Control Graph Flattening

From ema
Revision as of 17:35, 7 July 2017 by Cicalese (talk | contribs) (Text replacement - "|Associated Behavior=ema-" to "|Associated Behavior=Ema-")
Jump to navigation Jump to search
EMA ID: ema-1105
Description: Flattening the control flow of each function by first breaking up the nesting of loops and if-statements, and then hiding each of them in a case of a large switch statement, that is wrapped inside the body of a loop.
Associated Behavior: linear disassembler prevention


References:
Date Malware Family URL
http://unprotect.tdgt.org/index.php/Anti-disassembly