Skip to content

Commit

Permalink
Change indent from 2 spaces to 4 spaces
Browse files Browse the repository at this point in the history
  • Loading branch information
bluesadi committed Nov 4, 2022
1 parent 7d9e051 commit e479478
Show file tree
Hide file tree
Showing 11 changed files with 64 additions and 59 deletions.
34 changes: 20 additions & 14 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
# Pluto-Obfuscator
Pluto-Obfuscator is an obfuscator based on LLVM 12.0.1, mainly developed by [34r7h4mn](https://github.com/bluesadi) and [za233](https://github.com/za233).
Pluto-Obfuscator is an obfuscator based on LLVM 12.0.1 by [34r7h4mn](https://github.com/bluesadi) and [za233](https://github.com/za233).

## Environment
This project was developed and tested on the following environment:
Expand All @@ -11,16 +11,18 @@ This project was developed and tested on the following environment:
You can also build this project on Windows and MacOS, or even merge it into Android NDK toolchain (tested on Android NDK r23).

## Features
Pluto-Obfuscator encompasses multiple passes as follows (`*` denotes highly recommended passes):

- Control Flow Flattening ([Ref: Obfuscator-LLVM](https://github.com/obfuscator-llvm/obfuscator/wiki/Control-Flow-Flattening))
- Control Flow Flattening Enhanced ([Chinese documentation](https://bbs.pediy.com/thread-274778.htm))
- \*Control Flow Flattening Enhanced ([Chinese documentation](https://bbs.pediy.com/thread-274778.htm))
- Bogus Control Flow ([Ref: Obfuscator-LLVM](https://github.com/obfuscator-llvm/obfuscator/wiki/Bogus-Control-Flow))
- Instruction Substitution ([Ref: Obfuscator-LLVM](https://github.com/obfuscator-llvm/obfuscator/wiki/Instructions-Substitution))
- Random Control Flow
- Variable Substitution
- String Encryption
- Globals Encryption
- \*Globals Encryption
- [Trap Angr (Experimental)](docs/TrapAngr.md)
- MBA Obfuscation ([Chinese documentation](https://bbs.pediy.com/thread-271574.htm))
- \*MBA Obfuscation ([Chinese documentation](https://bbs.pediy.com/thread-271574.htm))

