Control Flow Protection

ID: ctrl flow
Preset: Normal

This protection mangles the code in the methods so that decompilers cannot decompile the methods.

Parameters

type: This parameter define how Neo ConfuserEx mangles the method code. Supported values are:

• switch: Neo ConfuserEx would insert a switch-base state machine to reorder the codes.

• jump: Neo ConfuserEx would inserts jumps in methods to produce traditional spaghetti code. (Produces unverifiable modules)

Default is switch.

predicate: This parameter define how Neo ConfuserEx store the state variable if type is set to switch. Supported values are:

• normal: Neo ConfuserEx would use the state variable directly.

• expression: Neo ConfuserEx would encode the state variable using dynamically generated expressions.

• x86: Neo ConfuserEx would encode the state variable using dynamically generated native x86 expressions. (Produces unverifiable modules)

Default is normal.

intensity: This parameter is a integer value from 0 to 100, indicates how large is each split code block. Default is 60.

depth: This parameter define how deep is the generated expression if predicate is set to expression or x86. Default is 4.

junk: This parameter is a boolean value indicates whether junk codes would be inserted. Default is false. (Produces unverifiable modules)

Usage in CLI

<protection id="ctrl flow">
	<argument name="predicate" value="x86" />
	<argument name="intensity" value="60" />
	<argument name="depth" value="4" />
	<argument name="junk" value="false" />
</protection>