llvm-obfuscation
Expertise in LLVM-based code obfuscation techniques including OLLVM, control flow flattening, string encryption, virtualization, and anti-analysis methods. Use this skill when working on code protection, anti-reverse engineering, or implementing custom obfuscation passes.
- Installs
- 113
- Last 24h
- —
- Trending rank
- —
- Security
- Not audited
Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/gmh5225/awesome-llvm-security --skill llvm-obfuscation- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads llvm-obfuscation automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
SKILL.md
The instructions your agent reads when the skill is triggered.
LLVM Code Obfuscation Skill
This skill provides comprehensive knowledge of LLVM-based code obfuscation frameworks and techniques for software protection and anti-reverse engineering.
Core Obfuscation Techniques
Control Flow Obfuscation
- Control Flow Flattening (CFF): Transform structured control flow into a single dispatcher loop with state machine
- Bogus Control Flow (BCF): Insert opaque predicates and dead code paths
- CFG Randomization: Randomize basic block ordering and add fake edges
Data Obfuscation
- String Encryption: Encrypt string literals at compile-time, decrypt at runtime
- Constant Substitution: Replace constants with complex expressions
- Variable Splitting: Split variables into multiple components
Code Transformation
- Instruction Substitution: Replace standard instructions with equivalent complex sequences
- MBA (Mixed Boolean-Arithmetic): Use mixed boolean-arithmetic expressions for obfuscation
- Virtualization (VMP): Convert code into custom bytecode executed by embedded VM
Major OLLVM Frameworks
Classic OLLVM
- Original OLLVM: https://github.com/obfuscator-llvm/obfuscator
- Features: BCF, CFF, Instruction Substitution, String Encryption
Modern Variants
- Hikari: Advanced features including function wrapper, anti-class-dump
- Pluto-Obfuscator: Well-maintained with MBA, indirect branch, global encryption
- Arkari: Modern implementation with enhanced features
- o-mvll: Mobile-focused obfuscator for iOS/Android
Specialized Tools
- IR VMP: GANGE666/xVMP, NiTianErXing666/SmallVmp for virtualization
- Warbird: Microsoft's commercial obfuscation technology
Implementation Guidelines
Creating Custom LLVM Obfuscation Pass
#include "llvm/Pass.h"
#include "llvm/IR/Function.h"
#include "llvm/IR/Instructions.h"
class MyObfuscationPass : public llvm::FunctionPass {
public:
static char ID;
MyObfuscationPass() : FunctionPass(ID) {}
bool runOnFunction(llvm::Function &F) override {
// Implement obfuscation logic
for (auto &BB : F) {
for (auto &I : BB) {
// Transform instructions
}
}
return true;
}
};
Best Practices
- Preserve Semantics: Ensure transformations don't break program correctness
- Randomization: Use seeded random number generators for reproducible builds
- Layered Approach: Combine multiple obfuscation techniques
- Performance Balance: Consider runtime overhead vs protection level
- Testing: Extensive testing across different inputs and platforms
Toolchain Integration
NDK Integration
- OLLVM with Android NDK (r17-r23+)
- Examples: android-ndk-aarch64-host-LLVM6.0-Ollvm-Armariris
Compiler Toolchains
- ollvm-mingw: Windows cross-compilation
- ollvm-rust: Rust toolchain integration
- Swift integration: swift-Ollvm11
Anti-Deobfuscation Considerations
When implementing obfuscation:
- Consider resistance to symbolic execution (SymCC, KLEE)
- Add protection against pattern matching deobfuscators
- Implement anti-debugging checks
- Use dynamic dispatch to hinder static analysis
Resources
Refer to the main README.md for a comprehensive list of OLLVM implementations and related tools.
Getting Detailed Information
When you need detailed and up-to-date resource links, tool lists, or project references, fetch the latest data from:
https://raw.githubusercontent.com/gmh5225/awesome-llvm-security/refs/heads/main/README.md
This README contains comprehensive curated lists of:
- 80+ OLLVM implementations and forks (OLLVM section)
- MSVC Warbird obfuscation tools (MSVC Warbird section)
- IR-based VMP and virtualization projects
- NDK integration examples for different versions
FAQ
What does the llvm-obfuscation skill do?
Expertise in LLVM-based code obfuscation techniques including OLLVM, control flow flattening, string encryption, virtualization, and anti-analysis methods. Use this skill when working on code protection, anti-reverse engineering, or implementing custom obfuscation passes.
How do I install llvm-obfuscation?
Run npx skills add https://github.com/gmh5225/awesome-llvm-security --skill llvm-obfuscation in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/llvm-obfuscation/ (personal) or .claude/skills/llvm-obfuscation/ (project).
Which AI agents can use llvm-obfuscation?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is llvm-obfuscation safe to install?
