Anti-optimization shield — shield¶
Post-obfuscation hardening. Inserts volatile barriers, opaque identity operations, dead-store
protection patterns, and CFG guards so that a subsequent optimization pass — including an
analyst running -O2 on your obfuscated output — cannot simplify the obfuscation away.
Runs near the end of the pipeline, protecting the finished shape.
Options¶
| Key | Default | Range | Meaning |
|---|---|---|---|
maxSites |
200 | 0–10000 | Maximum insertion sites. |
volatileBarriers / volatile |
1 | 0/1 | Insert volatile load/store barriers. |
opaqueIdentities / identity |
1 | 0/1 | Insert opaque identity operations. |
deadStoreProtect / dse |
1 | 0/1 | Add dead-store protection patterns. |
cfgGuards / cfg |
1 | 0/1 | Add CFG guard patterns. |
Example¶
__attribute__((annotate("obf: shield(maxSites=250,volatile=1,identity=1,dse=1,cfg=1)")))
int f(int x) { return x ^ 0x5A5A; }
Auto-enable across a module
-obf-shield-auto turns on shield with default knobs for any function that has some
obfuscation but no explicit shield(...). Explicit shield(...) annotations are always honored
regardless. Handy to blanket-protect a heavily obfuscated module against -O2 reversal.
It hardens, it doesn't obfuscate
shield adds no new logic to reverse — its job is to stop the optimizer from unravelling the
passes that ran before it. Use it as the last layer over mba/bcf/flattening, not on its own.