feat: complete control flow fusion obfuscation

src/ModuleFusion.cpp

@@ -28,6 +28,11 @@ namespace {
         std::vector<BasicBlock*> blocks;
     };
 
+    struct SliceBlocks {
+        std::vector<BasicBlock*> blocks;
+        BasicBlock* phiBlock;
+    };
+
     struct CallNode {
         std::string name;
         bool isTarget;
@@ -132,8 +137,6 @@ namespace {
         std::set<std::string> bunkerFunctions;
         std::map<std::string, std::string> fusionPairs;
 
-        std::vector<SliceTransition> sliceTransitions;
-
         size_t getRandomIndex(size_t max) {
             static unsigned seed = 0;
             seed = (seed * 1103515245 + 12345) & 0x7fffffff;
@@ -1009,8 +1012,14 @@ namespace {
                 // 用于存储所有克隆的基本块
                 std::map<BasicBlock*, BasicBlock*> bunkerBlockMap;
                 std::map<BasicBlock*, BasicBlock*> targetBlockMap;
+                std::map<BasicBlock*, BasicBlock*> reverseTargetBlockMap;
+                std::map<BasicBlock*, BasicBlock*> reverseBunkerBlockMap;
                 std::vector<BasicBlock*> allFusedBlocks;
 
+                std::vector<SliceTransition> sliceTransitions;
+                std::vector<SliceBlocks> targetSliceBlocksList;
+                std::vector<SliceBlocks> bunkerSliceBlocksList;
+
                 // 存储条件块的映射
                 // std::map<BasicBlock*, BasicBlock*> condBlockMap;
 
@@ -1131,66 +1140,250 @@ namespace {
                 std::vector<BasicBlock*> currentBunkerSlice;
                 sliceTransitions.clear();
 
+                // 在循环外声明phi块变量
+                BasicBlock* currentBunkerPhiBlock = nullptr;
+
                 for (BasicBlock& BB : *bunkerFunc) {
                     // 如果当前基本块是关键点且还有未插入的target分片
                     if (currentSliceIndex < targetSlices.size() && criticalPoints.count(&BB)) {
-                        // 记录当前bunker分片的最后一个基本块
-                        BasicBlock* lastBunkerBlock = nullptr;
-                        if (!currentBunkerSlice.empty()) {
-                            lastBunkerBlock = currentBunkerSlice.back();
+                        // 记录分片转换信息
+                        SliceTransition transition;
+                        
+                        // 如果存在当前的bunker phi块，说明前一个bunker分片已完成
+                        if (currentBunkerPhiBlock) {
+                            transition.bunkerLastBlock = currentBunkerPhiBlock;
+                            // 为bunker分片的最后一个基本块添加到phi块的跳转
+                            if (!currentBunkerSlice.empty()) {
+                                BasicBlock* lastBunkerBlock = currentBunkerSlice.back();
+                                if (BranchInst* BI = dyn_cast<BranchInst>(lastBunkerBlock->getTerminator())) {
+                                    BI->eraseFromParent();
+                                }
+                                IRBuilder<> Builder(lastBunkerBlock);
+                                Builder.CreateBr(currentBunkerPhiBlock);
+                            }
+                            // 将phi块添加到分片和allFusedBlocks中
+                            allFusedBlocks.push_back(currentBunkerPhiBlock);
+                            SliceBlocks currentBunkerSliceBlocks;
+                            currentBunkerSliceBlocks.blocks = currentBunkerSlice;
+                            currentBunkerSliceBlocks.phiBlock = currentBunkerPhiBlock;
+                            bunkerSliceBlocksList.push_back(currentBunkerSliceBlocks);
+                        }
+                        
+                        // 为target分片创建条件块、跳过块和合并块
+                        BasicBlock* targetCondBlock = BasicBlock::Create(M.getContext(), 
+                            "target_cond_" + std::to_string(currentSliceIndex), fusedFunc);
+                        BasicBlock* targetSkipBlock = BasicBlock::Create(M.getContext(), 
+                            "target_skip_" + std::to_string(currentSliceIndex), fusedFunc);
+                        BasicBlock* targetPhiBlock = BasicBlock::Create(M.getContext(), 
+                            "target_phi_" + std::to_string(currentSliceIndex), fusedFunc);
+                        
+                        // bunker分片到target cond块的跳转
+                        if (currentBunkerPhiBlock) {
+                            IRBuilder<> bunkerPhiBuilder(currentBunkerPhiBlock);
+                            bunkerPhiBuilder.CreateBr(targetCondBlock);
                         }
+
+                        // 将条件块加入到allFusedBlocks
+                        allFusedBlocks.push_back(targetCondBlock);
+                        allFusedBlocks.push_back(targetSkipBlock);
+                        
+                        // 在条件块中创建条件跳转
+                        IRBuilder<> targetCondBuilder(targetCondBlock);
+                        Value* shouldRunTarget = targetCondBuilder.CreateICmpEQ(isTarget, 
+                            ConstantInt::getTrue(Type::getInt1Ty(M.getContext())));
                         
