llvm-obfuscation

LLVM Code Obfuscation Skill

This skill provides comprehensive knowledge of LLVM-based code obfuscation frameworks and techniques for software protection and anti-reverse engineering.

Core Obfuscation Techniques

Control Flow Obfuscation

• Control Flow Flattening (CFF): Transform structured control flow into a single dispatcher loop with state machine
• Bogus Control Flow (BCF): Insert opaque predicates and dead code paths
• CFG Randomization: Randomize basic block ordering and add fake edges

Data Obfuscation

• String Encryption: Encrypt string literals at compile-time, decrypt at runtime
• Constant Substitution: Replace constants with complex expressions
• Variable Splitting: Split variables into multiple components

Code Transformation

• Instruction Substitution: Replace standard instructions with equivalent complex sequences
• MBA (Mixed Boolean-Arithmetic): Use mixed boolean-arithmetic expressions for obfuscation
• Virtualization (VMP): Convert code into custom bytecode executed by embedded VM

Major OLLVM Frameworks

Classic OLLVM

• Original OLLVM: https://github.com/obfuscator-llvm/obfuscator
• Features: BCF, CFF, Instruction Substitution, String Encryption

Modern Variants

• Hikari: Advanced features including function wrapper, anti-class-dump
• Pluto-Obfuscator: Well-maintained with MBA, indirect branch, global encryption
• Arkari: Modern implementation with enhanced features
• o-mvll: Mobile-focused obfuscator for iOS/Android

Specialized Tools

• IR VMP: GANGE666/xVMP, NiTianErXing666/SmallVmp for virtualization
• Warbird: Microsoft's commercial obfuscation technology

Implementation Guidelines

Creating Custom LLVM Obfuscation Pass

#include "llvm/Pass.h"
#include "llvm/IR/Function.h"
#include "llvm/IR/Instructions.h"

class MyObfuscationPass : public llvm::FunctionPass {
public:
    static char ID;
    MyObfuscationPass() : FunctionPass(ID) {}
    
    bool runOnFunction(llvm::Function &F) override {
        // Implement obfuscation logic
        for (auto &BB : F) {
            for (auto &I : BB) {
                // Transform instructions
            }
        }
        return true;
    }
};