OLLVM-Next (Ensia)

⚠️ ETHICAL USE WARNING: This is a high-strength industrial compiler obfuscation tool. Please read our Ethics & Disclaimer Notice before use.

OLLVM-Next (Ensia) is a modern, high-resilience LLVM-based compiler obfuscation framework. Continuing the lineage of the Hikari, Hikari-LLVM15, and Hikari-LLVM19 projects, Ensia completely redesigns the core transformation engine for modern LLVM toolchains (LLVM 21+, including LLVM 21, 22, and 23+).

Ensia supports cross-platform code protection across Linux, Windows (MSVC, clang-cl, MinGW), macOS, iOS, and Android, with first-class architecture support for x86_64, AArch64 (ARM64), and i386.

Traditional VM-based obfuscators (Virtualizers) encapsulate target logic within a custom interpreter loop. While difficult to inspect by hand, they introduce a catastrophic Single Point of Failure (SPOF): once an analyst devirtualizes the bytecode opcode dispatch table or extracts the central interpreter handler loop, all protected routines collapse at once.

Ensia completely rejects single-point interpreter designs. Instead, it enforces Non-Linear SMT / Symbolic Solver State-Space Explosion and Dynamic Taint Analysis (DTA) Neutralization through an interleaved composition of distributed passes:

1. Non-Linear Cascading Pipeline: Passes are scheduled in a strict 12-stage non-linear sequence where each pass transforms and multiplies the entropy generated by previous passes.
2. Branchless Algebraic State Transitions: Control Flow Flattening (CFF) and Chaos State Machines (CSM) eliminate volatile memory markers and naked select branches, binding state updates directly to condition bitmasks and stateful contextual barriers.
3. Stateful Contextual Barriers: Static barrier signatures are completely eliminated. Barriers are dynamically derived from runtime state (stack canary %fs:0x28 / %gs:0x14, stack alignment masks %rsp & 15, Thread Control Block self-pointers, and ARM64 tpidr_el0), backed by isolated per-barrier stack allocations to guarantee zero spill corruption.
4. 3-Tier Anti-Taint & Data-Flow Entanglement: Neutralizes dynamic taint analysis engines (Triton, BAP, angr) via indirect Identity LUTs, implicit control-flow bit laundering, and SIMD vector lane diffusion.
5. Memory-Dump Resistance (Anti-Dump): Plaintext buffers from String Encryption are automatically zeroized at function exits (ReturnInst / ResumeInst) using isVolatile memory scrubbing and atomic status locks, with decryption stubs tagged synthetic to eliminate MBA blowup.
6. Triple-Scheme Constant Encryption: Combines Bivariate MBA, 4-round Feistel non-linear networks, and dynamic anti-debug token (adb.tok) entanglement without combinatorial code bloat.

Ensia schedules passes to maximize cascading complexity. Each pass treats the obfuscated output of previous passes as input, creating an exponential barrier to symbolic deobfuscation:

 1. AntiHooking & AntiClassDump     -> Dual-defense AntiHook (Entry Prologue Guard + Scattered In-Flight Auditing + Embedded Integrity Self-Check with Data-Flow Entanglement), direct syscalls, dynamic execution tokens (T_env), ObjC metadata scrambling
 2. FunctionWrapper                 -> Generates polymorphic proxy trampolines around entry points (argument XOR shuffling, frame depth mutation, return masking)
 3. FunctionCallObfuscate (FCO)     -> Eliminates direct imports via dlopen/dlsym runtime resolution inside callers and proxies
 4. AntiDebugging                   -> Injects ptrace, hardware breakpoint (DR0-7), TF single-step probes, violent exit handler
 5. StringEncryption                -> Encrypts global strings with GF(2^8) stubs & injects volatile exit zeroizers
 6. ConstantEncryption (Phase 1)    -> Encrypts original programmer literals before CFG transformations
 7. Per-Function Transformation Loop:
    ├── 7a. Substitution (Sub)      -> Arithmetic expansions (x + y -> algebraic identities)
    ├── 7b. MBA Obfuscation         -> Multivariate non-linear boolean-arithmetic + polymorphic hardware barriers
    ├── 7c. Split Basic Blocks      -> Slices basic blocks, cutting MBA expressions across blocks + stack confusion
    ├── 7d. Bogus Control Flow (BCF)-> Injects opaque hardware predicates & clones split blocks into loops
    ├── 7e. Chaos State Machine (CSM)-> Replaces CFG topology with logistic-map quadratic chaotic dispatch
    ├── 7f. Classic Flattening (CFF)-> Fallback CFF with branchless algebraic masking for functions skipped by CSM
    └── 7g. Vector Obfuscation (Vec)-> Lifts remaining scalar logic & dispatch state into SIMD vector space
 8. ConstantEncryption (Phase 2)    -> Encrypts state constants & jump keys generated by BCF/CSM/CFF
 9. IndirectBranch                  -> Encrypts jump targets via Knuth multiplicative hashing into jump tables
10. Cleanup Markers                 -> Erases temporary compiler sentinel declarations (ensia_*) before symbol scrambling
11. FeatureElimination              -> Strips DWARF metadata, anonymizes TU path to "a", drops llvm.ident, clears COMDATs, internalizes ODR linkages, scrambles private/internal symbols (_f<hex>, _v<hex>, _a<hex>)
12. LTO Evasion                     -> Stamps functions with Attribute::OptimizeNone and Attribute::NoInline