No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.
Who maintains llvm-obfuscation?
It is published by gmh5225 in gmh5225/awesome-llvm-security. It has 113 recorded installs.
More from gmh5225/awesome-llvm-security
compiler-development
gmh5225/awesome-llvm-security
Expertise in compiler development using LLVM infrastructure including frontend design, IR generation, optimization passes, and code generation. Use this skill when building custom programming languages, implementing DSL compilers, or working on compiler internals.
binary-lifting
gmh5225/awesome-llvm-security
Expertise in binary lifting techniques - converting machine code to LLVM IR for analysis, decompilation, and recompilation. Use this skill when working on reverse engineering, binary analysis, deobfuscation, or converting binaries to higher-level representations.
llvm-optimization
gmh5225/awesome-llvm-security
Expertise in LLVM optimization passes, performance tuning, and code transformation techniques. Use this skill when implementing custom optimizations, analyzing pass behavior, improving generated code quality, or understanding LLVM's optimization pipeline.
llvm-learning
gmh5225/awesome-llvm-security
Comprehensive learning resources and tutorials for LLVM, Clang, and compiler development. Use this skill when helping users learn LLVM internals, find educational resources, or understand compiler concepts.
static-analysis
gmh5225/awesome-llvm-security
Expertise in LLVM-based static analysis including dataflow analysis, pointer analysis, taint tracking, and program verification. Use this skill when implementing security scanners, bug finders, code quality tools, or performing program analysis research.
mlir-development
gmh5225/awesome-llvm-security
Expertise in MLIR (Multi-Level Intermediate Representation) and CIR (Clang IR) development for domain-specific compilation and high-level optimizations. Use this skill when building ML compilers, domain-specific languages, or working with multi-level compilation pipelines.
Popular security skills
azure-compliance
microsoft/azure-skills
Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: compliance scan, security audit, BEFORE running azqr (compliance cli tool), Azure best practices, Key Vault expiration check, expired certificates, expiring secrets, orphaned resources, compliance assessment.
minimal-run-and-audit
lllllllama/rigorpilot-skills
Rigor Run skill for README-first deep learning repo reproduction. Use when the task is specifically to capture or normalize evidence from the selected smoke test or documented inference or evaluation command and write standardized reprooutputs/ files, including patch notes when repository files changed. Do not use for training execution, initial repo intake, generic environment setup, paper lookup, target selection, hidden scientific-meaning changes, or end-to-end orchestration by itself.
seo-audit
coreyhaines31/marketingskills
When the user wants to audit, review, or diagnose SEO issues on their site. Also use when the user mentions "SEO audit," "technical SEO," "why am I not ranking," "SEO issues," "on-page SEO," "meta tags review," "SEO health check," "my traffic dropped," "lost rankings," "not showing up in Google," "site isn't ranking," "Google update hit me," "page speed," "core web vitals," "crawl errors," "indexing issues," "stuck on page 2," "striking distance keywords," "title tag rewrite," "low CTR," "local SEO," "Google Business Profile," or "map pack." Use this even if the user just says something vague like "my SEO is bad" or "help with SEO" — start with an audit. For building pages at scale to target keywords, see programmatic-seo. For adding structured data, see schema. For AI search optimization, see ai-seo.
firebase-security-rules-auditor
firebase/agent-skills
Audits Firebase (Firestore, Cloud Storage) security rules for vulnerabilities, privilege escalation, role bypasses, create vs update inconsistencies, resource exhaustion, type safety, size limits, and hasOnly ownership checks. Use when auditing/reviewing rules, running red-team rule assessments, or scoring against auditor checklists. Don't use for Firebase CLI (login, deploy), Auth, Crashlytics, Remote Config, or database queries.
audit
pbakaus/impeccable
Run technical quality checks across accessibility, performance, theming, responsive design, and anti-patterns. Generates a scored report with P0-P3 severity ratings and actionable plan. Use when the user wants an accessibility check, performance audit, or technical quality review.
competitors
coreyhaines31/marketingskills
When the user wants to create competitor comparison or alternative pages for SEO and buyer-facing use. Also use when the user mentions 'alternative page,' 'vs page,' 'competitor comparison,' 'comparison page,' '[Product] vs [Product],' '[Product] alternative,' 'competitive landing pages,' 'how do we compare to X,' 'competitor teardown,' 'audit our competitor pages,' 'are our comparison pages out of date,' or 'competitive asset audit.' Use this for any content that positions your product against competitors. Covers four formats: singular alternative, plural alternatives, you vs competitor, and competitor vs competitor. For auditing existing claims (not researching competitors from scratch, which is competitor-profiling; not technical SEO on these pages, which is seo-audit), use the asset audit here. For internal battle cards and sales-specific competitor docs, see sales-enablement.