Obfuscate Your Code With Control Flow

Control Flow Obfuscation makes decompiled code more difficult to understand by altering the code patterns that decompilers use to reconstruct high-level source code.

During protection, Dotfuscator introduces additional constructs, such as false conditional statements and other misleading logic structures. These transformations produce valid executable code while making the resulting control flow more difficult for decompilers to interpret accurately.

The goal of Control Flow Obfuscation is to increase the effort required to reverse engineer an application by preventing reliable automatic decompilation of Microsoft Intermediate Language (MSIL) into high-level source code.

How Control Flow Obfuscation Works

Applications compiled for .NET contain Microsoft Intermediate Language (MSIL), which decompilers analyze to recreate source code.

Control Flow Obfuscation transforms method implementations by:

• Introducing misleading branching and conditional logic.
• Modifying execution paths while preserving behavior.
• Disrupting patterns commonly used by decompilers.
• Producing valid executable code that is more difficult to analyze.

Although users can still inspect the MSIL, the resulting code is significantly more difficult to understand, modify, and maintain.

Example

The following example illustrates the effect of Control Flow Obfuscation on decompiled code.

Before Protection	After Protection (with Renaming)

Benefits

Control Flow Obfuscation helps protect application logic by increasing the complexity of decompiled code.

Common benefits include:

• Making application logic more difficult to understand.
• Increasing the effort required to reverse engineer algorithms.
• Reducing the usefulness of automatically generated decompiled source code.
• Complementing other protection features such as Renaming and String Encryption.

Limitations and Performance Considerations

Control Flow Obfuscation is not appropriate for every scenario and should be tested as part of the protection process.

Performance Impact

Control Flow Obfuscation can increase the complexity of protected methods and may affect runtime performance.

Pay particular attention to:

• Game loops
• Computationally intensive methods
• Frequently executed code paths
• Performance-critical algorithms

After enabling Control Flow Obfuscation, test the protected application and measure performance in real-world usage scenarios.

Method Requirements

Control Flow Obfuscation is most effective when a method contains a sufficient number of basic blocks and meets other internal requirements.

As a result, not every method can be transformed to the same degree.

Non-Deterministic Output

Control Flow Obfuscation is not fully deterministic.

Two methods with identical IL may produce different obfuscated output while remaining functionally equivalent.

This behavior is expected and does not affect application functionality.

Excluding Code from Control Flow Obfuscation

Control Flow Exclusions allow specific code elements to be excluded from Control Flow Obfuscation.

Control Flow Exclusions function similarly to Renaming Exclusions and support:

• Specific exclusions
• Custom exclusion rules

Unlike Renaming Exclusions, Control Flow Exclusions apply only to methods.

When to Create Exclusions

Consider excluding methods when testing identifies unacceptable performance degradation.

This is most commonly required for:

• Computationally intensive methods
• Frequently executed methods
• Performance-critical processing loops
• CPU-bound operations

When creating exclusions, start with the smallest scope possible and expand only when necessary.

Control Flow Levels

Dotfuscator provides multiple Control Flow protection levels.

For most applications, use High and create targeted exclusions when performance testing indicates they are required.

Apply Control Flow Obfuscation

Control Flow Obfuscation can be configured through the Control Flow Editor.

1. In the Config Editor, go to the Settings tab and ensure the Control Flow feature is enabled.
2. Go to Control Flow > Exclude and select the methods you want to exclude from the application tree view. 
3. Add custom exclusion rules, if necessary.
4. In the Option tab, select a Control Flow Level.
5. Build the protected application.
6. Test the protected application to verify that it functions as expected.

For more information about available settings and exclusion options, see The Control Flow Editor.

Related Articles

• Understanding Protection with Dotfuscator
• The Control Flow Editor 
• Obfuscate Your Code with Renaming