基于Frida的OLLVM混淆代码动态分析技术教学文档<\/h1>

前言<\/h2>
在移动应用安全领域，代码混淆技术是保护商业应用知识产权、抵御逆向工程的重要手段。OLLVM（Obfuscator-LLVM）作为强大的开源混淆工具，通过字符串加密、控制流程平坦化、指令替换等技术显著增加逆向分析难度。传统静态分析方法难以应对复杂混淆，需要Frida等动态插桩框架进行辅助分析。<\/p>

一、Frida辅助分析OLLVM字符串加密<\/h2>

1.1 字符串加密原理<\/h3>
字符串加密在编译时对明文字符串进行加密存储，避免以明文形式存在于二进制文件中，增加静态分析难度。<\/p>

1.2 实例分析<\/h3>

1.2.1 Java层与Native层交互<\/h4>

Java层调用native函数sign1<\/code>，模块在libhello-jni.so<\/code><\/li>
Native层导出表搜索无目标函数，推测为动态注册<\/li>

分析JNI_OnLoad<\/code>函数：<\/li>
<\/ul>
jint JNI_OnLoad<\/span>(JavaVM *<\/span>vm, void<\/span> *<\/span>reserved) {
<\/span><\/span>    JNIEnv *<\/span>env;
<\/span><\/span>    \/\/ 获取JNI环境
<\/span><\/span><\/span><\/span>    if<\/span> ((*<\/span>vm)-><\/span>GetEnv(vm, &<\/span>env, 65540LL<\/span>)) return<\/span> -<\/span>1<\/span>;
<\/span><\/span>    
<\/span><\/span>    \/\/ 动态注册Native方法
<\/span><\/span><\/span><\/span>    jclass clazz =<\/span> (*<\/span>env)-><\/span>FindClass(env, "com\/example\/hellojni\/HelloJni"<\/span>);
<\/span><\/span>    JNINativeMethod methods[] =<\/span> {{"sign1"<\/span>, "()Ljava\/lang\/String;"<\/span>, (void<\/span>*<\/span>)sub_E76C}};
<\/span><\/span>    (*<\/span>env)-><\/span>RegisterNatives(env, clazz, methods, 1<\/span>);
<\/span><\/span>    return<\/span> 65540<\/span>;
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>1.2.2 字符串解密机制<\/h4>

