Why Use LLVM for Obfuscation and How to Apply It in Android Development

In Android development, protecting sensitive information like cryptographic keys is critical, and storing them on the device poses a risk of reverse engineering. Moving the key handling to the NDK layer improves security, but the native code itself can still be analyzed, so additional protection is needed.

The article introduces LLVM as a tool for code obfuscation, outlining several techniques:

Instruction substitution (e.g., transforming a = b + c into a = b - (-c) ).

Control‑flow flattening, which converts conditional branches into a switch‑based structure.

Bogus control flow, which injects fake code blocks with configurable probabilities (e.g., -perBCF=20 , -boguscf-loop=3 , -boguscf-prob=40 ).

Custom passes, including a simple pass and a string‑obfuscation pass, demonstrated with example diagrams.

Each technique is illustrated with images of the transformed assembly or intermediate representation, showing how the original logic is concealed while preserving functionality.

The final section summarizes the overall obfuscation principles, providing visual examples of how LLVM transforms code to make reverse engineering more difficult.