Hacking Tools

ollvm-unflattener : A Tool For Reversing Control Flow Flattening In OLLVM

Control flow flattening is a common obfuscation technique used by OLLVM (Obfuscator-LLVM) to transform executable logic into complex state-driven structures.

The ollvm-unflattener tool addresses this challenge through Python-based analysis and Miasm framework integration, offering a systematic approach to reverse engineering obfuscated binaries.

This tool specializes in reconstructing original control flow graphs (CFGs) by:

  1. Symbolic execution of flattened functions using Miasm’s engine
  2. State variable analysis to identify dispatch mechanisms and block relationships
  3. Multi-layered deobfuscation through breadth-first search (BFS) of function calls
  4. Binary patching to restore executable logic

Key Features

  • Architecture Support: Currently focuses on x86 architecture (tested on Linux ELF binaries)
  • Dynamic Analysis: Uses symbolic execution instead of static pattern matching
  • Batch Processing: --all flag enables recursive deobfuscation of related functions
  • Visual Validation: Generates Graphviz diagrams for pre/post deobfuscation comparison
bash# Installation
git clone https://github.com/cdong1012/ollvm-unflattener.git
pip install -r requirements.txt

Operational Workflow

  1. Target Identification: Requires function address (-t parameter)
  2. Execution Tracing: Maps state transitions through symbolic execution
  3. CFG Reconstruction: Rebuilds original block connections using recovered logic
  4. Binary Modification: Patches flattened structures with reconstructed flow
Obfuscated CFGRestored CFG
Complex switch-case structureSimplified conditional branches
State-driven transitionsDirect block connections

Limitations

  • Architecture Constraints: No native ARM/x64 support (requires code modifications)
  • Platform Specificity: Primarily tested on Linux binaries
  • Layer Depth: Multi-pass obfuscation requires sequential processing

The tool demonstrates 83% success rate in test cases against single-layer OLLVM flattening, though complex multi-layered obfuscations may require manual intervention.

Future development plans include IDA Pro integration and expanded architecture support, building on concepts from MODeflattener’s static analysis approach.

Varshini

Varshini is a Cyber Security expert in Threat Analysis, Vulnerability Assessment, and Research. Passionate about staying ahead of emerging Threats and Technologies.

Recent Posts

Pystinger : Bypass Firewall For Traffic Forwarding Using Webshell

Pystinger is a Python-based tool that enables SOCKS4 proxying and port mapping through webshells. It…

5 days ago

CVE-Search : A Tool To Perform Local Searches For Known Vulnerabilities

Introduction When it comes to cybersecurity, speed and privacy are critical. Public vulnerability databases like…

6 days ago

CVE-Search : A Tool To Perform Local Searches For Known Vulnerabilities

Introduction When it comes to cybersecurity, speed and privacy are critical. Public vulnerability databases like…

6 days ago

How to Bash Append to File: A Simple Guide for Beginners

If you are working with Linux or writing bash scripts, one of the most common…

6 days ago

Mastering the Bash Case Statement with Simple Examples

What is a bash case statement? A bash case statement is a way to control…

6 days ago

How to Check if a File Exists in Bash – Simply Explained

Why Do We Check Files in Bash? When writing a Bash script, you often work…

1 week ago