obfus.h - Macro-header for compile-time C obfuscation (tcc,

项目说明


obfus.h

obfus.h is a macro-only library for compile-time obfuscating C applications, designed specifically for the Tiny C (tcc) (you can download it here -> Tiny-C-Compiler/releases). It is tailored for Windows x86 and x64 platforms and supports almost all of the compiler. Very reliable armor for your C programs!

What features does it have?...

🔍 Function Call Obfuscation: Confuse function calls to make your code less readable to unauthorized eyes.

🛡️ Anti-Debugging Techniques: Built-in mechanisms to prevent code analysis during runtime.

🔄 Control Flow Code Mutation: Turns code into spaghetti, making it difficult to parse conditions and loops.

🧶 Strings Hiding: Hides specified strings in a file and dynamically collects them when executed.

🚫 Anti-Decompilation Techniques: Makes many popular decompilers useless breaking their output.

😈 Fake Signatures Adding: Can add fake signatures of packers and protectors to confuse reverse engineers.

🧠 : Makes math operations very difficult to understand using machine commands.

🎯 Intended use

obfus.h is a full-featured obfuscation tool, not a proof of concept. It is a powerful tool when you understand where and how to apply it: use it to protect selected nati containing sensiti.

Since obfus.h requires TCC, the recommended approach for larger projects is to isolate that logic in C DLLs compiled with TCC and obfuscated with obfus.h. The main application can remain in C#, C++, another language, or C compiled with GCC, LL or C and call those DLLs through their exported interfaces.

The resulting binaries can also be processed by commercial protectors and packers to add another layer of protection. Check compatibility with your chosen protector and settings before distributing the protected components.

> [!IMPORTANT]
> obfus.h significantly raises the barrier to reverse engineering, but it is not a panacea. Protecting trade secrets also requires your own internal protection mechanisms; obfuscation should be one layer of your protection strategy.

👾 Usage

Integrating obfus.h into your project is a simple process. Just include the following line in your code:

This enables compile-time obfuscation to make your code harder to analyze and help protect your intellectual property.

Junk branches use different compile-time constants and skipped byte sequences at each expansion. Define OBFH_BUILD_SEED before including the header, or pass -DOBFH_BUILD_SEED=123u, to vary them between builds. The default seed is 0; a fixed seed keeps the reproducible with the same source and compiler.

BREAK_STACK_CFLOW; inserts a compile-time-selected template from the shared pool of 128 . The header uses it throughout its protection paths, with fresh parameters per expansion and less frequent selection of the CPUID . The pool includes paired arithmetic, bitwise, carry and rotation predicates with branch layouts and randomized skipped payloads. CFLOW_V2 adds a different lightweight template; HIDE_STRING emits one template.

> A options for protection configuring:
>
> or use it with compiler args:
>
>

> [!WARNING]
> When compiling an application with obfuscation, use the -w argument to suppress warnings. Otherwise, the console will display numerous intimidating logs that have no impact on the final result. There's no need to be alarmed by them.

🔐 Debugging protection is triggered by calls to many basic MSVCRT functions.
In critical places in the code you can use the ANTI_DEBUG; construct. For example:

🧶 Strings hiding

The HIDE_STRING(str) obfuscates and hides strings by mutating them, significantly complicating their discovery and patching in the source code. When declared in this manner, the strings are assembled on the stack through mov instructions rather than being loaded all at once. This method ensures that the strings are not statically declared and are instead constructed at runtime, making them less susceptible to static analysis. However, it is important to note that this feature cannot be used for hiding static fields during their declaration, as it in a function call.

> [!IMPORTANT]
> Some decompilers may still reveal them due to static optimizations. In disassembler output, the code will appear complex and cumbersome, which can deter straightforward analysis but may not fully prevent determined reverse engineering efforts.

The returned pointer remains valid until the enclosing block ends. Copy the string if it needs to outlive that block. There is no fixed 4096-byte helper buffer.

An example of calling the printf function from the standard library with static hiding of the message and its decryption on the stack:

👺

This is a protection technique in which certain calculations are performed through an embedded machine upon command. Makes analysis of mathematical operations very difficult! It will work with the VIRT option enabled (and only!). Otherwise, all machine commands will be replaced by ordinary mathematical operators.

