Skip to content

Latest commit

 

History

History
202 lines (163 loc) · 9.93 KB

README.md

File metadata and controls

202 lines (163 loc) · 9.93 KB
Raw

obfus.h

obfus.h is a macro-only library for compile-time obfuscating C applications, designed specifically for the Tiny C (tcc). It is tailored for Windows x86 and x64 platforms and supports almost all versions of the compiler. Very reliable armor for your C programs!

What features does it have?...

  • 🔍 Function Call Obfuscation: Confuse function calls to make your code less readable to unauthorized eyes.
  • 🛡️ Anti-Debugging Techniques: Built-in mechanisms to prevent code analysis during runtime.
  • 🔄 Control Flow Code Mutation: Turns code into spaghetti, making it difficult to parse conditions and loops.
  • 🚫 Anti-Decompilation Techniques: Makes many popular decompilers useless visually breaking their output.
  • 😈 Fake Signatures Adding: Can add fake signatures of various packers and protectors to confuse reverse engineers.
  • 🧠 Virtualization: Makes math operations very difficult to understand using virtual machine commands.

👾 Usage

Integrating obfus.h into your project is a simple process. Just include the following line in your code:

#include "obfus.h"

This will automatically obfuscate your code during compilation, ensuring protection and confidentiality of your intellectual property.

Available options for protection configuring:

// Advanced code protection (see the "Virtualization" part of the documentation!)
#define VIRT           1  // Allows you to use the functions of a math VM

// Additional options
#define CFLOW_V2       1  // More powerful Control Flow obfuscation (slowly!)
#define ANTIDEBUG_V2   1  // Use better dynamic anti-debugging protection
#define FAKE_SIGNS     1  // Adds fake signatures of various protectors or packers

// Disabling default features
#define NO_CFLOW       1  // Don't use Control-Flow obfuscation
#define NO_ANTIDEBUG   1  // Don't build in debugging protection

or use it with compiler args:

tcc "app.c" -w  -D NO_CFLOW  -D ANTIDEBUG_V2  -D FAKE_SIGNS  -D VIRT

Warning

When compiling an application with obfuscation, use the -w argument to suppress warnings. Otherwise, the console will display numerous intimidating logs that have no impact on the final result. There's no need to be alarmed by them.

🔐 Debugging protection is triggered by calls to many basic MSVCRT functions. In critical places in the code you can use the ANTI_DEBUG; construct. For example:

ANTI_DEBUG;
if (!licenseExpired()) {
    // ...
}

👺 Virtualization

This is a protection technique in which certain calculations are performed through an embedded virtual machine upon command. Makes analysis of mathematical operations very difficult! It will work with the VIRT option enabled (and only!). Otherwise, all virtual machine commands will be replaced by ordinary mathematical operators.

Warning

Virtualization in critical locations can impact optimization. Use with caution only in areas where it is really needed

Function Type Op Description Example
VM_ADD long + Adds two numbers VM_ADD(5, 3) = 8
VM_SUB long - Subtracts two numbers VM_SUB(5, 3) = 2
VM_MUL long * Multiplies two numbers VM_MUL(5, 3) = 15
VM_DIV long / Divides two numbers VM_DIV(6, 3) = 2
VM_MOD long % Calculates the modulus of two numbers VM_MOD(5, 3) = 2
VM_EQU BOOL == Checks if two numbers are equal VM_EQU(5, 5) = true
VM_NEQ BOOL != Checks if two numbers are not equal VM_NEQ(5, 3) = true
VM_LSS BOOL < Checks if the first number is less than the second number VM_LSS(3, 5) = true
VM_GTR BOOL > Checks if the first number is greater than the second number VM_GTR(5, 3) = true
VM_LEQ BOOL <= Checks if the first number is less than or equal to the second number VM_LEQ(3, 5) = true
VM_GEQ BOOL >= Checks if the first number is greater than or equal to the second number VM_GEQ(5, 3) = true
VM_ADD_DBL long double + Adds two double numbers VM_ADD_DBL(5.5, 3.2) = ≈8.7
VM_SUB_DBL long double - Subtracts two double numbers VM_SUB_DBL(5.5, 3.2) = ≈2.3
VM_MUL_DBL long double * Multiplies two double numbers VM_MUL_DBL(5.5, 3.2) = ≈17.6
VM_DIV_DBL long double / Divides two double numbers VM_DIV_DBL(6.0, 3.0) = ≈2.0
VM_LSS_DBL BOOL < Checks if the first double number is less than the second double number VM_LSS_DBL(3.5, 5.2) = true
VM_GTR_DBL BOOL > Checks if the first double number is greater than the second double number VM_GTR_DBL(5.5, 3.2) = true

The virtual machine does not support some basic double comparison operations.

You can use logical operators that use virtual machine calls to further complicate the understanding of your code.

Operator Description
VM_IF Use instead of if
VM_ELSE_IF Use instead of else if
VM_ELSE Use instead of else

A simple example of using virtualization:

// ...
#define VIRT 1
// ...

// if ((2 + 2) == 4) { ... }
VM_IF (VM_EQU(VM_ADD(2, 2), 4)) {
    printf("2 + 2 == 4!");
}

// if (condition1) { ... }
// else if (condition2) { ... }
// else { ... }
VM_IF (condition1) {
    // if
} VM_ELSE_IF (condition2) {
    // else if
} VM_ELSE {
    // else
}

You can find examples of using all the functions of a virtual machine in the file tests/virtualmachine.c

❓ Example of using

If you need advanced protection against skilled reversers, use CFLOW_V2 and ANTIDEBUG_V2 options.

// Let's obfuscate your code!

#include <stdio.h>

#define VIRT         1 // [+] Use math virtual machine

#define CFLOW_V2     1 // [+] ControlFlow v2
#define FAKE_SIGNS   1 // [+] Fake signatures
#define ANTIDEBUG_V2 1 // [+] AntiDebug v2

#define NO_CFLOW     0 // [-] Disable ControlFlow
#define NO_ANTIDEBUG 0 // [-] Disable AntiDebug


#include "obfus.h"

void main() {
    char *out = malloc(256);

    strcpy(out, "Hello, world!\n");

    if (out) {
        printf(out);
    } else {
        printf("Error!\n");
    }

    free(out);

    int result = VM_ADD(5, 7); // 5 + 7

    VM_IF (VM_EQU(result, 12)) { // (5 + 7) == 12
        printf("5 + 7 == 12");
    }
}

🤖 How it works?

🛠 Compiler (important)

The latest version of Tiny C (0.9.27) is recommended for use. Unfortunately, some versions of the compiler do not support the functionality needed to completely obfuscation. Visual C, GCC and Clang is not supported and is unlikely to be supported.

🌐 obfus.h updater

You can use special script for Windows to get the latest versions of obfus.h by downloading the package from the official repository. This is useful if you need to automate security updates without using git.

For example, you can use it before building your project:

+ C:\...> call obfh-update
  C:\...> tcc app.c -w

The script will update the contents of the obfus.h file in the current directory (according to the specified configuration)

📖 Summarize

The code of a program (and its original original logic) protected using obfus.h is almost impossible to recover (deobfuscate). However, using this obfuscator does not guarantee complete protection against all types of threats. It's important to develop and maintain internal program security systems.

What the diagrammatic code will look like after obfuscation:

The reverser will see something like this if he tries to use a decompiler:

🌈 Special thanks

Thanks to everyone who helped in the development of this project. I appreciate it! ❤️

  • 👨🏼‍💻 @horsicq (for help with the code and advices)
  • 🐺 @ac3ss0r (for cool ideas and their solutions)

And thanks to you 🤝 for paying attention to this project!