JNINativeMethod<\/code>结构体中字符串被加密（显示为"ycmd;"等乱码）<\/li>
交叉引用发现.datadiv_decode<\/code>解密函数被.init_array<\/code>段调用<\/li>
程序运行时自动执行解密操作<\/li>
<\/ul>
1.3 Frida动态分析技术<\/h3>
1.3.1 Hook Dump方法<\/h4>
function<\/span> print_hex_dump<\/span>(addr<\/span>) {
<\/span><\/span>    var<\/span> libhello_base<\/span> =<\/span> Module<\/span>.findBaseAddress<\/span>("libhello-jni.so"<\/span>);
<\/span><\/span>    console<\/span>.log<\/span>(hexdump<\/span>(libhello_base<\/span>.add<\/span>(addr<\/span>)));
<\/span><\/span>}
<\/span><\/span>
<\/span><\/span>function<\/span> hooknative<\/span>() {
<\/span><\/span>    print_hex_dump<\/span>(0x037070<\/span>); \/\/ 解密字符串地址
<\/span><\/span><\/span><\/span>}
<\/span><\/span><\/code><\/pre>1.3.2 Hook RegisterNatives方法<\/h4>
function<\/span> hook_libart<\/span>() {
<\/span><\/span>    var<\/span> module_libart<\/span> =<\/span> Process<\/span>.findModuleByName<\/span>("libart.so"<\/span>);
<\/span><\/span>    var<\/span> symbols<\/span> =<\/span> module_libart<\/span>.enumerateSymbols<\/span>();
<\/span><\/span>    
<\/span><\/span>    for<\/span> (var<\/span> i<\/span> =<\/span> 0<\/span>; i<\/span> <<\/span> symbols<\/span>.length<\/span>; i<\/span>++<\/span>) {
<\/span><\/span>        var<\/span> name<\/span> =<\/span> symbols<\/span>[i<\/span>].name<\/span>;
<\/span><\/span>        if<\/span> (name<\/span>.indexOf<\/span>("RegisterNatives"<\/span>) ><\/span> 0<\/span> &&<\/span> name<\/span>.indexOf<\/span>("CheckJNI"<\/span>) ==<\/span> -<\/span>1<\/span>) {
<\/span><\/span>            Interceptor<\/span>.attach<\/span>(symbols<\/span>[i<\/span>].address<\/span>, {
<\/span><\/span>                onEnter<\/span>:<\/span> function<\/span>(args<\/span>) {
<\/span><\/span>                    var<\/span> java_class<\/span> =<\/span> Java<\/span>.vm<\/span>.tryGetEnv<\/span>().getClassName<\/span>(args<\/span>[1<\/span>]);
<\/span><\/span>                    var<\/span> method_count<\/span> =<\/span> parseInt(args<\/span>[3<\/span>]);
<\/span><\/span>                    console<\/span>.log<\/span>("RegisterNatives - Class:"<\/span>, java_class<\/span>, "Methods:"<\/span>, method_count<\/span>);
<\/span><\/span>                    
<\/span><\/span>                    \/\/ 遍历并打印所有注册的Native方法
<\/span><\/span><\/span><\/span>                    for<\/span> (var<\/span> i<\/span> =<\/span> 0<\/span>; i<\/span> <<\/span> method_count<\/span>; i<\/span>++<\/span>) {
<\/span><\/span>                        var<\/span> method_ptr<\/span> =<\/span> args<\/span>[2<\/span>].add<\/span>(i<\/span> *<\/span> Process<\/span>.pointerSize<\/span> *<\/span> 3<\/span>);
<\/span><\/span>                        console<\/span>.log<\/span>("Method Name:"<\/span>, method_ptr<\/span>.readPointer<\/span>().readCString<\/span>());
<\/span><\/span>                        console<\/span>.log<\/span>("Signature:"<\/span>, method_ptr<\/span>.add<\/span>(Process<\/span>.pointerSize<\/span>).readPointer<\/span>().readCString<\/span>());
<\/span><\/span>                    }
<\/span><\/span>                }
<\/span><\/span>            });
<\/span><\/span>        }
<\/span><\/span>    }
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>二、Frida辅助分析OLLVM控制流程平坦化<\/h2>
2.1 控制流程平坦化原理<\/h3>
将函数原有控制流拆散，平铺到while循环和switch结构中，极大增加逆向分析复杂度。<\/p>
2.1.1 原始代码示例<\/h4>
int<\/span> main<\/span>(int<\/span> argc, char<\/span>**<\/span> argv) {
<\/span><\/span>    int<\/span> a =<\/span> atoi(argv[1<\/span>]);
<\/span><\/span>    if<\/span>(a ==<\/span> 0<\/span>) return<\/span> 1<\/span>;
<\/span><\/span>    else<\/span> return<\/span> 10<\/span>;
<\/span><\/span>    return<\/span> 0<\/span>;
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>2.1.2 平坦化后代码<\/h4>
int<\/span> main<\/span>(int<\/span> argc, char<\/span>**<\/span> argv) {
<\/span><\/span>    int<\/span> a =<\/span> atoi(argv[1<\/span>]);
<\/span><\/span>    int<\/span> b =<\/span> 0<\/span>;
<\/span><\/span>    while<\/span>(1<\/span>) {
<\/span><\/span>        switch<\/span>(b) {
<\/span><\/span>            case<\/span> 0<\/span>:<\/span> 
<\/span><\/span>                if<\/span>(a ==<\/span> 0<\/span>) b =<\/span> 1<\/span>;
<\/span><\/span>                else<\/span> b =<\/span> 2<\/span>;
<\/span><\/span>                break<\/span>;
<\/span><\/span>            case<\/span> 1<\/span>:<\/span> return<\/span> 1<\/span>;
<\/span><\/span>            case<\/span> 2<\/span>:<\/span> return<\/span> 10<\/span>;
<\/span><\/span>            default<\/span>:<\/span> break<\/span>;
<\/span><\/span>        }
<\/span><\/span>    }
<\/span><\/span>    return<\/span> 0<\/span>;
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>2.2 动态分析策略<\/h3>
2.2.1 关键点Hook技术<\/h4>

