obfus.h

obfus.h is a macro-only library for compile-time obfuscating C applications, designed specifically for the Tiny C (tcc). It is tailored for Windows x86 and x64 platforms and supports almost all versions of the compiler. Very reliable armor for your C programs!

What features does it have?...

• 🔍 Function Call Obfuscation: Confuse function calls to make your code less readable to unauthorized eyes.
• 🛡️ Anti-Debugging Techniques: Built-in mechanisms to prevent code analysis during runtime.
• 🔄 Control Flow Code Mutation: Turns code into spaghetti, making it difficult to parse conditions and loops.
• 🚫 Anti-Decompilation Techniques: Makes many popular decompilers useless visually breaking their output.
• 😈 Fake Signatures Adding: Can add fake signatures of various packers and protectors to confuse reverse engineers.
• 🧠 Virtualization: Makes math operations very difficult to understand using virtual machine commands.

👾 Usage

Integrating obfus.h into your project is a simple process. Just include the following line in your code:

#include "obfus.h"

This will automatically obfuscate your code during compilation, ensuring protection and confidentiality of your intellectual property.

Available options for protection configuring:

// Advanced code protection (see the "Virtualization" part of the documentation!)
#define VIRT           1  // Allows you to use the functions of a math VM

// Additional options
#define CFLOW_V2       1  // More powerful Control Flow obfuscation (slowly!)
#define ANTIDEBUG_V2   1  // Use better dynamic anti-debugging protection
#define FAKE_SIGNS     1  // Adds fake signatures of various protectors or packers

// Disabling default features
#define NO_CFLOW       1  // Don't use Control-Flow obfuscation
#define NO_ANTIDEBUG   1  // Don't build in debugging protection

or use it with compiler args:

tcc "app.c" -w  -D NO_CFLOW  -D ANTIDEBUG_V2  -D FAKE_SIGNS  -D VIRT

[!WARNING] When compiling an application with obfuscation, use the -w argument to suppress warnings. Otherwise, the console will display numerous intimidating logs that have no impact on the final result. There's no need to be alarmed by them.

🔐 Debugging protection is triggered by calls to many basic MSVCRT functions. In critical places in the code you can use the ANTI_DEBUG; construct. For example:

ANTI_DEBUG;
if (!licenseExpired()) {
    // ...
}

👺 Virtualization

This is a protection technique in which certain calculations are performed through an embedded virtual machine upon command. Makes analysis of mathematical operations very difficult! It will work with the VIRT option enabled (and only!). Otherwise, all virtual machine commands will be replaced by ordinary mathematical operators.

[!WARNING] Virtualization in critical locations can impact optimization. Use with caution only in areas where it is really needed

The virtual machine does not support some basic double comparison operations.

A simple example of using virtualization:

// ...
#define VIRT 1
// ...

// if ((2 + 2) == 4) { ... }
VM_IF (VM_EQU(VM_ADD(2, 2), 4)) {
    printf("2 + 2 == 4!");
}

// if (condition1) { ... }
// else if (condition2) { ... }
// else { ... }
VM_IF (condition1) {
    // if
} VM_ELSE_IF (condition2) {
    // else if
} VM_ELSE {
    // else
}

You can find examples of using all the functions of a virtual machine in the file tests/virtualmachine.c

❓ Example of using

If you need advanced protection against skilled reversers, use CFLOW_V2 and ANTIDEBUG_V2 options.

// Let's obfuscate your code!

#include <stdio.h>

#define VIRT         1 // [+] Use math virtual machine

#define CFLOW_V2     1 // [+] ControlFlow v2
#define FAKE_SIGNS   1 // [+] Fake signatures
#define ANTIDEBUG_V2 1 // [+] AntiDebug v2

#define NO_CFLOW     0 // [-] Disable ControlFlow
#define NO_ANTIDEBUG 0 // [-] Disable AntiDebug

#include "obfus.h"

void main() {
    char *out = malloc(256);

    strcpy(out, "Hello, world!\n");

    if (out) {
        printf(out);
    } else {
        printf("Error!\n");
    }

    free(out);

    int result = VM_ADD(5, 7); // 5 + 7

    VM_IF (VM_EQU(result, 12)) { // (5 + 7) == 12
        printf("5 + 7 == 12");
    }
}

🤖 How it works?

🛠 Compiler (important)

The latest version of Tiny C (0.9.27) is recommended for use. Unfortunately, some versions of the compiler do not support the functionality needed to completely obfuscation. Visual C, GCC and Clang is not supported and is unlikely to be supported.

🌐 obfus.h updater

You can use special script for Windows to get the latest versions of obfus.h by downloading the package from the official repository. This is useful if you need to automate security updates without using git.

For example, you can use it before building your project:

+ C:\...> call obfh-update
  C:\...> tcc app.c -w

The script will update the contents of the obfus.h file in the current directory (according to the specified configuration)

📖 Summarize

The code of a program (and its original original logic) protected using obfus.h is almost impossible to recover (deobfuscate). However, using this obfuscator does not guarantee complete protection against all types of threats. It's important to develop and maintain internal program security systems.

What the diagrammatic code will look like after obfuscation:

The reverser will see something like this if he tries to use a decompiler:

🌈 Special thanks

Thanks to everyone who helped in the development of this project. I appreciate it! ❤️

• 👨🏼‍💻 @horsicq (for help with the code and advices)
• 🐺 @ac3ss0r (for cool ideas and their solutions)

And thanks to you 🤝 for paying attention to this project!