                         // 克隆并插入target分片的基本块
                         std::vector<BasicBlock*> targetSliceBlocks;
                         for (BasicBlock* targetBB : targetSlices[currentSliceIndex].blocks) {
                             BasicBlock* clonedTargetBB = CloneBasicBlock(targetBB, targetVMap, 
                                 "target_" + targetBB->getName(), fusedFunc);
-                            targetBlockMap[targetBB] = clonedTargetBB;
+                            targetBlockMap[clonedTargetBB] = targetBB;
+                            reverseTargetBlockMap[targetBB] = clonedTargetBB;
                             allFusedBlocks.push_back(clonedTargetBB);
                             targetSliceBlocks.push_back(clonedTargetBB);
+                            LOG_INFO("performCodeFusion", 
+                                "adding: {0}",
+                                getNodeId(clonedTargetBB));
+                            }
+
+                        // 为最后一个实际基本块添加到phi块的跳转
+                        if (!targetSliceBlocks.empty()) {
+                            BasicBlock* lastActualBlock = targetSliceBlocks.back();
+                            if (BranchInst* BI = dyn_cast<BranchInst>(lastActualBlock->getTerminator())) {
+                                BI->eraseFromParent();
+                            }
+                            IRBuilder<> Builder(lastActualBlock);
+                            Builder.CreateBr(targetPhiBlock);
                         }
+
+                        // 添加phi块到末尾
+                        allFusedBlocks.push_back(targetPhiBlock);
+
+                        SliceBlocks currentTargetSlice;
+                        for (BasicBlock* clonedBB : targetSliceBlocks) {
+                            LOG_INFO("performCodeFusion", 
+                                "before push Block ID: {0}",
+                                getNodeId(clonedBB));
+                        }
+                        currentTargetSlice.blocks = targetSliceBlocks;
+                        currentTargetSlice.phiBlock = targetPhiBlock;
+                        targetSliceBlocksList.push_back(currentTargetSlice);
+
+                        // 为bunker分片创建条件块、跳过块和合并块
+                        BasicBlock* bunkerCondBlock = BasicBlock::Create(M.getContext(), 
+                            "bunker_cond_" + std::to_string(currentSliceIndex), fusedFunc);
+                        BasicBlock* bunkerSkipBlock = BasicBlock::Create(M.getContext(), 
+                            "bunker_skip_" + std::to_string(currentSliceIndex), fusedFunc);
+                        BasicBlock* bunkerPhiBlock = BasicBlock::Create(M.getContext(), 
+                            "bunker_phi_" + std::to_string(currentSliceIndex), fusedFunc);
+                        currentBunkerPhiBlock = bunkerPhiBlock;
+
+                        // 将条件块加入到allFusedBlocks
+                        allFusedBlocks.push_back(bunkerCondBlock);
+                        allFusedBlocks.push_back(bunkerSkipBlock);
+                        
+                        // 在条件块中创建条件跳转
+                        IRBuilder<> bunkerCondBuilder(bunkerCondBlock);
+                        Value* shouldRunBunker = bunkerCondBuilder.CreateICmpEQ(isTarget, 
+                            ConstantInt::getFalse(Type::getInt1Ty(M.getContext())));
                         
