Reverse › Module 3 › Lesson 3
Control Flow
Graphs, loops, and switches structure programs — map control flow on $RE_LAB disassembly, not to hide malware.
Visual · re_control_flow
Control flow literacy. $RE_LAB only. Original Cyberlium.
Opening
Control flow graphs turn spaghetti disassembly into readable decision trees.
Basic blocks run straight-line until a branch; edges connect jumps and falls-through. Loops appear as backward jumps; switch tables use jump registries. Ghidra and objdump help visualize flow in authorized crackmes on $RE_LAB. Cyberlium teaches CFG literacy for finding check functions. You will NOT obfuscate malware or hide unauthorized payloads. Next: Asm Lab.
1. Basic blocks and edges
A basic block has one entry and one exit (except function start). Conditional jumps split blocks — JE to success, JNE to failure is the classic crackme fork.
Mark block addresses in YOUR toy binary disassembly on $RE_LAB; label check, success, fail blocks.
Command guide
Try these commands — Basic blocks and edges
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Control flow — https://sourceware.org/binutils/docs/binutils/objdump.html (branches and calls) x86 Jcc instructions — https://www.felixcloutier.com/x86/ (conditional jumps) pwn.college — https://pwn.college/ (control-flow in CTF labs)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install binutils sudo apt install build-essential
macOS: Built-in (Xcode CLI) or brew install binutils
Command — copy this
xcode-select --install # or brew install gcc
Windows: Use WSL binutils Use WSL or MinGW
═══ LINUX / macOS ═══
Command — copy this
export LAB_RE=${LAB_RE:-$HOME/cyberlium-lab/t23-re}
cat > "$LAB_RE/src/branch.c" <<'EOF'
#include <stdio.h>
int pick(int n) {
if (n > 10) return 100;
if (n == 7) return 42;
return n;
}
int main(void) { printf("%d
", pick(7)); return 0; }
EOFCommand — copy this
gcc -Wall -O0 -g -o "$LAB_RE/bin/branch" "$LAB_RE/src/branch.c" objdump -d "$LAB_RE/bin/branch" | grep -E '<pick>|j[e|ne|g|l]|cmp' | head -15
Primary tools to practice this lesson: objdump, gcc. Reference sites: Control flow (https://sourceware.org/binutils/docs/binutils/objdump.html); x86 Jcc instructions (https://www.felixcloutier.com/x86/); pwn.college (https://pwn.college/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Loops and switches
Loops: compare at bottom, JNE to top. Switches: jump table indexed by case value — CTF binaries love switch obfuscation on $RE_LAB.
Follow induction variable in RCX/RAX when reversing character-by-character password loops.
3. CFG literacy for learning only
Forbidden: control-flow flattening for malware, opaque predicates on unauthorized binaries, or evasion against enterprise EDR outside defensive research with authorization.
Ship: rough CFG sketch — three blocks, two edges — for YOUR toy check function. Next: Asm Lab.
4. What you ship: control flow sketch for $RE_LAB
Three-block CFG for YOUR toy check. $RE_LAB named. NEVER malware obfuscation. chmod 600.
5. What you record before the next lesson
Date. CFG sketch. $RE_LAB named. File t23-m03-l03-control-flow.txt chmod 600.
6. Wrong vs right: commercial piracy vs crackmes/CTF toys
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Flatten control flow in unauthorized binary. Skip labeling success/fail blocks.
Right
Sketch CFG for $RE_LAB toy check. Next: Asm Lab.
Mission: sketch YOUR toy binary CFG
1) Draw three basic blocks with one conditional edge. 2) Label check, success, fail. 3) chmod 600.
Stuck? Ask Cyberlium AI Mentor
One backward edge usually means a loop.
Knowledge Check
APPLY: Control flow literacy means:
Multiple choice
Knowledge Check
APPLY: True or False: A conditional jump creates two possible successor blocks.
True or False
Knowledge Check
APPLY: Character-check loops often use:
Multiple choice