github:

https://github.com/obfuscator-llvm/obfuscator/tree/llvm-4.0

先复制 include Obfuscation:

/home/nowind/llvm/ollvm/obfuscator/include/llvm/Transforms/Obfuscation

/home/nowind/llvm/llvm-project-9.0.1/llvm/include/llvm/Transforms/Obfuscation

lib Obfuscation:

/home/nowind/llvm/ollvm/obfuscator/lib/llvm/Transforms/Obfuscation

/home/nowind/llvm/llvm-project-9.0.1/llvm/lib/Transforms/Obfuscation

再复制：

/home/nowind/llvm/ollvm/obfuscator/include/llvm/CrytoUtils.h

/home/nowind/llvm/llvm-project-9.0.1/llvm/include/llvm/CrytoUtils.h

在/home/nowind/llvm/llvm-project-9.0.1/llvm/lib/Transforms/目录中的

CMakeLists.txt 中增加 add_subdirectory(Obfuscation)

LLVMBuild.txt中增加 Obfuscation

在/home/nowind/llvm/llvm-project-9.0.1/llvm/lib/IPO/ 中增加Obfuscation

修改PassManagerBuilder 文件

报错：/home/nowind/llvm/llvm-project-9.0.1/llvm/lib/Transforms/Obfuscation/Flattening.cpp:68:25: error: ‘createLowerSwitchPass’ was not declared in this scope

增加#include "llvm/Transforms/Utils.h"

ninja LLVMObfuscation

ninja clang

fix bug:https://github.com/obfuscator-llvm/obfuscator/pull/76/files

混淆的4种特性：https://github.com/obfuscator-llvm/obfuscator/wiki/Features

1、指令替换Instructions Substitution ，加减等运算符替换，增加无用数值

clang -mllvm -sub hello_ollvm.c -o hello_ollvm_sub IDA已做优化，可直接识别

clang -mllvm -sub -mllvm -sub_loop=3 hello_ollvm.c -o hello_ollvm_sub2，替换3次

2、虚假的控制流程 bogus control flow，bcf

clang -mllvm -bcf hello_ollvm_bcf.c -o hello_ollvm_bcf

clang -mllvm -bcf -mllvm -bcf_loop=3 hello_ollvm_bcf.c -o hello_ollvm_bcf

clang -mllvm -bcf -mllvm -bcf_prob=40 hello_ollvm_bcf.c -o hello_ollvm_bcf 混淆百分比

3、控制流程平坦化 Control Flow Flattening 转成switch

clang -mllvm -fla hello_ollvm_bcf.c -o hello_ollvm_fla 其中hello_ollvm_fla为可执行文件

clang -mllvm -fla -mllvm -split hello_ollvm_bcf.c -o hello_ollvm_fla

clang -mllvm -fla -mllvm -split_num=3 hello_ollvm_bcf.c -o hello_ollvm_fla

4、给函数增加混淆特性：

__attribute((__annotate__(("fla"))));

__attribute((__annotate__(("nosub")))) __attribute((__annotate__(("nobcf"))));

混合：

clang -mllvm -fla -mllvm -split -mllvm -split_num=3 -mllvm -bcf -mllvm -bcf_loop=3 -mllvm -bcf_prob=40 -mllvm -sub -mllvm -sub_loop=3 hello_ollvm_bcf.c -o hello_ollvm_obf

clang -mllvm -fla -emit-llvm -S hello_ollvm_bcf.c -o hello_ollvm_fla.ll 生成ll文件

clang -mllvm -fla -S hello_ollvm_bcf.c -o hello_ollvm_fla.s 生成汇编文件

在源码外编译使用ollvm：

git 切换到最初始的源码，没有ollvm的代码中，我这里是master分支，

ollvm 源码外下载的资料：

https://download.csdn.net/download/ahjxly/88624738https://download.csdn.net/download/ahjxly/88624738使用clang 执行ollvm：

clang -Xclang -load -Xclang /home/nowind/llvm/pro/pro4/OLLVM/cmake-build-debug/ollvm/lib/Transforms/Obfuscation/LLVMObfuscation.so -mllvm -fla /home/nowind/llvm/pro/pro4/example/hello_ollvm_fla.c -emit-llvm -S -o /home/nowind/llvm/pro/pro4/example/hello_llvm_fla.ll

 断点的话要使用clang-9:

/home/nowind/llvm/llvm-project-9.0.1/llvm/cmake-build-debug/bin/clang-9 -cc1 -triple x86_64-unknown-linux-gnu -emit-llvm -disable-free -main-file-name hello_ollvm_fla.c -mrelocation-model static -mthread-model posix -mdisable-fp-elim -fmath-errno -masm-verbose -mconstructor-aliases -munwind-tables -fuse-init-array -target-cpu x86-64 -dwarf-column-info -debugger-tuning=gdb -coverage-notes-file /home/nowind/llvm/pro/pro4/example/hello_llvm_fla.gcno -resource-dir /home/nowind/llvm/llvm-project-9.0.1/llvm/cmake-build-debug/lib/clang/9.0.1 -internal-isystem /usr/local/include -internal-isystem /home/nowind/llvm/llvm-project-9.0.1/llvm/cmake-build-debug/lib/clang/9.0.1/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -fdebug-compilation-dir /home/nowind/llvm/llvm-project-9.0.1/llvm/cmake-build-debug/bin -ferror-limit 19 -fmessage-length 0 -fobjc-runtime=gcc -fdiagnostics-show-option -fcolor-diagnostics -load /home/nowind/llvm/pro/pro4/OLLVM/cmake-build-debug/ollvm/lib/Transforms/Obfuscation/LLVMObfuscation.so -mllvm -fla -faddrsig -o /home/nowind/llvm/pro/pro4/example/hello_llvm_fla.ll -x c /home/nowind/llvm/pro/pro4/example/hello_ollvm_fla.c