                         // 克隆当前bunker基本块
                         BasicBlock* clonedBunkerBB = CloneBasicBlock(&BB, bunkerVMap, 
                             "bunker_" + BB.getName(), fusedFunc);
-                        bunkerBlockMap[&BB] = clonedBunkerBB;
+                        bunkerBlockMap[clonedBunkerBB] = &BB;
+                        reverseBunkerBlockMap[&BB] = clonedBunkerBB;
                         allFusedBlocks.push_back(clonedBunkerBB);
                         
-                        // 记录分片转换信息
-                        SliceTransition transition;
-                        transition.bunkerLastBlock = lastBunkerBlock;
-                        transition.targetFirstBlock = targetSliceBlocks.front();
-                        transition.targetLastBlock = targetSliceBlocks.back();
-                        transition.nextBunkerBlock = clonedBunkerBB;
-                        sliceTransitions.push_back(transition);
+                        // 设置初始条件跳转
+                        targetCondBuilder.CreateCondBr(shouldRunTarget, 
+                            targetSliceBlocks.front(), targetSkipBlock);  // 跳转到第一个实际target块
+
+                        // 设置skip块到phi块的跳转
+                        IRBuilder<> targetSkipBuilder(targetSkipBlock);
+                        targetSkipBuilder.CreateBr(targetPhiBlock);
+
+                        // target分片到bunker cond块的跳转
+                        IRBuilder<> targetPhiBuilder(targetPhiBlock);
+                        targetPhiBuilder.CreateBr(bunkerCondBlock);
+
+                        // 设置bunker条件跳转
+                        bunkerCondBuilder.CreateCondBr(shouldRunBunker, 
+                            clonedBunkerBB, bunkerSkipBlock);
+                            
+                        // 设置bunker skip块到phi块的跳转
+                        IRBuilder<> bunkerSkipBuilder(bunkerSkipBlock);
+                        bunkerSkipBuilder.CreateBr(bunkerPhiBlock);
                         
+                        transition.targetFirstBlock = targetCondBlock;
+                        transition.targetLastBlock = targetPhiBlock;
+                        transition.nextBunkerBlock = bunkerCondBlock;
+                        sliceTransitions.push_back(transition);
+
                         // 开始新的bunker分片
                         currentBunkerSlice.clear();
                         currentBunkerSlice.push_back(clonedBunkerBB);
+
                         
                         currentSliceIndex++;
                     } else {
                         // 克隆bunker基本块
                         BasicBlock* clonedBunkerBB = CloneBasicBlock(&BB, bunkerVMap, 
                             "bunker_" + BB.getName(), fusedFunc);
-                        bunkerBlockMap[&BB] = clonedBunkerBB;
+                        bunkerBlockMap[clonedBunkerBB] = &BB;
+                        reverseBunkerBlockMap[&BB] = clonedBunkerBB;
                         allFusedBlocks.push_back(clonedBunkerBB);
                         currentBunkerSlice.push_back(clonedBunkerBB);
                     }
                 }
 
