List

// Buffer is a copy of the .text section

function Deflow(byte[] buffer, ulong[] functions)

  for(int i = 0; i < functions.Length; i++)

    do

      int newDiscovered = 0;

      List

      while(chunks.Count != 0)

        List

        foreach(var c in chunks)

          newChunks.AddRange(DeflowChunk(buffer, c));

        newDiscovered += chunks.Count;

        chunks = newChunks;

    while (newDiscovered != 0)

function DeflowChunk(address)

  List

  // 63th bit indicates if this address was extracted from a negative jump or not

  bool isNegative = address >> 63 == 1;

  address &= 1 << 63;

  // Check if already discovered

  if(_alreadyDiscovered.Contains(address))

    return newChunks;

  _alreadyDiscovered.Add(address);

  ulong lastBranch = 0;      // Indicates our last conditional jump address

  ulong lastBranchSize = 0;  // Size of the last conditional jump address

  ulong lastTarget = 0;      // Target location of the last conditional jump

  int stepsLeft = 0;         // Steps (bytes) left to reach lastTarget from current address

  // Usage of SharpDisasm

  var disasm = new Disassembler(buffer, address - base); // NOTE: base = BaseAddress + .text offset

  foreach(var insn in disasm.Disassemble())

    ulong target = 0;

    ulong lastAddrStart

    bool isJmp = true;

    switch(insn.Mnemonic)

      // Stop analysing when we encounter a invalid or return instruction while we have no lastTarget

      case ud_mnemonic_code.Invalid:

      case ud_mnemonic_code.Ret:

        if(lastTarget == 0)

          return newChunks; // Only accept when no lastTarget as we may be looking at junk code

        break;

      case ud_mnemonic_code.ConditionalJump: // all conditional jumps

        if(lastTarget == 0)

          target = calcTargetJump(insn); // Helper to extract jump location from instruction

          if(!isInRange(target)) // Helper to see if target address is located in our Buffer

            isJmp = false;

            break;

          // Check if instruction is bigger then 2, if so it wont be obfuscated but we

          // do want to analyse the target location

          if(insn.Length > 2)

            isJmp = false;

            newChunks.Add(target);

            break;

        else

          isJmp = false; // Do not this conditional jump accept while we already

                           // have a target (might be looking at junk code)

        break;

      case ud_mnemonic_code.UnconditionalJump:

      case ud_mnemonic_code.Call:

        if(lastTarget == 0)

          ulong newAddress = calcTargetJump(insn); // Helper to extract jump location from instruction

          if(!isInRange(newAddress))

            isJmp = false;

            break;

          // Add target and next instruction IF not JMP (CALL does return, JMP not)

          if(insn.Mnemonic == ud_mnemonic_code.Call)

            newChunks.Add(address + insn.PC);

          // Add instruction target for further analyses

          newChunks.Add(newAddress);

          return newChunks;

        break;

    // quick mafs

    ulong location = (address+insn.Offset);

    stepsLeft = (int)(lastTarget - location); // Only valid if we have a lastTarget!

    // Setup a new target if current instruction is conditional jump while there is no lastTarget

    if(lastTarget == 0 && isJmp)

      lastBranch = loction;

      lastBranchSize = insn.Length;

      lastTarget = target;

    else if (stepsLeft <= 0 && lastTarget != 0)

      // if stepsLeft isn't zero then our lastTarget is located slighlt above us,

      // meaning that we are partly located inside the previous instruction and thus we are hidden (obfuscated)

      if(stepsLeft != 0)

        int count = lastTarget = lastBranch; // calculate how much bytes we are in the next instruction

        if(count > 0)

          // making sure we are a positive jump

          int bufferOffset = lastBranch - base; // subtract base from out address so we can write to our local buffer

          // NOP slide everything except our own instruction

          if(int i = 0; i < count - lastBranchSize; i++)

            buffer[bufferOffset + lastBranchSize + i] = isNegative ? 0x90 : 0xCC; // We use NOP for negative jumps

                                                                                  // and int3 for positive

          if(!isNegative)

            buffer[bufferOffset] = 0xEB; // Force unconditional Jump

          // add next instruction for analyses and exit current analysis

          newChunks.Add(lastTarget);

          return newChunks;

        else

          // we are a negative jump, set 63th bit to indicate negative jump

          lastTarget = |= 1 << 63;

          // add target to analyser and exit current analysis

          newChunks.Add(lastTarget);

          return newChunks;

      else

        // stepsLeft was zero, meaning there is no collision

        // add both target address and next instruction address so we can exit current analysis

        newChunks.Add(lastBranch + lastBranchSize);

        newChunks.Add(lastTarget);

        return newChunks;

  return newChunks;