xollvm¶
Annotation-driven LLVM 22 obfuscator — new pass manager, zero LLVM source edits.
xollvm is an annotation-driven obfuscation framework for LLVM's new pass manager.
You annotate the functions you care about in the source; a module analysis parses
llvm.global.annotations once into a cached, deterministic Function → Config map; a module
entry pass then runs the module-only work and an ordered, budget-gated per-function pipeline.
It plugs into stock LLVM with no source edits — compiled in as an LLVM static extension
(LLVM_EXTERNAL_PROJECTS) or loaded as a -fpass-plugin (Obfuscator.so).
Get started Browse the passes VM deep-dive
Why xollvm¶
Fork-free¶
No LLVM patches. Ships as a static extension or a loadable plugin from the exact same source tree — nothing to rebase against upstream.
Annotation-driven¶
Obfuscation is selected per function via source annotations, resolved once per module into a cached config. No global on/off switch; you protect exactly what you mark.
Deterministic¶
Seeds cascade base → module → function → pass. Same input + same seed = byte-identical
output. Dump a full seed manifest for auditable, reproducible builds.
Safety-railed¶
Every transform is gated on instruction / block / loop-depth thresholds and an IR-growth budget, so obfuscation degrades gracefully instead of exploding on large functions.
Layered¶
Expression, control-flow, call-hardening, post-hardening, and full code virtualization — composed in a topologically-ordered pipeline you can dial per function.
Observable¶
JSON obfuscation map, per-pass CFG snapshots, an HTML report viewer, and a Python runtime test suite that verifies obfuscated binaries still behave.
60-second taste¶
// Mark a function — expression + structural + post-hardening
__attribute__((annotate("obf: mba(prob=70), bcf(prob=30), flattening(minBlocks=3), shield")))
int check(int key, int data) { return key ^ (data + 0xDEAD); }
clang -S -emit-llvm -O0 app.c -o app.ll
opt -passes=obfuscation app.ll -S -o app.obf.ll -obf-seed=1 -obf-deterministic
clang app.obf.ll -O2 -o app
That's the whole loop: annotate → -passes=obfuscation → compile. Diagnostics
(-passes=obf-dump-config, -passes=obf-metrics) tell you exactly what ran.
Obfuscation is not a security boundary
Treat it as one layer in a broader defensive strategy (hardening, anti-tamper, secure update, key management). It raises the cost of reverse engineering; it does not make code unbreakable. See Legal & disclaimer for intended-use terms.