-                // 添加新的日志打印代码
-                if (fusedFunc->getName() == "fused_createDynamicArray") {
-                    LOG_INFO("performCodeFusion", "Listing all instructions after block cloning in function: {0}", 
-                        fusedFunc->getName().str());
-                    dumpControlFlowGraph(*fusedFunc);
+                // 处理最后一个bunker分片
+                if (currentBunkerPhiBlock) {
+                    sliceTransitions.back().bunkerLastBlock = currentBunkerPhiBlock;
+                    // 为最后一个bunker分片的最后一个基本块添加到phi块的跳转
+                    if (!currentBunkerSlice.empty()) {
+                        BasicBlock* lastBunkerBlock = currentBunkerSlice.back();
+                        if (BranchInst* BI = dyn_cast<BranchInst>(lastBunkerBlock->getTerminator())) {
+                            BI->eraseFromParent();
+                        }
+                        IRBuilder<> Builder(lastBunkerBlock);
+                        Builder.CreateBr(currentBunkerPhiBlock);
+                    }
+                    // 将最后的phi块添加到分片和allFusedBlocks中
+                    allFusedBlocks.push_back(currentBunkerPhiBlock);
+                    SliceBlocks currentBunkerSliceBlocks;
+                    currentBunkerSliceBlocks.blocks = currentBunkerSlice;
+                    currentBunkerSliceBlocks.phiBlock = currentBunkerPhiBlock;
+                    bunkerSliceBlocksList.push_back(currentBunkerSliceBlocks);
                 }
 
+                // // 添加新的日志打印代码
+                // if (fusedFunc->getName() == "fused_createDynamicArray") {
+                //     LOG_INFO("performCodeFusion", "Listing all instructions after block cloning in function: {0}", 
+                //         fusedFunc->getName().str());
+                //     dumpControlFlowGraph(*fusedFunc);
+                // }
+
+                // // 在检查映射前添加调试信息
+                // LOG_INFO("performCodeFusion", "Dumping reverseBunkerBlockMap contents:");
+                // for (const auto& pair : reverseBunkerBlockMap) {
+                //     LOG_INFO("performCodeFusion", 
+                //         "Map entry: cloned={0} -> original={1}",
+                //         getNodeId(pair.first),
+                //         getNodeId(pair.second));
+                // }
+
+                // // 在检查映射前添加调试信息
+                // LOG_INFO("performCodeFusion", "Dumping BunkerBlockMap contents:");
+                // for (const auto& pair : bunkerBlockMap) {
+                //     LOG_INFO("performCodeFusion", 
+                //         "Map entry: original={0} -> cloned={1}",
+                //         getNodeId(pair.first),
+                //         getNodeId(pair.second));
+                // }
+
+                // // 输出所有bunkerSliceBlocksList中的块的id
+                // LOG_INFO("performCodeFusion", "bunkerSliceBlocksList size: {0}", bunkerSliceBlocksList.size());
+                // LOG_INFO("performCodeFusion", "Dumping bunkerSliceBlocksList contents:");
+                // for (const auto& sliceBlocks : bunkerSliceBlocksList) {
+                //     for (BasicBlock* clonedBB : sliceBlocks.blocks) {
+                //         LOG_INFO("performCodeFusion", 
+                //             "Block ID: {0}",
+                //             getNodeId(clonedBB));
+                //     }
+                // }
+
+                // // 在检查映射前添加调试信息
+                // LOG_INFO("performCodeFusion", "Dumping reverseTargetBlockMap contents:");
+                // for (const auto& pair : reverseTargetBlockMap) {
+                //     LOG_INFO("performCodeFusion", 
+                //         "Map entry: cloned={0} -> original={1}",
+                //         getNodeId(pair.first),
+                //         getNodeId(pair.second));
+                // }
+
+                // // 在检查映射前添加调试信息
+                // LOG_INFO("performCodeFusion", "Dumping TargetBlockMap contents:");
+                // for (const auto& pair : targetBlockMap) {
+                //     LOG_INFO("performCodeFusion", 
+                //         "Map entry: original={0} -> cloned={1}",
+                //         getNodeId(pair.first),
+                //         getNodeId(pair.second));
+                // }
+
+                // // 输出所有targetSliceBlocksList中的块的id
+                // LOG_INFO("performCodeFusion", "targetSliceBlocksList size: {0}", targetSliceBlocksList.size());
+                // LOG_INFO("performCodeFusion", "Dumping targetSliceBlocksList contents:");
+                // for (const auto& sliceBlocks : targetSliceBlocksList) {
+                //     for (BasicBlock* clonedBB : sliceBlocks.blocks) {
+                //         LOG_INFO("performCodeFusion", 
+                //             "Block ID: {0}",
+                //             getNodeId(clonedBB));
+                //     }
+                // }
+
                 // 修复target分片内的跳转
-                for (const auto& slice : targetSlices) {
-                    for (BasicBlock* BB : slice.blocks) {
-                        BasicBlock* clonedBB = targetBlockMap[BB];
-                        
+                for (const auto& sliceBlocks : targetSliceBlocksList) {
+                    for (BasicBlock* clonedBB : sliceBlocks.blocks) {
                         // 修复所有非终结指令
                         for (Instruction &I : make_range(clonedBB->begin(), --clonedBB->end())) {
                             RemapInstruction(&I, targetVMap, RF_NoModuleLevelChanges);
@@ -1198,8 +1391,12 @@ namespace {
                             if (PHINode* PHI = dyn_cast<PHINode>(&I)) {
                                 for (unsigned i = 0; i < PHI->getNumIncomingValues(); i++) {
                                     BasicBlock* incomingBlock = PHI->getIncomingBlock(i);
-                                    if (targetBlockMap.count(incomingBlock)) {
-                                        PHI->setIncomingBlock(i, targetBlockMap[incomingBlock]);
+                                    if (reverseTargetBlockMap.count(incomingBlock)) {
+                                        BasicBlock* originalBlock = reverseTargetBlockMap[incomingBlock];
+                                        if (targetBlockMap.count(originalBlock)) {
+                                            BasicBlock* mappedBlock = targetBlockMap[originalBlock];
+                                            PHI->setIncomingBlock(i, mappedBlock);
+                                        }
                                     }
                                 }
                             }
@@ -1208,94 +1405,203 @@ namespace {
                         // 处理终结指令
                         if (BranchInst* BI = dyn_cast<BranchInst>(clonedBB->getTerminator())) {
                             // 检查是否是分片的最后一个基本块
-                            bool isLastInSlice = false;
-                            BasicBlock* nextBunkerBlock = nullptr;
+                            bool isLastInSlice = (clonedBB == sliceBlocks.blocks.back());
                             
