Obfuscator for compiled 64-bit portable executables.
- Disassembly: the binary's code section is disassembled and partitioned into basic blocks by tracing all reachable control flow or by scanning the
.binsafesection that marked functions are placed in.
- Lifting: instructions are translated into bytecode that the runtime interprets.
- Peephole: bytecode is scanned in multiple passes to simplify sequences and collapse redundant operations.
- Permutation: operations are reordered through their dependency graph into a semantically equivalent sequence.
- Scrambling: operations are placed in a randomized physical layout connected by jumps that follow their original execution order.
- Mutation: operations are rewritten into logically equivalent forms whose structure varies between builds.
- Encryption: immediate values are encrypted using key(s) that evolve in the execution order of the block.
- Fusing: operations are scanned for fusible sequences and combined into compound operations.
- Patching: virtualized blocks are replaced with dispatch stubs that transfer control to the VM.
- Obfuscation: the runtime code is transformed through passes to resist static analysis.
- Assembly: the runtime is assembled directly into the output binary with code and data shuffled into a randomized layout.
- Imports: the imports are resolved at runtime by hashes of module and export names.
- Dispatch: a stub transfers CPU state to the VM, which decrypts and interprets bytecode through indirect dispatch.
- Isolation: a thread maintains an isolated context in thread-local storage, with a child context for nested execution.
- Exceptions: a vectored handler catches faults inside the VM and reconstructs the CPU context for external handlers.
- Attestation: anti-debug and integrity checks run as bytecode and feed directly into block decryption, corrupting execution on tampering or debugging.
- Stub: the protected binary is embedded in a freshly assembled executable carrying its own runtime.
- Loader: the embedded binary is mapped into memory by bytecode as a headerless image and transfers control, so a dump yields no runnable binary.
The tests crate spins up an instrumented VM and compares its behavior against the CPU.
- Instructions: each instruction is executed through the VM and the resulting register and vector state is compared against native execution.
cargo run --release --bin obfuscator -- <filename> --virtualization --packing
- Fork it
- Create your branch (
git checkout -b my-change) - Commit your changes (
git commit -m "changed something") - Push to the branch (
git push origin my-change) - Create new pull request