconstructing a non-obfuscated control flow by identifying and removing obfuscation mechanisms, enabling more accurate malware detection.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Difficulty of detecting and measuring

If control flow flattening is applied to obfuscate malware, then detection difficulty increases, but analysis complexity increases

Engineering Contradiction:

Improvemalware detection difficultyVSAvoidcontrol flow analysis complexity

Core Design Contradiction:

Difficulty of detecting and measuringVSDevice complexity

Solution Approach 1:

The patent segments the flattened control flow into discrete basic blocks and identifies dispatcher patterns that control execution flow between these blocks. By breaking down the obfuscated control flow into manageable segments and analyzing the dispatcher logic that connects them, the system can reconstruct the original control flow without being overwhelmed by the overall complexity of the flattened structure.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent introduces an intermediary analysis layer that detects dispatcher variables and control flow transfer instructions as intermediate elements. This intermediary layer acts as a bridge between the obfuscated flattened control flow and the original control structure, allowing the system to trace execution paths through the dispatcher logic and reconstruct the non-obfuscated control flow graph.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If control flow flattening is used to disguise malware, then malware evasion improves, but computational resources for analysis increase

Engineering Contradiction:

Improvemalware evasion capabilityVSAvoidcomputational resources for analysis

Core Design Contradiction:

ReliabilityVSUse of energy by moving object

Solution Approach 1:

The patent extracts and removes the obfuscation elements (dispatcher blocks and control flow transfer instructions) from the control flow graph. By taking out these artificial complexity-inducing elements, the system reduces the computational burden of analysis while maintaining the ability to detect malware, as the core malicious functionality remains identifiable without the disguising layer.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The patent discards the obfuscated control flow structure and recovers the original control flow by tracing execution paths through dispatcher analysis. This process eliminates the computationally expensive analysis of flattened control structures while recovering the essential control flow information needed for malware detection, thereby reducing resource consumption without sacrificing detection capability.

Inventive Principle:

Principle #34Discarding and recovering

3Device complexity

If dispatcher blocks and control flow transfer instructions are added for obfuscation, then code complexity increases, but detection accuracy can be improved

Engineering Contradiction:

Improvecontrol flow structure complexityVSAvoidmalware detection accuracy

Core Design Contradiction:

Device complexityVSMeasurement precision

Solution Approach 1:

The patent uses dispatcher variables and control flow transfer instructions as intermediary elements that, while adding structural complexity, actually enable more precise malware detection. By analyzing these intermediary elements, the system can trace the exact execution paths taken by the malware, providing precise measurement of the malware's behavior and improving detection accuracy despite the increased structural complexity.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent effectively 'colors' or labels different types of blocks (dispatcher blocks, conditional function blocks, unconditional function blocks) and control flow transfer instructions within the control flow graph. This classification and labeling system transforms the complex structure into a analyzable format where different elements have distinct meanings, enabling more accurate malware detection by highlighting suspicious patterns and behaviors.

Inventive Principle:

Principle #32Color changes

Data Source

PatentUS12518011B2Techniques for remediating control flow flattening

Publication Date: 2026.01.06 CROWDSTRIKE

AI summary

A computer-implemented method for deobfuscating an executable image including a plurality of computer instructions organized in a first control flow is provided. The computer-implemented method includes analyzing the executable image to identify a plurality of discrete blocks of the computer instructions, the computer instructions of each of the discrete blocks comprising a control flow transfer instruction and a dispatcher variable, categorizing a type of each of the discrete blocks into one of a plurality of block types, wherein the plurality of block types comprise a conditional functional block type, an unconditional functional block type, and a dispatcher block type, based on the type of each of the discrete blocks, reorganizing the computer instructions of the executable image into a second control flow, different from the first control flow.