Git Product home page Git Product logo

obfuscator-llvm-16.0's Introduction

Obfuscator-LLVM-16.0

Quick Usage

Get the Docker image and run:

docker pull ghcr.io/joaovarelas/obfuscator-llvm-16.0:latest
docker run -v  /path/to/cargo/proj:/projects/ -it <image-id> /bin/bash

# target windows
cargo rustc --target x86_64-pc-windows-gnu --release -- -Cdebuginfo=0 -Cstrip=symbols -Cpanic=abort -Copt-level=3 -Cllvm-args=-enable-allobf

# target linux
cargo rustc --target x86_64-unknown-linux-gnu --release -- -Cdebuginfo=0 -Cstrip=symbols -Cpanic=abort -Copt-level=3 -Cllvm-args=-enable-allobf

Compiled binaries will be placed at ./target directory.

Available OLLVM Features

Current Rust OLLVM is based on Hikari which has the following features:

  • Anti Class Dump: -enable-acdobf

  • Anti Hooking: -enable-antihook

  • Anti Debug: -enable-adb

  • Bogus Control Flow: -enable-bcfobf

  • (*) Control Flow Flattening: -enable-cffobf

  • Basic Block Splitting: -enable-splitobf

  • Instruction Substitution: -enable-subobf

  • Function CallSite Obf: -enable-fco

  • (*) String Encryption: -enable-strcry

  • Constant Encryption: -enable-constenc

  • (*) Indirect Branching: -enable-indibran

  • (*) Function Wrapper: -enable-funcwra

  • Enable ALL of the above: -enable-allobf (not going to work and you'll probably run out of memory)

* not working

Development

TO-DO

Contributors

obfuscator-llvm-16.0's People

Contributors

eduardo010174 avatar joaovarelas avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar

obfuscator-llvm-16.0's Issues

Build failled

image
I get this error when I run the build command docker build -t rustc-ollvm .

Not supported aarch64-linux-android

RUSTCFLAGS="-Cllvm-args=-enable-allobf" cargo +ollvm-rust-1.70.0 build --target aarch64-linux-android --release
error: failed to run `rustc` to learn about target-specific information

Caused by:
  process didn't exit successfully: `/usr/local/rustup/toolchains/ollvm-rust-1.70.0/bin/rustc - --crate-name ___ --print=file-names --target aarch64-linux-android --crate-type bin --crate-type rlib --crate-type dylib --crate-type cdylib --crate-type staticlib --crate-type proc-macro --print=sysroot --print=split-debuginfo --print=crate-name --print=cfg` (exit status: 1)
  --- stderr
  error: could not create LLVM TargetMachine for triple: aarch64-linux-android: No available targets are compatible with triple "aarch64-unknown-linux-android"

May I ask how to solve it

May I ask why remap debuginfo=true is not used

https://b1n.io/posts/orust-mimikatz-bypass-kaspersky/#%e6%b7%b7%e6%b7%86%e7%89%88rust-mimikatz-bypass%e5%8d%a1%e5%b7%b4%e6%96%af%e5%9f%ba
It seems that this article was also written by you, as mentioned in the article

大家都知道, rust默认编译后会将一些敏感目录打包进二进制文件, rust的库也存在类似的问题. 一般的解决方案是使用--remap-path-prefix去映射, 但是在编译rust的本身的库的时候, 是无法完全控制的, 为什么说无法完全控制呢? 因为确实可以控制一部分, 在编译rust的config.toml的文件里rust选项下有个remap-debuginfo选项, 取消注释, 并且设置为true即可去除部分路径, 这条配置启用之后, rust本身的调试路径将会映射到/rust/$sha/..., 但是部分rust依赖的crate并不能靠这条命令完成映射
有两个解决方法, 一是在编译时, 重新编译这些库, 并且配置好--remap-path-prefix, 命令如下

Do you know how to use string encryption

After compiling the original string, the binary can be directly opened to view the used string.

    let my_string = "Hello, world!";

I will now use ASCII for the string and then convert it back to the string

    let my_string = String::from_utf8_lossy(&[72, 101, 108, 108, 111, 44, 32, 119, 111, 114, 108, 100, 33]);

Please evaluate the safety

String encryption failed

fn main() {
    println!("Hello, world!11111111");
}

docker pull ghcr.io/joaovarelas/obfuscator-llvm-16.0:latest
docker run -v  .:/projects/ -it ghcr.io/joaovarelas/obfuscator-llvm-16.0:latest /bin/bash
cargo clean && cargo rustc --target x86_64-unknown-linux-gnu --release -- -Cdebuginfo=0 -Cstrip=symbols -Cpanic=abort -Copt-level=3 -Cllvm-args=-enable-allobf
root@b1b21ac3b374:/projects# strings target/x86_64-unknown-linux-gnu/release/demo | grep Hello
..range start index  out of range for slice of length slice index starts at  but ends at panicked at 00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899invalid args/repos/rust-1.70.0/library/core/src/fmt/mod.rsHello, world!11111111

编译命令

我测试了下没测出混淆效果。弱弱的问下楼主,如何编译,用什么参数可以达到混淆效果

Hikari Rust obfuscation (docker) is visual only

Hello! I was able to install OLLVM (Hikari) using docker on Ubuntu 22.04 machine. Installation went smooth, but it seems that although hikari outputs the build is obfuscated successfully, upon review in IDA it seems not. Used allobf.

CMD:

RUSTCFLAGS="-Cllvm-args=-enable-allobf" cargo +ollvm-rust-1.70.0 build --release --target x86_64-pc-windows-gnu

Interestingly, file size was almost unchanged:

2.086.400 bytes No Hikari
2.098.176 bytes Hikari

Without hikari:

image

With hikari:

image

Hikari output at the end:

Doing Post-Run Cleanup
Hikari Out
Spend Time: 0.0077369s
std::mt19937_64 seeded with current timestamp: 1702740763666
Initializing Hikari Core with Revision ID:2b9c52f66815bb8d6ea74a4b26df3410602be9b0
Running Hikari On magnolia_endpoint.f67844fb-cgu.12
Doing Post-Run Cleanup
Hikari Out
Spend Time: 0.0044720s
std::mt19937_64 seeded with current timestamp: 1702740763680
Initializing Hikari Core with Revision ID:2b9c52f66815bb8d6ea74a4b26df3410602be9b0
Running Hikari On magnolia_endpoint.f67844fb-cgu.5
Doing Post-Run Cleanup
Hikari Out
Spend Time: 0.0045967s
std::mt19937_64 seeded with current timestamp: 1702740763696
Initializing Hikari Core with Revision ID:2b9c52f66815bb8d6ea74a4b26df3410602be9b0
Running Hikari On magnolia_endpoint.f67844fb-cgu.3
Doing Post-Run Cleanup
Hikari Out
Spend Time: 0.0027835s
Finished release [optimized] target(s) in 1m 03s

conditional compilation

Hi,
I've been studying this recently, and I've come across a tricky question。How do you use conditional compilation in rust? For example, attribute((annotate("annotation")) in c++?

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.