-                            for (const auto& transition : sliceTransitions) {
-                                if (transition.targetLastBlock == clonedBB) {
-                                    isLastInSlice = true;
-                                    nextBunkerBlock = transition.nextBunkerBlock;
-                                    break;
+                            if (!isLastInSlice) {
+                                // 获取当前克隆块对应的原始块
+                                BasicBlock* originalBB = targetBlockMap[clonedBB];
+                                if (!originalBB) {
+                                    LOG_ERROR("performCodeFusion", 
+                                        "Could not find original block for cloned block {0}",
+                                        getNodeId(clonedBB));
+                                    continue;
                                 }
-                            }
-                            
-                            if (isLastInSlice && nextBunkerBlock) {
-                                // 替换为直接跳转到下一个bunker块
-                                BranchInst::Create(nextBunkerBlock, BI);
-                                BI->eraseFromParent();
-                            } else {
-                                // 正常修复跳转目标
-                                RemapInstruction(BI, targetVMap, RF_NoModuleLevelChanges);
-                                for (unsigned i = 0; i < BI->getNumSuccessors(); i++) {
-                                    BasicBlock* succ = BI->getSuccessor(i);
-                                    if (targetBlockMap.count(succ)) {
-                                        BI->setSuccessor(i, targetBlockMap[succ]);
+                                // 获取原始块的终结指令
+                                BranchInst* originalBI = dyn_cast<BranchInst>(originalBB->getTerminator());
+                                if (!originalBI) {
+                                    LOG_ERROR("performCodeFusion", 
+                                        "Could not find branch instruction in original block {0}",
+                                        getNodeId(originalBB));
+                                    continue;
+                                }
+
+                                // 修复克隆块的后继块
+                                for (unsigned i = 0; i < originalBI->getNumSuccessors(); i++) {
+                                    BasicBlock* originalSucc = originalBI->getSuccessor(i);
+                                    if (!originalSucc) {
+                                        LOG_WARNING("performCodeFusion", 
+                                            "Null successor found at index {0} in original block {1}",
+                                            i,
+                                            getNodeId(originalBB));
+                                        continue;
+                                    }
+
+                                    // 在reverseTargetBlockMap中查找对应的克隆后继块
+                                    if (reverseTargetBlockMap.count(originalSucc)) {
+                                        BasicBlock* mappedSucc = reverseTargetBlockMap[originalSucc];
+                                        if (mappedSucc) {
+                                            // LOG_DEBUG("performCodeFusion", 
+                                            //     "Remapping successor for block {0}: {1} -> {2}",
+                                            //     getNodeId(clonedBB),
+                                            //     getNodeId(originalSucc),
+                                            //     getNodeId(mappedSucc));
+                                            BI->setSuccessor(i, mappedSucc);
+                                        } else {
+                                            LOG_WARNING("performCodeFusion",
+                                                "Mapped successor is null for original block {0}",
+                                                getNodeId(originalSucc));
+                                        }
+                                    } else {
+                                        LOG_WARNING("performCodeFusion", 
+                                            "Could not find mapping for original successor block {0}",
+                                            getNodeId(originalSucc));
                                     }
                                 }
+
+                                // // 正常修复跳转目标
+                                // for (unsigned i = 0; i < BI->getNumSuccessors(); i++) {
+                                //     BasicBlock* succ = BI->getSuccessor(i);
+                                //     if (reverseTargetBlockMap.count(succ)) {
+                                //         // 获取原始基本块
+                                //         BasicBlock* originalSucc = reverseTargetBlockMap[succ];
+                                //         if (targetBlockMap.count(originalSucc)) {
+                                //             errs() << "2331: \n";
+                                //             auto it = targetBlockMap.find(originalSucc);
+                                //             if (it != targetBlockMap.end()) {
+                                //                 errs() << "2332: \n";
+                                //                 BasicBlock* mappedSucc = it->second;
+                                //                 LOG_DEBUG("performCodeFusion", 
+                                //                     "Remapping successor {0} to {1}",
+                                //                     getNodeId(succ),
+                                //                     getNodeId(mappedSucc));
+                                //                 BI->setSuccessor(i, mappedSucc);
+                                //             }
+                                //         }
+                                //     } else {
+                                //         LOG_WARNING("performCodeFusion", 
+                                //             "Could not find mapping for successor block {0}",
+                                //             getNodeId(succ));
+                                //     }
+                                // }
                             }
                         }
                     }
                 }
 
