Annotation grammar¶
The complete annotation syntax, plus every pass's keys in one place. Conceptual explanation: Annotation model.
Syntax¶
__attribute__((annotate("obf: <spec>"))) // C / C++
[[clang::annotate("obf: <spec>")]] // C++ attribute form
<spec> := <passSpec> ( "," <passSpec> )*
<passSpec> := <passName> [ "(" <params> ")" ]
<params> := <kv> ( "," <kv> )*
<kv> := <key> "=" <value>
Rules: keys are [A-Za-z0-9_] (no dashes); values unquoted (maxSites=200) or quoted
(tag="a b"); whitespace ignored; booleans usually 0/1 (some accept true/false/yes/no/on/off);
all keys optional. Multiple annotations on one function merge (enablement additive, params last-wins,
ordering resolved after).
Top-level budget tokens. Besides pass specs, a spec may carry standalone per-function budget
overrides — budget=<N> / budgetMultiplier=<N> (the growth multiplier) and budgetMax=<N> (the
absolute hard cap), e.g. obf: budgetMax=8000, mba(...), bcf(...). They override the global
-obf-ir-budget-* defaults for that function (last-wins). See
Safety rails & budgeting.
Pass IDs & aliases¶
| Canonical | Aliases | Canonical | Aliases |
|---|---|---|---|
constenc |
cenc, numenc |
flattening |
fla |
mba |
— | shield |
antiopt, anti-opt |
substitution |
sub |
adec |
anti-decompiler, antidecompiler |
sdiff |
— | vm |
virtualize, virt |
vcall |
— | fmerge |
funcmerge, merge |
split |
— | strenc |
— |
bcf |
— |
Keys per pass¶
Full descriptions and examples are on each pass page; this is the at-a-glance index.
| Pass | Keys |
|---|---|
constenc |
prob, maxSites, minAbs, encInt, encFP, wrapMBA |
mba |
preset, prob, maxDepth, maxSites, linearTermsMin/Max, enableNonLinear, nonLinearWeight, enableLayered, layeredWindow, layeredBudget, inputZero, inputZeroReplace/Count/Weight, sle, sleReplace/Count/Weight |
substitution |
prob, loop, maxSites |
sdiff |
prob, slots, maxSites |
| Pass | Keys |
|---|---|
split |
num / n |
bcf |
prob, loop, maxBlocks |
flattening |
minBlocks, maxBlocks, allowIndirect, hybrid, opaqueState, fakeTransitions, fakeCases, perDispatcherDomain, obfuscateStatePtr, opaqueAliasStatePtr |
| Pass | Keys |
|---|---|
vcall |
prob, maxSites, opaqueVTableNames, addDecoyEntries, decoyMin, decoyMax, varyIndexPerCallsite, indexStrength, mergeVTables, encryptTable |
shield |
maxSites, volatileBarriers, opaqueIdentities, deadStoreProtect, cfgGuards |
adec |
prob, maxSites, strength, enableIndirectBr, enableAsmAntiDisasm, enableStackPollution, enableDeadCodeDecoys, enableCallObfuscation, enableAliasConfusion |
| Pass | Keys |
|---|---|
fmerge |
group, chunk, opaqueSel, dispatch, minInsts, maxInsts, stripDbg, thunkAddrTaken, launderSel |
strenc |
minlen, cipher, aes, keysplit |
vm |
preset, minBlocks, maxBlocks, obfRegIdx, encBytecode, lazyDecrypt, constInStream, hardened, regEncrypt, antiDebug, bindAntiDebug, nestedVM, threadedDispatch, keyedDispatch, superOps, randISA, enginePoolSize, perFnEngine, metamorphicEngines, adDispatchThreshold, adHandlerThreshold |
Many keys have short aliases (e.g. substitution accepts max/sites for maxSites); see the
individual pass pages for the aliases.