Control Flow Flattening

JS-Confuser

Try It Out

NPM GitHub

Control Flow Flattening

Control-flow Flattening hinders program comprehension by creating convoluted switch statements.

⚠️ Significantly impacts performance, use sparingly!

Option name: "controlFlowFlattening"

Option values: true/false/0-1

Requires Non-Strict Mode

The obfuscated code will not work properly in Strict Mode.

You can use the Pack option to bypass Strict Mode constraints.

Input / Output

This example showcases how Control Flow Flattening transforms the code. Try it out by changing the input code and see changes apply in real-time.

Input.js

Output.js

function* OlgKuer(FBX8lB, tiGm2U, LU5_WH = {
  rg4bUS: {}
}, Hoj87O) {
  while (FBX8lB + tiGm2U !== 165) with (LU5_WH.xpqYGw || LU5_WH) switch 
  (FBX8lB + tiGm2U) {
    case LU5_WH.rg4bUS.Cmd7dQ_ + 291:
      [YzwJnh4.Bfqwwty] = Hoj87O;
      for (YzwJnh4._4CN7F = FBX8lB + 175; YzwJnh4._4CN7F <= YzwJnh4.Bfqwwty; 
      YzwJnh4._4CN7F++) console.log(YzwJnh4._4CN7F);
      return;
    case -113:
      [LU5_WH.rg4bUS.Cmd7dQ_, LU5_WH.rg4bUS.ATFA98] = [-204, 28];
      rg4bUS.caIemDj = function (...FBX8lB) {
        return OlgKuer(-174, 261, {
          rg4bUS: LU5_WH.rg4bUS,
          YzwJnh4: {}
        }, FBX8lB).next().value;
      };
      rg4bUS.z05L2S = FBX8lB + -5;
      return (1, rg4bUS.caIemDj)(rg4bUS.z05L2S);
    case -29:
    case 159:
    default:
      LU5_WH.xpqYGw = LU5_WH.foNwph, FBX8lB += -214, tiGm2U += 69;
      break;
    case FBX8lB - -11:
    case -137:
    case tiGm2U - -252:
    case -162:
      LU5_WH.xpqYGw = LU5_WH.ywVqJFw, FBX8lB += -237, tiGm2U += 136;
      break;
    case -159:
    case 175:
      [LU5_WH.rg4bUS.Cmd7dQ_, LU5_WH.rg4bUS.ATFA98] = [104, 127];
      LU5_WH.xpqYGw = LU5_WH.fBHwLY, FBX8lB += -234, tiGm2U += 558;
      break;
    case -79:
    case LU5_WH.rg4bUS.Cmd7dQ_ + 111:
      LU5_WH.xpqYGw = LU5_WH.bi8VVCQ, FBX8lB += -234, tiGm2U += 492;
      break;
    case -73:
    case -70:
    case tiGm2U - -34:
      LU5_WH.xpqYGw = LU5_WH.eY5X4s1, FBX8lB += 8, tiGm2U += 387;
      break;
    case FBX8lB - 247:
      LU5_WH.xpqYGw = LU5_WH.Ym9g26b, FBX8lB += -261, tiGm2U += 119;
      break;
  }
}
OlgKuer(15, -128).next().value;

Requires Non-Strict Mode

Control Flow Flattening requires non-strict mode to work. This is because the with statement is used to conceal local scope variables.

It is recommended to enable the Pack option when using Control Flow Flattening.

Control Flow Flattening Process

Control Flow Flattening transforms the code into a large, convoluted switch statement. This switch statement is intended to replicate the functionality of the 'goto' statement seen in other languages.

The switch statement is designed to be difficult to follow, making it harder for reverse engineers to understand the program's flow.

Control Flow Flattening introduces dead code:
Add fake chunks that are never reached
Add fake jumps to really mess with deobfuscators ("irreducible control flow")
Clone chunks but these chunks are never ran
Control Flow Flattening introduces opaque predicates:
Add fake conditions that are always true or false
Control Flow Flattening mangles the scoped variables through the use of the with statement.
This makes identifiers harder to track from static analysis tools.
Control Flow Flattening obfuscates IF-statements into equivalent switch-case statements.
Control Flow Flattening obfuscates certain eligible functions into equivalent switch-case statements.

Usage Example

The provided code example will obfuscate the file input.js and write the output to a file named output.js.

Usage Example

import JSConfuser from "js-confuser";
import {readFileSync, writeFileSync} from "fs";
// Read input code
const sourceCode = readFileSync("input.js", "utf8");
const options = {
  target: 'browser',
  controlFlowFlattening: true,
};
JSConfuser.obfuscate(sourceCode, options).then((result)=>{
  // Write output code
  writeFileSync("output.js", result.code);
}).catch(err=>{
  // Error occurred
  console.error(err);  
});

Enabled In

High Preset: Yes (50%)
Medium Preset: Yes (25%)
Low Preset: No

Performance reduction

Control Flow Flattening reduces the performance of your program. You should adjust the option controlFlowFlattening to be a percentage that is appropriate for your app.

Other notes

Control Flow Flattening only applies to:

Blocks of 3 statements or more