                 // 修复bunker块内的跳转
-                for (auto& pair : bunkerBlockMap) {
-                    BasicBlock* clonedBB = pair.second;
-                    
-                    // 修复所有非终结指令
-                    for (Instruction &I : make_range(clonedBB->begin(), --clonedBB->end())) {
-                        RemapInstruction(&I, bunkerVMap, RF_NoModuleLevelChanges);
-                        
-                        if (PHINode* PHI = dyn_cast<PHINode>(&I)) {
-                            for (unsigned i = 0; i < PHI->getNumIncomingValues(); i++) {
-                                BasicBlock* incomingBlock = PHI->getIncomingBlock(i);
-                                if (bunkerBlockMap.count(incomingBlock)) {
-                                    PHI->setIncomingBlock(i, bunkerBlockMap[incomingBlock]);
+                for (const auto& sliceBlocks : bunkerSliceBlocksList) {
+                    for (BasicBlock* clonedBB : sliceBlocks.blocks) {
+                        // 修复所有非终结指令
+                        for (Instruction &I : make_range(clonedBB->begin(), --clonedBB->end())) {
+                            RemapInstruction(&I, bunkerVMap, RF_NoModuleLevelChanges);
+                            
+                            if (PHINode* PHI = dyn_cast<PHINode>(&I)) {
+                                for (unsigned i = 0; i < PHI->getNumIncomingValues(); i++) {
+                                    BasicBlock* incomingBlock = PHI->getIncomingBlock(i);
+                                    if (reverseBunkerBlockMap.count(incomingBlock)) {
+                                        BasicBlock* originalBlock = reverseBunkerBlockMap[incomingBlock];
+                                        if (bunkerBlockMap.count(originalBlock)) {
+                                            BasicBlock* mappedBlock = bunkerBlockMap[originalBlock];
+                                            PHI->setIncomingBlock(i, mappedBlock);
+                                        }
+                                    }
                                 }
                             }
                         }
-                    }
                     
