ModifyIfElse Obfuscation Algorithm

Author

Kamlesh Kantilal (kamlesh@cs.arizona.edu)

Description

The ModifyIfElse obfuscator exchanges the "if" and the "else" part of an if-else statement. It also negates the if instruction (example ifge is replaced by iflt) so that the semantics is preserved.

This algorithm parses the instruction list to look for if statements. Once it encounters an if statement it does a post dominator analysis of its "if" part and the "else" part. Thus it gets a list of block which postdominates the "if" block and a list of block that postdominates the "else" block. It then does a intersection to determine the end of block which is the end of the "if"-"else" statement. It then exchanges the group of block on the "if" side with the group of blocks on the "else" side and negates the "if" instruction to preserve the semantics.

Example

Configuration

There are no extra configuration parameters necessary to run this obfuscator.

References