es3n1n / obfuscator

PE bin2bin obfuscator

Obfuscator

A native code obfuscator written in c++23.

Available transforms:

• Bogus Control Flow
• Constant Crypt
• Decompilation breaker (ida, ghidra)
• Substitution

---

Usage

Available options:
    -h, --help                   -- This message
    -pdb         [path]          -- Set custom .pdb file location
    -map         [path]          -- Set custom .map file location
    -f           [name]          -- Start new function configuration
    -t           [name]          -- Start new transform configuration
    -g           [name]          -- Start new transform global configuration
    -v           [name] [value]  -- Push value
 
Examples:
    obfuscator hehe.exe -f main -t TransformName -v SomeName 1337
    obfuscator hehe.exe -f main -t TransformName -v SomeName 1337 -g TransformName -v SomeGlobalName 1337
    obfuscator hehe.exe -f main -t TransformName -v SomeName 1337 -v SomeName0 1337 -g TransformName -v SomeGlobalName 1337
    obfuscator hehe.exe -map mymap.map -pdb mypdb.pdb -f main -t TransformName -v SomeName 1337 -v SomeName0 1337 -g TransformName -v SomeGlobalName 1337

Writeup

• https://blog.es3n1n.eu/posts/obfuscator-pt-1

---

Building

This project is designed to be used on both Linux and Windows, and on any architecture. Although you may need to update your compiler/libc++ to the latest version, as we're using some fancy C++23 features.

cmake -B build -DOBFUSCATOR_BUILD_TESTS=0
cmake --build build --config Release

If you are using Visual Studio on Windows, you can generate the sln project using the first command and build the project using the generated .sln file.

Contributing

Any contributions you make are greatly appreciated.

1. Fork the Project
2. Create your Feature Branch (git checkout -b feature/AmazingFeature)
3. Commit your Changes (git commit -m 'Add some AmazingFeature')
4. Push to the Branch (git push origin feature/AmazingFeature)
5. Open a Pull Request

Bug reporting

Before reporting any bugs that could be related to code generation, please ensure that you attach the random seed used by the obfuscator. You can obtain this seed from the obfuscator logs; it is printed as the first message and looks like this:

12:11:30.150 | [  info  ] random: seed is 0xcb91ccbef7cbcdc1

---

Special thanks

• @j4ckson4800, @bs1337 - Code review, proof-reading

License

GPL-3.0

obfuscator's Issues

hi, can I use this after use Themida?

hi, can I use this after use Themida?
or
can I use Themida after use this?

thanks!

Create source files for header only files

Some of the project files that are header only can benefit from having source files created for them.
As per https://github.com/es3n1n/obfuscator/blob/master/todo.txt#L1

What is the enviroment&version of build tool-chain?

I have tried clang17/libc++abi-17-dev on kali but failed on linker (looks like some symbols couldn't found in libc++, compiled 100% )
Then I tried other llvm docker but also failed .
If would be helpful to provide some version information as c++23 is not stably supported

Does nothing

Command I've used to perform:

"C:\Users\geork\Documents\Github\obfuscator\build\src\RelWithDebInfo\obfuscator.exe" C:\Users\geork\Documents\Github\obfox\test_app\AppKey\x64\Debug\AppKey.exe -pdb C:\Users\geork\Documents\Github\obfox\test_app\AppKey\x64\Debug\AppKey.pdb -f main -t ConstantCrypt -t BogusControlFlow -t DecompBreak -t Substitution -v SomeValue0 133

AppKey source code:

#include <stdio.h>
#include <string.h>


#define PASS "key01234"
#define BUFF_SIZE 0xFF

int main(void) {
	printf("Enter key: ");
	char key[BUFF_SIZE];

	fgets(key, BUFF_SIZE, stdin);
	key[sizeof(PASS) - 1] = '\0';

	if (strcmp(key, PASS) == 0) {
		printf("Correct key!\n");
	} else {
		printf("Incorrect key!\n");
	}

	getchar();
	return 0;
}

I've tried both Release and Release with debug info versions of obfuscator. Both do nothing, guess it because of exception:

