11# Shifting Codes
22
3- Python port of [ Pluto] ( https://github.com/bluesadi/Pluto ) LLVM obfuscation passes using [ llvm-nanobind] ( https://github.com/LLVMParty/llvm-nanobind ) bindings (fork: [ transformation-api] ( https://github.com/expend20/llvm-nanobind/tree/transformation-api ) ), with a PyQt6 visualization UI.
3+ Python port of [ Pluto] ( https://github.com/bluesadi/Pluto ) and [ Polaris ] ( https://github.com/polaris-obfuscator/polaris-obfuscator ) LLVM obfuscation passes using [ llvm-nanobind] ( https://github.com/LLVMParty/llvm-nanobind ) bindings (fork: [ transformation-api] ( https://github.com/expend20/llvm-nanobind/tree/transformation-api ) ), with a PyQt6 visualization UI.
44
55![ ] ( assets/UI-showcase.gif )
66
77## Passes
88
9- Six obfuscation passes are available:
9+ ### [ Pluto ] ( https://github.com/bluesadi/Pluto ) (6 passes)
1010
1111| Pass | Type | Description |
1212| ------| ------| -------------|
@@ -17,6 +17,21 @@ Six obfuscation passes are available:
1717| ** Global Encryption** | Module | XOR-encrypts global variable initializers with runtime decryption stubs |
1818| ** Indirect Call** | Module | Replaces direct function calls with indirect calls through function pointers |
1919
20+ ### [ Polaris] ( https://github.com/polaris-obfuscator/polaris-obfuscator ) (8 passes)
21+
22+ Upgraded versions of four Pluto passes plus four new passes:
23+
24+ | Pass | Type | Description |
25+ | ------| ------| -------------|
26+ | ** Bogus Control Flow** | Function | Modular-arithmetic opaque predicates (upgraded from Pluto's trivial predicates) |
27+ | ** Flattening** | Function | Switch-based dispatch with dominance-based state encryption (upgraded from plaintext) |
28+ | ** Global Encryption** | Module | Use-based discovery with per-function decryption via shared helper (upgraded from single-site inline) |
29+ | ** Indirect Call** | Module | Per-call-site globals with add/subtract pointer masking (upgraded from shared GV, no masking) |
30+ | ** Indirect Branch** | Function | Replaces direct branches with indirect jumps through obfuscated jump tables |
31+ | ** Alias Access** | Function | Obscures local variable access through pointer aliasing and multi-level struct indirection |
32+ | ** Custom CC** | Module | Randomly assigns non-standard calling conventions to internal functions |
33+ | ** Merge Function** | Module | Merges multiple functions into a single switch-based dispatcher |
34+
2035## Prerequisites
2136
2237- ** Python 3.12+**
@@ -46,15 +61,45 @@ Six obfuscation passes are available:
4661
4762## Usage
4863
64+ Pluto passes:
65+
66+ ``` python
67+ from shifting_codes.passes import PassPipeline
68+ from shifting_codes.passes.substitution import SubstitutionPass
69+ from shifting_codes.passes.mba_obfuscation import MBAObfuscationPass
70+ from shifting_codes.passes.bogus_control_flow_pluto import PlutoBogusControlFlowPass
71+ from shifting_codes.passes.flattening_pluto import PlutoFlatteningPass
72+ from shifting_codes.passes.global_encryption_pluto import PlutoGlobalEncryptionPass
73+ from shifting_codes.passes.indirect_call_pluto import PlutoIndirectCallPass
74+ from shifting_codes.utils.crypto import CryptoRandom
75+
76+ rng = CryptoRandom(seed = 42 )
77+
78+ pipeline = PassPipeline()
79+ pipeline.add(SubstitutionPass(rng = rng))
80+ pipeline.add(MBAObfuscationPass(rng = rng))
81+ pipeline.add(PlutoBogusControlFlowPass(rng = rng))
82+ pipeline.add(PlutoFlatteningPass(rng = rng))
83+ pipeline.add(PlutoGlobalEncryptionPass(rng = rng))
84+ pipeline.add(PlutoIndirectCallPass(rng = rng))
85+
86+ pipeline.run(mod, ctx)
87+ ```
88+
89+ Polaris passes:
90+
4991``` python
50- import llvm
5192from shifting_codes.passes import PassPipeline
5293from shifting_codes.passes.substitution import SubstitutionPass
5394from shifting_codes.passes.mba_obfuscation import MBAObfuscationPass
5495from shifting_codes.passes.bogus_control_flow import BogusControlFlowPass
5596from shifting_codes.passes.flattening import FlatteningPass
5697from shifting_codes.passes.global_encryption import GlobalEncryptionPass
5798from shifting_codes.passes.indirect_call import IndirectCallPass
99+ from shifting_codes.passes.indirect_branch import IndirectBranchPass
100+ from shifting_codes.passes.alias_access import AliasAccessPass
101+ from shifting_codes.passes.custom_cc import CustomCCPass
102+ from shifting_codes.passes.merge_function import MergeFunctionPass
58103from shifting_codes.utils.crypto import CryptoRandom
59104
60105rng = CryptoRandom(seed = 42 )
@@ -66,8 +111,11 @@ pipeline.add(BogusControlFlowPass(rng=rng))
66111pipeline.add(FlatteningPass(rng = rng))
67112pipeline.add(GlobalEncryptionPass(rng = rng))
68113pipeline.add(IndirectCallPass(rng = rng))
114+ pipeline.add(IndirectBranchPass(rng = rng))
115+ pipeline.add(AliasAccessPass(rng = rng))
116+ pipeline.add(CustomCCPass(rng = rng))
117+ pipeline.add(MergeFunctionPass(rng = rng))
69118
70- # Apply to a module
71119pipeline.run(mod, ctx)
72120```
73121
0 commit comments