Ported Polaris-Obfuscator from C++/LLVM 16 to Python on LLVM 21.
9 passes: encrypted flattening, modular-arithmetic predicates, pointer mazes, function merging, and an X86 MIR pass that makes IDA's decompiler hallucinate variables that never existed.
https://t.co/eaQSD0ppKp
Shifting Codes — open-source LLVM obfuscation passes ported from Pluto/Polaris/riscy-business to Python via llvm-nanobind. 17 passes, PyQt6 UI, works with modern LLVM 21.
Blog post walking through Pluto obfuscations: https://t.co/BZWUrNopYD
GitHub: https://t.co/BhHd1G5xV5
@pentest_swissky@kmkz_security@two06 Great reading! Just curious what would you do if disassembly or just symbols would be several dozens of megabytes?
@CyberGhost13337 on x64 I think it's generally unavailable information, first 4 parameters are passed via registers, so as soon as you enter the function, optimizing compiler will do it's thing and then, in the middle of the function, you no longer have access to parameters
@spaceraccoonsec@nostarch just noticed a small error in ch1 about buffer overflow, my gcc on ubuntu shows "stack smashing detected" even without "-fstack-protector", to replicate intended behavior one would need to add "-fno-stack-protector"