loc_obf_1: mov eax, switch_var cmp eax, 0x1 -> jmp loc_realblock1 cmp eax, 0x2 -> jmp loc_realblock2 ... If prebuilt plugin fails:
clang-cl.exe /O2 /GS- /c payload.c -mllvm -enable-pass-plugin=C:\Hikari\lib\hikari_pe_x64.dll -mllvm -sub -mllvm -bcf -mllvm -fla -mllvm -split Use lld-link.exe (or MSVC link.exe):
Download prebuilt hikari_pe_x64.dll from: github.com/HikariObfuscator/Hikari/releases (look for Hikari-LLVM15.0-windows-x64.zip ) Extract the zip to C:\Hikari\ :
clang-cl.exe /O2 /GS- /c source.c ^ -mllvm -enable-pass-plugin=C:\Hikari\lib\hikari_pe_x64.dll ^ -mllvm -sub -mllvm -sub_loop=1 | Flag | Effect | |------|--------| | -sub | Instruction substitution | | -sub_loop=1 | Substitution on loops | | -bcf | Bogus control flow | | -bcf_loop=1 | Bogus flow in loops | | -fla | Control flow flattening | | -fla_loop=1 | Flatten loops | | -split | Basic block splitting | | -split_num=2 | Split into 2 blocks | | -indibran | Indirect branching (opaque predicates) |
Also available: "bcf" , "split" , "indibran" , "fla_loop" , "sub_loop" , "split_num=3" Combine with manual tricks:
// Opaque predicate example (constant folding resistant) volatile int x = 0; if (x == 0 && (GetTickCount() & 1) == 0) // real code else // dead code
((annotate("nohikari"))) void normal_function() // no obfuscation
loc_obf_1: mov eax, switch_var cmp eax, 0x1 -> jmp loc_realblock1 cmp eax, 0x2 -> jmp loc_realblock2 ... If prebuilt plugin fails:
clang-cl.exe /O2 /GS- /c payload.c -mllvm -enable-pass-plugin=C:\Hikari\lib\hikari_pe_x64.dll -mllvm -sub -mllvm -bcf -mllvm -fla -mllvm -split Use lld-link.exe (or MSVC link.exe):
Download prebuilt hikari_pe_x64.dll from: github.com/HikariObfuscator/Hikari/releases (look for Hikari-LLVM15.0-windows-x64.zip ) Extract the zip to C:\Hikari\ :
clang-cl.exe /O2 /GS- /c source.c ^ -mllvm -enable-pass-plugin=C:\Hikari\lib\hikari_pe_x64.dll ^ -mllvm -sub -mllvm -sub_loop=1 | Flag | Effect | |------|--------| | -sub | Instruction substitution | | -sub_loop=1 | Substitution on loops | | -bcf | Bogus control flow | | -bcf_loop=1 | Bogus flow in loops | | -fla | Control flow flattening | | -fla_loop=1 | Flatten loops | | -split | Basic block splitting | | -split_num=2 | Split into 2 blocks | | -indibran | Indirect branching (opaque predicates) |
Also available: "bcf" , "split" , "indibran" , "fla_loop" , "sub_loop" , "split_num=3" Combine with manual tricks:
// Opaque predicate example (constant folding resistant) volatile int x = 0; if (x == 0 && (GetTickCount() & 1) == 0) // real code else // dead code
((annotate("nohikari"))) void normal_function() // no obfuscation