从输入参数开始逆向追踪<\/li>
从输出结果正向追踪<\/li>
交替使用两种分析方式<\/li>
<\/ul>
2.2.2 Hook NewStringUTF获取返回结果<\/h4>
function<\/span> hook_libart<\/span>() {
<\/span><\/span>    var<\/span> module_libart<\/span> =<\/span> Process<\/span>.findModuleByName<\/span>("libart.so"<\/span>);
<\/span><\/span>    var<\/span> symbols<\/span> =<\/span> module_libart<\/span>.enumerateSymbols<\/span>();
<\/span><\/span>    
<\/span><\/span>    for<\/span> (var<\/span> i<\/span> =<\/span> 0<\/span>; i<\/span> <<\/span> symbols<\/span>.length<\/span>; i<\/span>++<\/span>) {
<\/span><\/span>        var<\/span> name<\/span> =<\/span> symbols<\/span>[i<\/span>].name<\/span>;
<\/span><\/span>        if<\/span> (name<\/span>.indexOf<\/span>("NewStringUTF"<\/span>) ><\/span> 0<\/span>) {
<\/span><\/span>            Interceptor<\/span>.attach<\/span>(symbols<\/span>[i<\/span>].address<\/span>, {
<\/span><\/span>                onEnter<\/span>:<\/span> function<\/span>(args<\/span>) {
<\/span><\/span>                    console<\/span>.log<\/span>("[NewStringUTF Result]:"<\/span>, ptr<\/span>(args<\/span>[1<\/span>]).readCString<\/span>());
<\/span><\/span>                }
<\/span><\/span>            });
<\/span><\/span>        }
<\/span><\/span>    }
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>2.2.3 固定输入参数简化分析<\/h4>
function<\/span> hook_java<\/span>() {
<\/span><\/span>    Java<\/span>.perform<\/span>(function<\/span>() {
<\/span><\/span>        var<\/span> HelloJni<\/span> =<\/span> Java<\/span>.use<\/span>("com.example.hellojni.HelloJni"<\/span>);
<\/span><\/span>        HelloJni<\/span>.sign2<\/span>.implementation<\/span> =<\/span> function<\/span>(arg0<\/span>) {
<\/span><\/span>            \/\/ 固定输入参数，排除干扰
<\/span><\/span><\/span><\/span>            var<\/span> result<\/span> =<\/span> this<\/span>.sign2<\/span>("adkliowpwkklsap"<\/span>, "0987654321adksoi"<\/span>);
<\/span><\/span>            console<\/span>.log<\/span>("[Fixed Input Result]:"<\/span>, result<\/span>);
<\/span><\/span>            return<\/span> result<\/span>;
<\/span><\/span>        };
<\/span><\/span>    });
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>2.3 实际案例分析<\/h3>
2.3.1 算法识别过程<\/h4>