> [!WARNING]
> in critical locations can impact optimization. Use with caution only in areas where it is really needed

| Function | Type | Op | Description | Example |
|------------------|----------------|----|----------------------------------------------------------------------------|--------------------------------------|
| | *long* |+ | Adds two numbers | (5, 3) = 8 |
| | *long* |- | Subtracts two numbers | (5, 3) = 2 |
| | *long* |* | Multiplies two numbers | (5, 3) = 15 |
| | *long* |/ | Divides two numbers | (6, 3) = 2 |
| | *long* |% | Calculates the modulus of two numbers | (5, 3) = 2 |
| | *BOOL* |==| Checks if two numbers are equal | (5, 5) = true |
| | *BOOL* |!=| Checks if two numbers are not equal | (5, 3) = true |
| | *BOOL* |< | Checks if the first number is less than the second number | (3, 5) = true |
| | *BOOL* |> | Checks if the first number is greater than the second number | (5, 3) = true |
| | *BOOL* |<=| Checks if the first number is less than or equal to the second number | (3, 5) = true |
| | *BOOL* |>=| Checks if the first number is greater than or equal to the second number | (5, 3) = true |
| | *long double* |+ | Adds two double numbers | (5.5, 3.2) = ≈8.7 |
| | *long double* |- | Subtracts two double numbers | (5.5, 3.2) = ≈2.3 |
| | *long double* |* | Multiplies two double numbers | (5.5, 3.2) = ≈17.6 |
| | *long double* |/ | Divides two double numbers | (6.0, 3.0) = ≈2.0 |
| | *BOOL* |< | Checks if the first double number is less than the second double number | (3.5, 5.2) = true |
| | *BOOL* |> | Checks if the first double number is greater than the second double number | (5.5, 3.2) = true |
> The machine does not support some basic double comparison operations.

You can use logical operators that use machine calls to further complicate the understanding of your code:
| Operator | Description |
|-----------------|---------------------------|
| VM_IF | Use instead of if |
| | Use instead of else if |
| | Use instead of else |
> This is not a complete replacement for if/else, but is just a complication of standard operators.

A simple example of using :

You can find examples of using all the functions of a machine in the file tests/vm.c

❓ Example of using

If you need ad protection against skilled re, use CFLOW_V2 and ANTIDEBUG_V2 options.

🤖 How it works?

> 

🛠 Compiler (important)

Tiny C 0.9.27 is recommended for use. Unfortunately, some of the compiler do not support the functionality needed to completely obfuscation. C, GCC and Clang *is not supported* and is unlikely to be supported.

> [!NOTE]
> Originally created by Fabrice Bellard, TCC is now maintained and de by the community. You can build the latest de yourself from the TCC source mirror.

🌐 obfus.h updater

You can use special script for Windows to get the latest of obfus.h by downloading the package from the official repository. This is useful if you need to automate security updates without using git.

> For example, you can use it before building your project:
>
> The script will update the contents of the obfus.h file in the current directory (according to the specified configuration)

🦎 Security Audits and the Community

* Defeating a Heavily Obfuscated Binary - Black-box analysis of internal obfus.h security mechanisms and it deobfuscation. All have now been patched.
* [\[CTF\] 2024 CISCN x 长城杯 初赛逆向0解题-VT 解题全流程]() - Re CTF with previous generation of obfus.h using the original protection code.
* ObfusHunter - A utility for scanning files protected by obfus.h

📖 Summarize

The code of a program (and its original original logic) protected using obfus.h is almost impossible to recover (deobfuscate). However, using this obfuscator does not guarantee complete protection against all types of threats. It's important to develop and maintain internal program security systems.

> What the diagrammatic code will look like after obfuscation:
> 

> The re will see something like this if he tries to use a decompiler:
> 

> This is what all hidden strings via HIDE_STRING feature look like in the disassembler (x86-64 arch):
>

<!--

-->

🌈 Special thanks

Thanks to e who helped in the de of this project. I appreciate it! ❤️
* 👨🏼‍💻 *(for help with the code and advices)*
* 🐺 *(for cool ideas and their solutions)*

And thanks to you 🤝 for paying attention to this project!

项目信息

开发语言：C

Star 数：1866

技术要点

该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Macro-header for compile-time C obfuscation (tcc, win x86/x64)展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。