-                    // 处理终结指令
-                    if (BranchInst* BI = dyn_cast<BranchInst>(clonedBB->getTerminator())) {
-                        // 检查是否是分片的最后一个基本块
-                        bool isLastInSlice = false;
-                        BasicBlock* nextTargetBlock = nullptr;
-                        
-                        for (const auto& transition : sliceTransitions) {
-                            if (transition.bunkerLastBlock == clonedBB) {
-                                isLastInSlice = true;
-                                nextTargetBlock = transition.targetFirstBlock;
-                                break;
-                            }
-                        }
-                        
-                        if (isLastInSlice && nextTargetBlock) {
-                            // 替换为直接跳转到下一个target块
-                            BranchInst::Create(nextTargetBlock, BI);
-                            BI->eraseFromParent();
-                        } else {
-                            // 正常修复跳转目标
-                            RemapInstruction(BI, bunkerVMap, RF_NoModuleLevelChanges);
-                            for (unsigned i = 0; i < BI->getNumSuccessors(); i++) {
-                                BasicBlock* succ = BI->getSuccessor(i);
-                                if (bunkerBlockMap.count(succ)) {
-                                    BI->setSuccessor(i, bunkerBlockMap[succ]);
+                        // 处理终结指令
+                        if (BranchInst* BI = dyn_cast<BranchInst>(clonedBB->getTerminator())) {
+                            // 检查是否是分片的最后一个基本块
+                            bool isLastInSlice = (clonedBB == sliceBlocks.blocks.back());
+                            
+                            if (!isLastInSlice) {
+                                // 获取当前克隆块对应的原始块
+                                BasicBlock* originalBB = bunkerBlockMap[clonedBB];
+                                if (!originalBB) {
+                                    LOG_ERROR("performCodeFusion", 
+                                        "Could not find original block for cloned block {0}",
+                                        getNodeId(clonedBB));
+                                    continue;
                                 }
+                                // 获取原始块的终结指令
+                                BranchInst* originalBI = dyn_cast<BranchInst>(originalBB->getTerminator());
+                                if (!originalBI) {
+                                    LOG_ERROR("performCodeFusion", 
+                                        "Could not find branch instruction in original block {0}",
+                                        getNodeId(originalBB));
+                                    continue;
+                                }
+
+                                // 修复克隆块的后继块
+                                for (unsigned i = 0; i < originalBI->getNumSuccessors(); i++) {
+                                    BasicBlock* originalSucc = originalBI->getSuccessor(i);
+                                    if (!originalSucc) {
+                                        LOG_WARNING("performCodeFusion", 
+                                            "Null successor found at index {0} in original block {1}",
+                                            i,
+                                            getNodeId(originalBB));
+                                        continue;
+                                    }
+
+                                    // 在reverseBunkerBlockMap中查找对应的克隆后继块
+                                    if (reverseBunkerBlockMap.count(originalSucc)) {
+                                        BasicBlock* mappedSucc = reverseBunkerBlockMap[originalSucc];
+                                        if (mappedSucc) {
+                                            // LOG_DEBUG("performCodeFusion", 
+                                            //     "Remapping successor for block {0}: {1} -> {2}",
+                                            //     getNodeId(clonedBB),
+                                            //     getNodeId(originalSucc),
+                                            //     getNodeId(mappedSucc));
+                                            BI->setSuccessor(i, mappedSucc);
+                                        } else {
+                                            LOG_WARNING("performCodeFusion",
+                                                "Mapped successor is null for original block {0}",
+                                                getNodeId(originalSucc));
+                                        }
+                                    } else {
+                                        LOG_WARNING("performCodeFusion", 
+                                            "Could not find mapping for original successor block {0}",
+                                            getNodeId(originalSucc));
+                                    }
+                                }
+                                // // 正常修复跳转目标
+                                // for (unsigned i = 0; i < BI->getNumSuccessors(); i++) {
+                                //     BasicBlock* succ = BI->getSuccessor(i);
+                                //     if (reverseBunkerBlockMap.count(succ)) {
+                                //         // 获取原始基本块
+                                //         BasicBlock* originalSucc = reverseBunkerBlockMap[succ];
+                                //         errs() << "2331: \n";
+                                //         if (bunkerBlockMap.count(originalSucc)) {
+                                //             errs() << "2332: \n";
+                                //             auto it = bunkerBlockMap.find(originalSucc);
+                                //             if (it != bunkerBlockMap.end()) {
+                                //                 BasicBlock* mappedSucc = it->second;
+                                //                 LOG_DEBUG("performCodeFusion", 
+                                //                     "Remapping successor {0} to {1}",
+                                //                     getNodeId(succ),
+                                //                     getNodeId(mappedSucc));
+                                //                 BI->setSuccessor(i, mappedSucc);
+                                //             }
+                                //         }
+                                //     } else {
+                                //         LOG_WARNING("performCodeFusion", 
+                                //             "Could not find mapping for bunker successor block {0}",
+                                //             getNodeId(succ));
+                                //     }
+                                // }
                             }
                         }
                     }
                 }
 