Hook NewStringUTF<\/code>得到密文：ea0973cd62f76a7336874be31cfd7540<\/code><\/li>
逆向追踪发现base64编码特征<\/li>
进一步分析发现MD5加密常量：0xD76AA478<\/code><\/li>
确认加密流程：输入拼接 → Base64 → MD5<\/li>
<\/ol>
2.3.2 关键函数Hook脚本<\/h4>
function<\/span> hook_native_addr<\/span>(addr<\/span>, idb_addr<\/span>) {
<\/span><\/span>    var<\/span> base<\/span> =<\/span> Module<\/span>.findBaseAddress<\/span>("libhello-jni.so"<\/span>);
<\/span><\/span>    Interceptor<\/span>.attach<\/span>(addr<\/span>, {
<\/span><\/span>        onEnter<\/span>:<\/span> function<\/span>(args<\/span>) {
<\/span><\/span>            this<\/span>.args<\/span> =<\/span> [args<\/span>[0<\/span>], args<\/span>[1<\/span>], args<\/span>[2<\/span>], args<\/span>[3<\/span>]];
<\/span><\/span>            this<\/span>.lr<\/span> =<\/span> this<\/span>.context<\/span>.lr<\/span>;
<\/span><\/span>        },
<\/span><\/span>        onLeave<\/span>:<\/span> function<\/span>(retval<\/span>) {
<\/span><\/span>            console<\/span>.log<\/span>("Function:"<\/span>, ptr<\/span>(idb_addr<\/span>));
<\/span><\/span>            console<\/span>.log<\/span>("LR:"<\/span>, ptr<\/span>(this<\/span>.lr<\/span>).sub<\/span>(base<\/span>));
<\/span><\/span>            console<\/span>.log<\/span>("Args:"<\/span>, this<\/span>.args<\/span>.map<\/span>(hex_dump<\/span>));
<\/span><\/span>            console<\/span>.log<\/span>("Return:"<\/span>, hex_dump<\/span>(retval<\/span>));
<\/span><\/span>        }
<\/span><\/span>    });
<\/span><\/span>}
<\/span><\/span>
<\/span><\/span>\/\/ 批量Hook关键函数
<\/span><\/span><\/span><\/span>function<\/span> hook_critical_functions<\/span>() {
<\/span><\/span>    var<\/span> base<\/span> =<\/span> Module<\/span>.findBaseAddress<\/span>("libhello-jni.so"<\/span>);
<\/span><\/span>    var<\/span> functions<\/span> =<\/span> [0x15F1C<\/span>, 0x162B8<\/span>, 0x154D4<\/span>, 0x158AC<\/span>, 0x14844<\/span>];
<\/span><\/span>    functions<\/span>.forEach<\/span>(addr<\/span> => hook_native_addr<\/span>(base<\/span>.add<\/span>(addr<\/span>), addr<\/span>));
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>三、Frida辅助分析OLLVM指令替换<\/h2>
3.1 指令替换原理<\/h3>
用功能等价但结构更复杂的指令序列替换原始简单指令，保持逻辑不变但增加理解难度。<\/p>
3.1.1 常见替换规则<\/h4>


加法替换<\/strong>：<\/p>

a = b + c<\/code> → a = b - (-c)<\/code><\/li>
a = b + c<\/code> → r = rand(); a = b + r; a = a + c; a = a - r<\/code><\/li>
<\/ul>
<\/li>

减法替换<\/strong>：<\/p>

a = b - c<\/code> → a = b + (-c)<\/code><\/li>
a = b - c<\/code> → r = rand(); a = b + r; a = a - c; a = a - r<\/code><\/li>
<\/ul>
<\/li>

