Presets¶

Two passes — mba and vm — accept a preset= key that bundles many knobs into one tier. Any explicit key you also pass overrides the preset. Presets are the fast way in; reach for individual knobs only when tuning.

MBA presets¶

Preset	What it sets	Cost	Resists
`light`	basic rewriting, no inflation	lowest	weak
`medium`	noise-slot inflation (nonlinear + layered) — historical default	medium	SMT (fragile under `-O2`)
`high`	memory-free SLE zeros replacing the noise slot — recommended	~medium	SMT + linear-MBA, survives `-O2`
`max`	noise-slot inflation + SLE + input-derived zeros stacked	highest	SMT + linear-MBA, survives `-O2`

__attribute__((annotate("obf: mba(preset=high)")))          // recommended
__attribute__((annotate("obf: mba(preset=max, prob=60)")))  // max, but override prob

Why high beats medium

The historical noise-slot zero folds away under an analyst's own -O2 (store-forwarding), and plain linear terms fall to SMT and linear-MBA simplifiers. high swaps in memory-free, nonlinear-lifted runtime zeros that survive -O2 and resist both. See MBA.

VM presets¶

Preset	Gives you
`light`	Structural virtualisation only.
`medium`	Today's defaults (bit-identical to a bare `vm`).
`high`	`medium` + structural hardening + threaded & IP-keyed dispatch.
`max`	Strongest tier — everything, plus a private metamorphic engine per function, `handlerVariants=4`, `handlerDecoys=2`.

__attribute__((annotate("obf: vm(preset=max)")))                 // strongest single tier
__attribute__((annotate("obf: vm(preset=high, regEncrypt=1)")))  // high + register encryption

See the VM reference for the full knob list behind each tier.

Strategy bundles¶

Presets tune a single pass. These bundles combine passes for a whole-function strategy — start light, verify correctness, then scale up.

LightMediumHeavyMaximum

Low risk, fast compile/run.

__attribute__((annotate(
  "obf: mba(prob=40,maxSites=60), substitution(loop=1), sdiff(prob=25,maxSites=40), split(num=4)")))

Balanced.

__attribute__((annotate(
  "obf: mba(prob=70,maxSites=120,maxDepth=3), substitution(loop=2), vcall(prob=25,indexStrength=2), split(num=6), bcf(prob=25,loop=1,maxBlocks=4000)")))

Medium + CFG flattening + post-hardening.

__attribute__((annotate(
  "obf: mba(prob=70), substitution(loop=2), split(num=6), bcf(prob=25), flattening(minBlocks=3,maxBlocks=160,fakeTransitions=1,fakeCases=2), shield(maxSites=300), adec(prob=60,strength=2,maxSites=50)")))

Pre-obfuscate, then virtualise the result.

__attribute__((annotate("obf: mba(prob=70), bcf(prob=30), vm(hardened=1,regEncrypt=1)")))

See Choosing passes to map these onto a threat model.