Anti-decompiler — adec¶
Post-hardening that targets decompilers and disassemblers specifically. Inserts indirectbr
trampolines, inline-asm junk bytes, fake stack-frame entries, opaque-predicate dead blocks, indirect
calls via volatile slots, and pointer aliasing via ptrtoint chains — patterns that break linear
disassembly, function recovery, and decompiler output.
adec is a modular subsystem (the ADec/ tree): a registry of techniques drawing from a gadget
pool, each independently tunable and budget-split.
Options (annotation)¶
| Key | Default | Range | Meaning |
|---|---|---|---|
prob |
50 | 1–100 | Site probability (%). |
maxSites |
40 | 1–500 | Maximum insertion sites. |
strength |
2 | 0–3 | Complexity level (0 = minimal, 3 = maximum). |
enableIndirectBr / indirectbr |
1 | 0/1 | indirectbr trampolines. |
enableAsmAntiDisasm / asm |
1 | 0/1 | Inline-asm junk bytes (target-dependent). |
enableStackPollution / stack |
1 | 0/1 | Fake stack-frame entries and noise. |
enableDeadCodeDecoys / decoy |
1 | 0/1 | Opaque-predicate + dead-code decoy blocks. |
enableCallObfuscation / call |
1 | 0/1 | Indirect call via volatile slots. |
enableAliasConfusion / alias |
1 | 0/1 | Pointer aliasing via ptrtoint chains. |
Example¶
__attribute__((annotate("obf: adec(prob=70,strength=2,maxSites=25,asm=0)")))
int f(int x) { return x + 1; }
Global tuning flags¶
adec exposes CLI flags for pool/technique control. Per-function annotation parameters override
these when both are present.
| Flag | Meaning |
|---|---|
-adec-gadgets-file=<paths> |
Comma-separated JSON gadget files merged into the pool. |
-adec-disable-builtin-gadgets |
Drop built-in gadget tables; use only user files / annotations. |
-adec-clobbers-x86=<csv> |
Override inline-asm clobber list for x86_64. |
-adec-clobbers-aarch64=<csv> |
Override inline-asm clobber list for aarch64. |
-adec-techniques=<csv> |
Whitelist of techniques (asmGadgets,indirectBr,deadDecoy,stackPollution,callTrampoline,aliasConfusion,fakeLoop,rdtscStretch,constLaunder). |
-adec-categories=<csv> |
Gadget category filter (anti-disasm,anti-trace,desync,…). |
-adec-budget-split=<key:pct,…> |
Per-technique budget split (asm,ibr,decoy,call,alias,loop,rdtsc,clndr). |
-adec-prefix=<name> |
IR-name prefix for adec artifacts — randomize per build to defeat signature scans of canonical adec.* names. |
-adec-randomize-consts |
Replace hard-coded decoy payload constants with RNG values. |
Defeat signature scans
Canonical adec.* IR names and fixed decoy constants are a signature. For shipping builds, set a
random -adec-prefix and -adec-randomize-consts so two builds share no static adec fingerprint.
asm is target-dependent
Inline-asm junk bytes are architecture-specific. If you cross-compile or hit an assembler error,
disable with asm=0 (or scope the clobber lists via the flags above).