逻辑运算替换<\/strong>：<\/p>

AND: a = b & c<\/code> → a = (b ^ ~c) & b<\/code><\/li>
OR: a = b | c<\/code> → a = (b & c) | (b ^ c)<\/code><\/li>
XOR: a = a ^ b<\/code> → a = (~a & b) | (a & ~b)<\/code><\/li>
<\/ul>
<\/li>
<\/ul>
3.2 动态分析技术<\/h3>
3.2.1 寄存器值提取<\/h4>
针对指令替换，通过Inline Hook提取关键寄存器值：<\/p>
function<\/span> hook_instruction_replace<\/span>() {
<\/span><\/span>    var<\/span> base<\/span> =<\/span> Module<\/span>.findBaseAddress<\/span>("libhello-jni.so"<\/span>);
<\/span><\/span>    var<\/span> target_addr<\/span> =<\/span> base<\/span>.add<\/span>(0x12345<\/span>); \/\/ 替换指令地址
<\/span><\/span><\/span><\/span>    
<\/span><\/span>    Interceptor<\/span>.attach<\/span>(target_addr<\/span>, {
<\/span><\/span>        onEnter<\/span>:<\/span> function<\/span>(args<\/span>) {
<\/span><\/span>            \/\/ 读取关键寄存器值
<\/span><\/span><\/span><\/span>            var<\/span> w8<\/span> =<\/span> this<\/span>.context<\/span>.x8<\/span>.toInt32<\/span>();
<\/span><\/span>            var<\/span> w9<\/span> =<\/span> this<\/span>.context<\/span>.x9<\/span>.toInt32<\/span>();
<\/span><\/span>            console<\/span>.log<\/span>("Instruction Replacement Analysis:"<\/span>);
<\/span><\/span>            console<\/span>.log<\/span>("W8:"<\/span>, w8<\/span>.toString<\/span>(16<\/span>));
<\/span><\/span>            console<\/span>.log<\/span>("W9:"<\/span>, w9<\/span>.toString<\/span>(16<\/span>));
<\/span><\/span>            
<\/span><\/span>            \/\/ 记录计算过程
<\/span><\/span><\/span><\/span>            this<\/span>.calculation_step<\/span> =<\/span> 0<\/span>;
<\/span><\/span>        },
<\/span><\/span>        onLeave<\/span>:<\/span> function<\/span>(retval<\/span>) {
<\/span><\/span>            \/\/ 分析替换指令的计算结果
<\/span><\/span><\/span><\/span>            var<\/span> final_result<\/span> =<\/span> this<\/span>.context<\/span>.x8<\/span>.toInt32<\/span>();
<\/span><\/span>            console<\/span>.log<\/span>("Final Result:"<\/span>, final_result<\/span>.toString<\/span>(16<\/span>));
<\/span><\/span>        }
<\/span><\/span>    });
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>3.2.2 内存访问监控<\/h4>
监控关键内存写入操作，分析指令替换的实际效果：<\/p>
function<\/span> monitor_memory_access<\/span>() {
<\/span><\/span>    var<\/span> target_range<\/span> =<\/span> [0x30000<\/span>, 0x40000<\/span>]; \/\/ 目标内存范围
<\/span><\/span><\/span><\/span>    var<\/span> base<\/span> =<\/span> Module<\/span>.findBaseAddress<\/span>("libhello-jni.so"<\/span>);
<\/span><\/span>    
<\/span><\/span>    \/\/ 监控内存写入
<\/span><\/span><\/span><\/span>    MemoryAccessMonitor<\/span>.enable<\/span>({
<\/span><\/span>        base<\/span>:<\/span> base<\/span>.add<\/span>(target_range<\/span>[0<\/span>]),
<\/span><\/span>        size<\/span>:<\/span> target_range<\/span>[1<\/span>] -<\/span> target_range<\/span>[0<\/span>]
<\/span><\/span>    }, {
<\/span><\/span>        onAccess<\/span>:<\/span> function<\/span>(details<\/span>) {
<\/span><\/span>            if<\/span> (details<\/span>.operation<\/span> ===<\/span> 'write'<\/span>) {
<\/span><\/span>                console<\/span>.log<\/span>("Memory Write at:"<\/span>, details<\/span>.address<\/span>.sub<\/span>(base<\/span>));
<\/span><\/span>                console<\/span>.log<\/span>("Value:"<\/span>, details<\/span>.value<\/span>.toInt32<\/span>());
<\/span><\/span>                console<\/span>.log<\/span>("From:"<\/span>, details<\/span>.from<\/span>.sub<\/span>(base<\/span>));
<\/span><\/span>            }
<\/span><\/span>        }
<\/span><\/span>    });
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>四、综合分析与实战技巧<\/h2>
4.1 动态分析工作流<\/h3>

