Control Flow Obfuscation rearranges the instructions in a method so that its flow of control is harder for both people and decompilers to follow. It removes many of the patterns decompilers look for when they try to rebuild source code. As a result, decompilers either fail outright on a protected method or produce code that's very hard to understand. This makes it harder for attackers to read and copy your algorithms.
This article explains how Control Flow Obfuscation works. To configure it, see Configuring Control Flow.
Control Flow Obfuscation Features
You enable or disable Control Flow Obfuscation as a whole, and each of its three features individually.
Block Jumbling
Block Jumbling randomly changes the order in which code blocks appear in a method's bytecode. The JVM still runs them in the original order. It works best on methods with many blocks. If a method's flow of control is relatively simple, use Block Splitting to create more blocks to rearrange.
Try/Catch Obfuscation
Try/Catch Obfuscation adds Try/Catch handlers to methods. The extra handlers break up control flow patterns that many decompilers depend on. You set the maximum number of handlers DashO adds to each method.
Block Splitting
Block Splitting splits blocks of code into smaller blocks. This gives Block Jumbling more blocks to rearrange, which makes it much more effective, especially on simpler methods.
Block Splitting can add many instructions to a method, which increases its size and may slow it down. To control this, you set the minimum number of bytecode instructions in each new block. A higher minimum produces fewer, longer blocks and fewer new instructions.
Includes and Excludes
Control Flow Obfuscation provides strong protection, but it can noticeably affect runtime performance and code size. Use include and exclude rules to balance protection and performance:
- Exclude classes or methods that contain performance-critical code.
- Include only the parts of your code with particularly sensitive algorithms, to focus protection there.
DashO decides which methods to protect as follows:
| Rules defined | Methods DashO protects |
| No include rules | All methods not covered by an exclude rule. |
| One or more include rules | Only methods covered by an include rule. |
Effect on LocalVariableTable and LocalVariableTypeTable
Control Flow Obfuscation can't leave the LocalVariableTable and LocalVariableTypeTable attributes intact, even if you configure DashO to keep them:
| Attribute | What Control Flow Obfuscation does |
LocalVariableTable |
Removes most of its information. If you configure DashO to keep this attribute, DashO keeps method parameter names. |
LocalVariableTypeTable |
Removes the attribute entirely. |
DashO emits a warning when it removes this information.
Limitations and Troubleshooting
| Limitation or issue | Details |
| Slower runtime performance or larger code. | Control Flow Obfuscation, especially Block Splitting, adds instructions. Exclude performance-critical code, or raise the minimum block size. |
| Local variable information is missing after protection. | Control Flow Obfuscation always removes most of LocalVariableTable and all of LocalVariableTypeTable. |
| The protected app misbehaves on older Android devices. | Enable Dalvik Compatibility for devices that use the Dalvik VM. |
| Very small methods show little change. | Control Flow Obfuscation alters existing code, so it's less effective on methods with only a few bytecode instructions. These methods rarely contain much intellectual property. |