CLI & global flags

Global options passed to opt (or via -mllvm to clang). Per-pass behaviour is set through annotations; these flags control the driver, seeding, budgets, reports, and adec.

Core

Option	Default	Meaning
-obf-seed=<N>	0	Base seed. Non-zero makes all runs reproducible.
-obf-deterministic	off	When seed is 0: derive module seed from module-id hash (else random_device).
-obf-verify	off	Run IR verification before/after each stage.
-obf-verbose	off	Print parsing, skips, budgets, pipeline order, etc.
-obf-max-function-insts=<N>	0 (off)	Skip functions larger than N instructions.
-obf-max-function-blocks=<N>	0 (off)	Skip functions larger than N basic blocks.
-obf-max-loop-depth=<N>	0 (off)	Skip functions whose loop nesting exceeds N.

IR budget

Option	Default	Meaning
-obf-ir-budget-multiplier=<N>	50	Budget = insts_before × N (clamped by the max). 0 = unlimited.
-obf-ir-budget-max=<N>	0 (off)	Absolute per-function instruction ceiling. 0 = no hard cap.

Budget knobs are global — they cannot be set per-function via annotations. See Safety rails & budgeting.

Pipeline ordering

Option	Default	Meaning
-obf-pipeline-ordering=<csv>	""	Explicit order (e.g. mba,split,bcf,flattening); remaining passes appended topologically. Unknown names are fatal.
-obf-pipeline-ordering-ann	off	Use annotation order verbatim. Ignored when -obf-pipeline-ordering is set.

Default is topological sort with conflict enforcement (e.g. vm + flattening rejected). Both overrides still run conflict checks. See Pipeline & ordering.

Seed manifest

Option	Default	Meaning
-obf-seed-manifest=<path>	""	Write JSON seed manifest (- = stderr).
-obf-seed-manifest-md	off	Also embed per-pass seeds into IR metadata (obf.seed.manifest.<passId>).

Debug info

Option	Default	Meaning
-obf-strip-debug	off	Strip debug metadata from obfuscated functions only.
-obf-debug-synthetic	on	Give inserted instructions synthetic line-0 debug locations so steppers don't jump erratically.

Shield auto-enable

Option	Default	Meaning
-obf-shield-auto	off	Auto-enable shield (default knobs) for any function that has obfuscation but no explicit shield(...). Explicit shield(...) is always honored.

Reports

Option	Default	Meaning
-obf-report-dir=<dir>	""	Emit report artifacts (CFG DOT + JSON) into this directory.
-obf-report-json=<path>	""	Write report JSON to this path (- = stdout).

Anti-decompiler (adec) tuning

Option	Default	Meaning
-adec-gadgets-file=<paths>	""	Comma-separated JSON gadget files merged into the pool.
-adec-disable-builtin-gadgets	off	Drop built-in gadget tables; use only user files / annotations.
-adec-clobbers-x86=<csv>	(built-in)	Override inline-asm clobber list for x86_64.
-adec-clobbers-aarch64=<csv>	(empty)	Override inline-asm clobber list for aarch64.
-adec-techniques=<csv>	"" (all)	Technique whitelist (asmGadgets,indirectBr,deadDecoy,stackPollution,callTrampoline,aliasConfusion,fakeLoop,rdtscStretch,constLaunder).
-adec-categories=<csv>	"" (all)	Gadget category filter (anti-disasm,anti-trace,desync,…).
-adec-budget-split=<key:pct,…>	(defaults)	Per-technique budget split (asm,ibr,decoy,call,alias,loop,rdtsc,clndr).
-adec-prefix=<name>	adec	IR-name prefix for adec artifacts — randomize per build to defeat signature scans.
-adec-randomize-consts	off	Replace hard-coded decoy payload constants with RNG values.

Per-function adec(...) annotation parameters override these CLI flags when both are present.

In-compiler gate

Option	Default	Meaning
-enable-obfuscation	off	Run the obfuscator inside a clang compile (extension point). Pass via -mllvm. Only annotated functions are transformed.