环境准备<\/strong>：安装Frida，配置测试环境<\/li>
初步识别<\/strong>：Hook标准库函数确定输入输出<\/li>
参数固定<\/strong>：稳定输入排除干扰因素<\/li>
关键点定位<\/strong>：通过交叉引用确定关键函数<\/li>
逐层分析<\/strong>：从外到内逐步分析加密逻辑<\/li>
算法识别<\/strong>：通过常量、特征识别标准算法<\/li>
验证确认<\/strong>：对比计算结果验证分析正确性<\/li>
<\/ol>
4.2 高级Hook技巧<\/h3>
4.2.1 条件Hook<\/h4>
function<\/span> conditional_hook<\/span>(addr<\/span>, condition<\/span>) {
<\/span><\/span>    Interceptor<\/span>.attach<\/span>(addr<\/span>, {
<\/span><\/span>        onEnter<\/span>:<\/span> function<\/span>(args<\/span>) {
<\/span><\/span>            if<\/span> (condition<\/span>(args<\/span>)) {
<\/span><\/span>                this<\/span>.should_log<\/span> =<\/span> true<\/span>;
<\/span><\/span>                console<\/span>.log<\/span>("Condition met, starting trace..."<\/span>);
<\/span><\/span>            } else<\/span> {
<\/span><\/span>                this<\/span>.should_log<\/span> =<\/span> false<\/span>;
<\/span><\/span>            }
<\/span><\/span>        },
<\/span><\/span>        onLeave<\/span>:<\/span> function<\/span>(retval<\/span>) {
<\/span><\/span>            if<\/span> (this<\/span>.should_log<\/span>) {
<\/span><\/span>                console<\/span>.log<\/span>("Function completed, return:"<\/span>, retval<\/span>);
<\/span><\/span>            }
<\/span><\/span>        }
<\/span><\/span>    });
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>4.2.2 调用栈追踪<\/h4>
function<\/span> trace_call_stack<\/span>() {
<\/span><\/span>    var<\/span> base<\/span> =<\/span> Module<\/span>.findBaseAddress<\/span>("libhello-jni.so"<\/span>);
<\/span><\/span>    
<\/span><\/span>    Interceptor<\/span>.attach<\/span>(Module<\/span>.findExportByName<\/span>("libc.so"<\/span>, "malloc"<\/span>), {
<\/span><\/span>        onEnter<\/span>:<\/span> function<\/span>(args<\/span>) {
<\/span><\/span>            var<\/span> backtrace<\/span> =<\/span> Thread<\/span>.backtrace<\/span>(this<\/span>.context<\/span>, Backtracer<\/span>.ACCURATE<\/span>);
<\/span><\/span>            console<\/span>.log<\/span>("Call stack for malloc:"<\/span>);
<\/span><\/span>            backtrace<\/span>.forEach<\/span>(addr<\/span> => {
<\/span><\/span>                console<\/span>.log<\/span>("  "<\/span>, addr<\/span>.sub<\/span>(base<\/span>));
<\/span><\/span>            });
<\/span><\/span>        }
<\/span><\/span>    });
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>五、总结<\/h2>
通过Frida动态分析OLLVM混淆代码，可以有效应对字符串加密、控制流程平坦化和指令替换等混淆技术。关键成功因素包括：<\/p>

系统化的分析思路<\/strong>：从外到内，从输入输出到中间过程<\/li>
精准的Hook定位<\/strong>：针对关键函数和内存访问点<\/li>
耐心的问题排查<\/strong>：混淆代码需要逐层分析和验证<\/li>
经验积累<\/strong>：熟悉常见加密算法特征和混淆模式<\/li>
<\/ol>
本教学文档提供了完整的技术方案和实战代码，可作为分析OLLVM混淆应用的标准化流程参考。<\/p>

基于Frida的OLLVM混淆代码动态分析技术教学文档<\/h1>

一、Frida辅助分析OLLVM字符串加密<\/h2>

1.1 字符串加密原理<\/h3> 字符串加密在编译时对明文字符串进行加密存储，避免以明文形式存在于二进制文件中，增加静态分析难度。<\/p>

1.2 实例分析<\/h3>

1.3 Frida动态分析技术<\/h3>

二、Frida辅助分析OLLVM控制流程平坦化<\/h2>

2.1 控制流程平坦化原理<\/h3> 将函数原有控制流拆散，平铺到while循环和switch结构中，极大增加逆向分析复杂度。<\/p>

2.2 动态分析策略<\/h3>

2.3 实际案例分析<\/h3>

三、Frida辅助分析OLLVM指令替换<\/h2>

3.1 指令替换原理<\/h3> 用功能等价但结构更复杂的指令序列替换原始简单指令，保持逻辑不变但增加理解难度。<\/p>

3.2 动态分析技术<\/h3>

四、综合分析与实战技巧<\/h2>

4.2 高级Hook技巧<\/h3>

1.1 字符串加密原理<\/h3>
字符串加密在编译时对明文字符串进行加密存储，避免以明文形式存在于二进制文件中，增加静态分析难度。<\/p>

2.1 控制流程平坦化原理<\/h3>
将函数原有控制流拆散，平铺到while循环和switch结构中，极大增加逆向分析复杂度。<\/p>

3.1 指令替换原理<\/h3>
用功能等价但结构更复杂的指令序列替换原始简单指令，保持逻辑不变但增加理解难度。<\/p>