Files
go-obfuscation/cmd/transformer/main.go
T
lukaszraczylo b6c3bacd23 Bug fixes, new transform passes, test coverage, and CI tooling
Bug fixes:
- pclntab/rtcorrupt_linux.go: remove duplicate mprotectRW/mprotectRO that
  broke GOOS=linux builds (they're defined in rtcorrupt_unsafe.go for
  darwin+linux).
- pclntab/pclntab.go: readUint now guards against negative offset
  (previously panicked via slice out-of-range).
- integrity/integrity.go: SetExpectedHashHex now validates length 64
  up-front and reports byte index on parse error; added ClearExpectedHash
  for runtime toggling and test isolation.
- transform/mba.go: mbaApplyBinOp used strings.Index on first match
  instead of the current match; replaced with FindAllStringSubmatchIndex
  + two-pass replacement.
- transform/transform.go: removed duplicate unconditional
  SplitLongStrings call.

New transform passes (CLI flags + Config fields + pipeline wiring):
- splice, constblind, mba, fakesigs, funcsplit, bbreorder — all
  default true.

Cleanup:
- strenc/keyderive.go: removed unused DeriveFromBinary + buildSeed.
- transform/transform.go: removed unused trimFirstParen.
- antidebug_hook_darwin.go: modernized readAddr to unsafe.Slice with
  noescape pattern (vet-safe).

Tests (10 packages, 116 tests, all green):
- internal/transform: 28 tests covering every pipeline stage.
- pkg/strenc: 7 tests for key derivation + XOR stream.
- pkg/stringcrypt: 7 tests for CFB round-trip + tamper detection.
- pkg/pageman: 14 tests for alignment + mprotect guards.
- pkg/integrity: 14 tests including ClearExpectedHash teardown.
- pkg/pclntab: 12 tests including readUint negative-offset guard.
- pkg/antisandbox: 6 tests for hostname/MAC lists + Check delegation.
- pkg/antiemul: 6 tests (1 skipped on non-Linux) for no-panic + timing.

Tooling:
- Makefile: added test, verify, lint, fmt, vet targets.
  vet uses -unsafeptr=false (only legitimate uintptr→pointer is the
  darwin antidebug hook). fmt skips build/ (generated).
- README.md: test coverage table + Makefile target reference.
2026-06-01 14:08:50 +01:00

97 lines
3.5 KiB
Go

package main
import (
"flag"
"fmt"
"os"
"path/filepath"
"time"
"github.com/lukaszraczylo/go-obfuscation/internal/transform"
)
func main() {
srcDir := flag.String("src", "", "Source directory to transform")
dstDir := flag.String("dst", "", "Destination directory for transformed source")
encryptStrings := flag.Bool("strings", true, "Encrypt string literals")
opaquePreds := flag.Bool("opaque", true, "Inject opaque predicates")
deadCode := flag.Bool("deadcode", true, "Inject dead code")
randomize := flag.Bool("randomize", true, "Randomize declaration order")
indirectDispatch := flag.Bool("indirect", true, "Indirect function dispatch")
bogusCFG := flag.Bool("bogus-cfg", true, "Bogus control-flow injection")
flatten := flag.Bool("flatten", true, "Control-flow flattening")
seed := flag.Int64("seed", 0, "Build seed for polymorphic output (0 = use current timestamp)")
injectBuildID := flag.Bool("buildid", true, "Inject unique build ID constant")
virtualizeVM := flag.Bool("vm", true, "Virtualize simple functions into VM bytecode")
antiDisasm := flag.Bool("anti-disasm", true, "Inject anti-disassembly patterns")
junkStrings := flag.Bool("junk-strings", true, "Inject junk string constants")
spliceCode := flag.Bool("splice", true, "Splice function bodies into fragments")
constBlind := flag.Bool("constblind", true, "Replace integer constants with XOR-decrypted expressions")
mba := flag.Bool("mba", true, "Apply Mixed Boolean-Arithmetic substitutions")
fakeSigs := flag.Bool("fakesigs", true, "Inject fake function signatures")
funcSplit := flag.Bool("funcsplit", true, "Split eligible functions into state-machine fragments")
bbReorder := flag.Bool("bbreorder", true, "Reorder basic blocks (swap if/else, shuffle switch cases)")
flag.Parse()
if *srcDir == "" || *dstDir == "" {
fmt.Fprintf(os.Stderr, "Usage: transformer -src <dir> -dst <dir>\n")
flag.PrintDefaults()
os.Exit(1)
}
if *seed == 0 {
*seed = time.Now().UnixNano()
}
absSrc, err := filepath.Abs(*srcDir)
if err != nil {
fmt.Fprintf(os.Stderr, "Invalid src path: %v\n", err)
os.Exit(1)
}
absDst, err := filepath.Abs(*dstDir)
if err != nil {
fmt.Fprintf(os.Stderr, "Invalid dst path: %v\n", err)
os.Exit(1)
}
config := transform.Config{
EncryptStrings: *encryptStrings,
InjectOpaquePreds: *opaquePreds,
InjectDeadCode: *deadCode,
RandomizeOrder: *randomize,
IndirectDispatch: *indirectDispatch,
BogusControlFlow: *bogusCFG,
FlattenControl: *flatten,
BuildSeed: *seed,
InjectBuildID: *injectBuildID,
VirtualizeFunctions: *virtualizeVM,
AntiDisassembly: *antiDisasm,
JunkStrings: *junkStrings,
SpliceCode: *spliceCode,
ConstantBlind: *constBlind,
ApplyMBA: *mba,
FakeSignatures: *fakeSigs,
FunctionSplit: *funcSplit,
ReorderBasicBlocks: *bbReorder,
}
t := transform.New(config)
fmt.Printf("[transformer] src=%s dst=%s\n", absSrc, absDst)
fmt.Printf("[transformer] seed=%d buildid=%v\n", config.BuildSeed, config.InjectBuildID)
fmt.Printf("[transformer] strings=%v opaque=%v deadcode=%v bogus=%v flatten=%v vm=%v antidisasm=%v junkstr=%v\n",
config.EncryptStrings, config.InjectOpaquePreds,
config.InjectDeadCode, config.BogusControlFlow, config.FlattenControl,
config.VirtualizeFunctions, config.AntiDisassembly, config.JunkStrings)
start := time.Now()
if err := t.TransformDir(absSrc, absDst); err != nil {
fmt.Fprintf(os.Stderr, "Transform failed: %v\n", err)
os.Exit(1)
}
fmt.Printf("[transformer] done in %v\n", time.Since(start))
}