> 34r7hm4n: The documentation of this project is still lacking. I will work on it when I am available.
Expand Down Expand Up @@ -52,6 +54,11 @@ ninja -j$(sysctl -n hw.logicalcpu)
ninja install # Comment it out if you already have another version of LLVM installed on your machine
```

### Compile
// TODO

`-s -mllvm -mba -mllvm -mba-prob=50 -mllvm -fla-ex -mllvm -gle`

### Filter Mode
In case you just want to obfuscate specific functions, Pluto-Obfuscator also provides a filter mechanism using annotation, to help you specify which functions should or should not be obfuscated.

Expand Down Expand Up @@ -92,22 +99,21 @@ int main(){
**IMPORTANT:** If you would like to improve this project by creating pull requests, please make sure your modified code can pass the tests as follows.

### Quick Test on AES
Usage: `./fast-check [your-passes]` (e.g., `./fast-check.sh gle mba mba-prob=40`).
Usage: `./fast-check [your-passes]` (e.g., `./fast-check.sh mba mba-prob=50 fla-ex gle`).

See [fast-check.sh](fast-check.sh) and [test/aes](test/aes/).

### Test on libsecp256k1
Usage: `./check [your-passes]` (e.g., `./check.sh -s -mllvm -mba -mllvm -mba-prob=50 -mllvm -fla-ex -mllvm -gle`)
Usage: `./check.sh [your-passes]` (e.g., `./check.sh mba mba-prob=50 fla-ex gle`)

Generally, it will cost several minutes to be done, much slower compared to test on AES.
Generally, it will cost several minutes to be done, much slower compared to AES test.

Passed Parameters:
- Flattening: `-O2 -mllvm -fla`
- FlatteningEnhanced: `-O2 -mllvm -fla-ex`
- BogusControlFlow: `-O2 -mllvm -bcf`
- Substitution: `-O2 -mllvm -sub`
- GlobalsEncryption: `-O2 -mllvm -gle`
- MBAObfuscation: `-O2 -mllvm -mba -mllvm -mba-prob=100`
- FullProtection (**HIGHLY RECOMMENDED**): `-s -mllvm -mba -mllvm -mba-prob=50 -mllvm -fla-ex -mllvm -gle`
- Flattening: `-fla`
- FlatteningEnhanced: `-fla-ex`
- Substitution: `sub`
- GlobalsEncryption: `gle`
- MBAObfuscation: `-mba -mba-prob=100`
- FullProtection (**HIGHLY RECOMMENDED**): `-mba -mllvm -mba-prob=50 -fla-ex -gle`

See [check.sh](check.sh) and [test/secp256k1](test/secp256k1/).
2 changes: 1 addition & 1 deletion install/include/llvm/Support/VCSRevision.h
Original file line number Diff line number Diff line change
@@ -1,2 +1,2 @@
#define LLVM_REVISION "7617bb57559af5b452899945bed164f0c1b7a721"
#define LLVM_REVISION "7d9e051b88e69a7185a76fdac08a77da86280075"
#define LLVM_REPOSITORY "[email protected]:bluesadi/Pluto-Obfuscator.git"
Binary file modified install/lib/libLLVMLTO.so.12
Binary file not shown.
Binary file modified install/lib/libLLVMObject.so.12
Binary file not shown.
Binary file modified install/lib/libclang-cpp.so.12
Binary file not shown.
Binary file modified install/lib/libclangBasic.so.12
Binary file not shown.
87 changes: 43 additions & 44 deletions llvm/lib/Transforms/Obfuscation/Utils.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -85,59 +85,58 @@ BasicBlock *llvm::createCloneBasicBlock(BasicBlock *BB) {
// Reference:
// https://github.com/obfuscator-llvm/obfuscator/blob/llvm-4.0/lib/Transforms/Utils/Utils.cpp
std::string llvm::readAnnotation(Function *F) {
std::string annotation = "";
/* Get annotation variable */
GlobalVariable *glob =
F->getParent()->getGlobalVariable("llvm.global.annotations");
if (glob != NULL) {
/* Get the array */
if (ConstantArray *ca = dyn_cast<ConstantArray>(glob->getInitializer())) {
for (unsigned i = 0; i < ca->getNumOperands(); ++i) {
/* Get the struct */
if (ConstantStruct *structAn =
dyn_cast<ConstantStruct>(ca->getOperand(i))) {
if (ConstantExpr *expr =
dyn_cast<ConstantExpr>(structAn->getOperand(0))) {
/*
* If it's a bitcast we can check if the annotation is concerning
* the current function
*/
if (expr->getOpcode() == Instruction::BitCast &&
expr->getOperand(0) == F) {
ConstantExpr *note = cast<ConstantExpr>(structAn->getOperand(1));
/*
* If it's a GetElementPtr, that means we found the variable
* containing the annotations
*/
if (note->getOpcode() == Instruction::GetElementPtr) {
if (GlobalVariable *annoteStr =
dyn_cast<GlobalVariable>(note->getOperand(0))) {
if (ConstantDataSequential *data =
dyn_cast<ConstantDataSequential>(
annoteStr->getInitializer())) {
if (data->isString()) {
annotation += data->getAsString().lower() + " ";
std::string annotation = "";
/* Get annotation variable */
GlobalVariable *glob =
F->getParent()->getGlobalVariable("llvm.global.annotations");
if (glob != NULL) {
/* Get the array */
if (ConstantArray *ca = dyn_cast<ConstantArray>(glob->getInitializer())) {
for (unsigned i = 0; i < ca->getNumOperands(); ++i) {
/* Get the struct */
if (ConstantStruct *structAn =
dyn_cast<ConstantStruct>(ca->getOperand(i))) {
if (ConstantExpr *expr =
dyn_cast<ConstantExpr>(structAn->getOperand(0))) {
/*
* If it's a bitcast we can check if the annotation is concerning
* the current function
*/
if (expr->getOpcode() == Instruction::BitCast &&
expr->getOperand(0) == F) {
ConstantExpr *note = cast<ConstantExpr>(structAn->getOperand(1));
/*
* If it's a GetElementPtr, that means we found the variable
* containing the annotations
*/
if (note->getOpcode() == Instruction::GetElementPtr) {
if (GlobalVariable *annoteStr =
dyn_cast<GlobalVariable>(note->getOperand(0))) {
if (ConstantDataSequential *data =
dyn_cast<ConstantDataSequential>(annoteStr->getInitializer())) {
if (data->isString()) {
annotation += data->getAsString().lower() + " ";
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
return annotation;
return annotation;
}

bool llvm::is_exceptional_instruction(Instruction &I) {

if (isa<LandingPadInst>(I) || isa<CatchPadInst>(I) ||
isa<CatchSwitchInst>(I) || isa<CatchReturnInst>(I) ||
isa<CleanupPadInst>(I) || isa<CleanupReturnInst>(I)) {
if (isa<LandingPadInst>(I) || isa<CatchPadInst>(I) ||
isa<CatchSwitchInst>(I) || isa<CatchReturnInst>(I) ||
isa<CleanupPadInst>(I) || isa<CleanupReturnInst>(I)) {

return true;
}
return true;
}

return false;
return false;
}
Empty file.
Empty file.
Empty file.
Empty file.

0 comments on commit e479478

Please sign in to comment.