undebel/NoFuserEx

[Feature Request] Undo switch case control flow obfuscation

vikramambrose opened this issue · 0 comments

Not sure if this is within scope, but I've noticed that some code obfuscators try to obfuscate the control flow by turning every function into a giant switch statement with non-sequentially selected cases

e.g.

public void foo(string foo)
{
	IL_06:
	uint num = 2346910876u;
	for (;;)
	{
		uint num2;
		switch ((num2 = (num ^ 3075522388u)) % 5u)
		{
		case 1u:
		// do stuff
		num = (num2 * 3623258486u ^ 573975171u);
		continue;
		case 2u:
		// do stuff
		num = (num2 * 2623783498u ^ 3053144548u);
		continue;

This looks like it can be easily reverted by static analysis of the switch case math. So I guess this is a feature request.

Thanks for the great software and keep up the good work.