-                // 添加新的日志打印代码
-                if (fusedFunc->getName() == "fused_createDynamicArray") {
-                    LOG_INFO("performCodeFusion", "Listing all instructions after block cloning in function: {0}", 
-                        fusedFunc->getName().str());
-                    dumpControlFlowGraph(*fusedFunc);
-                }
-
                 // 从入口块创建跳转到第一个块
                 Builder.CreateBr(allFusedBlocks.front());
 
+                // 添加新的日志打印代码
+                LOG_INFO("performCodeFusion", "Listing all instructions after block cloning in function: {0}", 
+                    fusedFunc->getName().str());
+                dumpControlFlowGraph(*fusedFunc);
+
                 // 在处理返回值之前添加日志
                 LOG_DEBUG("performCodeFusion", 
                     "Processing return values for fused function: {0}", 
@@ -1542,12 +1848,12 @@ namespace {
                 targetFunc->eraseFromParent();
 
 
-                // 添加新的日志打印代码
-                if (fusedFunc->getName() == "fused_createDynamicArray") {
-                    LOG_INFO("performCodeFusion", "Listing all instructions after block cloning in function: {0}", 
-                        fusedFunc->getName().str());
-                    dumpControlFlowGraph(*fusedFunc);
-                }
+                // // 添加新的日志打印代码
+                // if (fusedFunc->getName() == "fused_createDynamicArray") {
+                //     LOG_INFO("performCodeFusion", "Listing all instructions after block cloning in function: {0}", 
+                //         fusedFunc->getName().str());
+                //     dumpControlFlowGraph(*fusedFunc);
+                // }
 
                 
                 LOG_INFO("performCodeFusion",