Console output:

If I remove all of the transforms I want to apply to program and leave only, for example, ConstantCrypt still doesn't work.

runtime error: parsed 0 functions

PS C:\Users\user\Desktop\obfuscator> C:\Users\user\Desktop\obfuscator\build\src\Release\obfuscator.exe ..\test.exe
09:45:08.662 | [  info  ] random: seed is 0x87ee46b82834fc34
09:45:08.666 | [  info  ] main: loading binary from ..\test.exe
09:45:08.696 | [ debug  ] pe: parsed 15 sections
09:45:08.700 | [ debug  ] pe: parsed total number of 29309 relocations
09:45:08.701 | [  info  ] func_parser: discovering functions: 0%
09:45:08.702 | [  info  ] func_parser: discovering functions: 25%
09:45:08.703 | [  info  ] func_parser: discovering functions: 50%
09:45:08.705 | [  info  ] func_parser: discovering functions: 75%
09:45:08.708 | [  info  ] func_parser: discovering functions: 100% took 7 ms
09:45:08.712 | [critical] RUNTIME ERROR: parser: Parsed 0 functions in total

text.exe is a golang binary, I also tried a c binary and same issue. Any idea how to fix the issue?

RUNTIME ERROR: obfuscator: got 0 functions to protect

13:10:14.962 | [ info ] random: seed is 0x5904f32cf6a0ce77
13:10:14.964 | [ info ] main: loading binary from test.exe
13:10:14.968 | [ debug ] pe: parsed 6 sections
13:10:14.969 | [ debug ] pe: parsed total number of 232 relocations
13:10:14.970 | [ info ] func_parser: discovering functions: 0%
13:10:15.026 | [ debug ] pdb: Parsed 38 types of DBI symbols
13:10:15.058 | [ info ] func_parser: discovering functions: 25%
13:10:15.058 | [ info ] func_parser: discovering functions: 50%
13:10:15.062 | [ info ] func_parser: discovering functions: 75%
13:10:15.066 | [ info ] func_parser: discovering functions: 100% took 96 ms
13:10:15.068 | [ debug ] func_parser: discovered 3089 functions
13:10:15.069 | [ info ] obfuscator: setting up functions: 9223372036854775808% took 13 microseconds
13:10:15.070 | [ info ] obfuscator: got 0 function(s) to obfuscate
13:10:15.075 | [critical] RUNTIME ERROR: obfuscator: got 0 functions to protect

It gives me this error for every .exe that I try

Feedback

This topic is truly fascinating and, unfortunately, there isn't much about it on the internet. It would be interesting if, in the future, we could see some basic content regarding bin2bin code virtualization. 😊

Strip second executable section

Good job, mate!
Do you have any idea to rebuild executable without adding second executeble section?
I think it have to look like as https://github.com/jnastarot/furikuri project

Error during building with cmake

I get this error during cmake building. Any idea how to solve this? Thanks!

iOS Support

Is iOS (MachO) supported?

RUNTIME ERROR: pe: rebuilder: unable to write section raw data

I've tried this tool on a small test program, and I ran into this error.

Tested on a c, and a cpp file. I got the same result.
I tried running the command in Administrator mode, but that did not solve my problem either.

Split up functions with only one basic block into multiple

Smaller functions with only one basic block breaks most of the transforms. A fix for this would be writing a transform that splits it up into multiple.

mov rax, 1
ret

becomes

:bb1
mov rax, 1
jmp bb2

:bb2
ret

bb->successors empty inside insert_jmps

command: obfuscator.exe stage1.dll -f main (seed irrelevant)
crash at:

obfuscator/src/lib/analysis/bb_decomp/bb_decomp.cpp

Line 388 in 72a0fef

assert(bb->successors.size() == 1);

debugger says bb->successors is empty

sample: RelWithDebInfo.zip (It's part of fumo_loader, one of my projects, just built with symbols)

discord name: nezu.cc in case you need that