Control-Flow Flattening in Python: How It Works (Real Example)

Normal code reads top-to-bottom: an if here, a for there, a return at the end. Flattening throws that away. It chops the function into basic blocks, drops them all into one big while True loop, and adds a state variable (a dispatcher) that decides which block runs next. Each block ends by setting the state to the *next* block and looping back. The blocks are emitted in a scrambled order, so the numbers you read top-to-bottom have nothing to do with execution order.

Here's the function I fed in — deliberately simple so the transform is easy to see:

def classify(n):
    if n < 0:
        label = "negative"
    else:
        label = "positive"
    total = 0
    for i in range(n):
        total += i
    return label, total

Running it through the obfuscator with only the Flatten layer on (194 → 978 characters), the branches and loop become a state machine:

def classify(n):
    llIIlllIllllIllll = 1810111
    while True:
        if llIIlllIllllIllll == 2215279:
            total = 0
            llIIlllIllllIllll = 9990608
            continue
        if llIIlllIllllIllll == 2579240:
            return (label, total)
        if llIIlllIllllIllll == 9990608:
            for i in range(n):
                total += i
            llIIlllIllllIllll = 2579240
            continue
        if llIIlllIllllIllll == 1810111:
            if n < 0:
                label = 'negative'
            else:
                label = 'positive'
            llIIlllIllllIllll = 2215279
            continue
print(classify(5))

String encryption can be undone by running the decoder; renaming just costs you readable names. Flattening is different: there is no original structure to recover. A decompiler turns the .pyc back into source, but the source it produces *is* the dispatcher — the if/for shape is genuinely gone from the compiled form. To understand the function, an analyst has to mentally execute the state machine, tracking the state variable by hand. On real code with dozens of states and nested loops, that's slow and error-prone.

On its own, flattened code still has readable names and plaintext strings. The point of a real obfuscator is to stack layers so each one removes a different clue: rename identifiers, encrypt strings, flatten control flow, inject junk. Stacked, they multiply an attacker's effort. Our obfuscator applies flattening as one togglable layer among several — see the full picture in How to obfuscate Python code.

Two honest caveats: flattening grows your code (here, 5×) and adds a small runtime cost from the dispatcher loop, and a determined reverse-engineer with the right tooling can partially un-flatten it. It raises the bar; it isn't a wall.