Traditional CFF relies on store volatile on a switch state variable. Once an attacker strips volatile, compiler passes (opt -O3, sccp, simplifycfg) unflatten the switch instantly. Ensia implements pure branchless algebraic masking:

// Bitwise equivalent (Zero-SPOF branchless state transition in LLVM IR):
uint32_t condExt     = (uint32_t)cond;                         // 0 or 1
uint32_t mask        = 0 - condExt;                            // 0x00000000 or 0xFFFFFFFF
uint32_t diff        = caseTrue ^ caseFalse;
uint32_t nextState   = caseFalse ^ (mask & diff);              // branchless state select
uint32_t opaqueState = insertOpaqueBarrier(nextState);         // polymorphic hardware barrier

Even with all volatile keywords maliciously stripped from the IR, opt -O3 fails to eliminate the dispatch switch (100% switch retention).

The static asm sideeffect "xorb $0, $0" signature has been replaced by a randomized 9-variant x86 instruction family (orb, andb, addb, subb, rolb, rorb, incb/decb, notb/notb) and 4 ARM64 pipeline barriers (prfm pldl1keep, prfm pstl1keep, prfm pldl2keep, isb sy, dmb ishld). Uniform signature and YARA rule detection is completely defeated.

• Tier 1 (Global Identity LUT): Dereferences bytes through indirect memory pointers (BytePtr = GEP(LUT, BarrieredByte); load volatile), severing register-level ALU dataflow edges.
• Tier 2 (Implicit Control-Flow Bit Laundering): Reconstructs all 8 bits using select(bit_test, 1 << bit, 0) over pure constants. Because Dynamic Taint Analysis engines do not propagate taint across constant control dependencies, taint tags are sanitized.
• Tier 3 (SIMD Vector Diffusion): Packs values into <4 x i32> / <2 x i64> vectors, mixes with entropy tokens, permutes lanes via shufflevector, and unpacks under polymorphic barriers, defeating scalar register trackers (Triton / angr).

Decrypted strings do not persist in memory. At function returns (ReturnInst) and exception unwinds (ResumeInst), an inlined isVolatile memset zeroizes the plaintext buffer, and the atomic status lock is reset (release ordering). Memory snapshots taken post-execution reveal only \x00\x00....

Ensia deploys a multi-tier hook detection and memory integrity defense architecture:

• Entry Prologue Guard: Embedded directly in the function entry block, inspecting the function start against classic and modern hook sequences: 1-byte opcodes (0xE9 JMP rel32, 0xEB short JMP, 0xCC INT3, 0x68 PUSH imm32, 0xF1 ICEBP), 2-byte opcodes (0x48 0xB8 MOVABS RAX, 0x8B 0xFF MOV EDI,EDI hotpatch, 0x90 0x90 double NOP sled, 0x0F 0x0B UD2, 0xCD 0x03 INT 3), 64-bit RIP-relative indirect jumps (0xFF 0x25 JMP [RIP+disp32]), and AArch64 branches (0x14000001 B .+4, BRK, LDR x16/x17).
• Scattered In-Flight CFG Auditing: Injects random runtime audits across non-EH interior basic blocks. If an attacker uses a trampoline hook that bypasses the entry guard and jumps past the prologue, executing interior basic blocks re-audits the function head (F[0], F[1]). All check sites branch to a single consolidated cold handler with violent exit, eliminating register pressure and preserving LLVM exception-handling invariants.
• Embedded Integrity Self-Check with Data-Flow Entanglement (check_integrity): Cryptographic checksums of code pages are coupled directly into function execution tokens (T_env / T_exp). Any in-memory tampering or breakpoint patching silently corrupts downstream program state, avoiding obvious exception breakpoints.
• Direct Syscall Bypass (direct_syscall): Bypasses userland libc hooks via direct kernel system calls (svc #0 / syscall).

Tested against aggressive deobfuscation pipelines (opt -passes='default<O3>' and opt -passes='sccp,simplifycfg,instcombine,dce,gvn'):

# 1. Automatic configuration discovery (loads ./ensia.toml if present in current directory):
clang -fpass-plugin=/path/to/libEnsia.so -O2 main.c -o main

# 2. Explicit configuration via environment variable:
ENSIA_CONFIG=/path/to/ensia.toml \
clang -fpass-plugin=/path/to/libEnsia.so -O2 main.c -o main

# 3. Quick preset selection via environment variable:
ENSIA_PRESET=mid \
clang -fpass-plugin=/path/to/libEnsia.so -O2 main.c -o main

# 4. Frontend plugin invocation with -mllvm option parsing:
clang -Xclang -load -Xclang /path/to/libEnsia.so \
  -mllvm -ensia-config=ensia.toml \
  -O2 main.c -o main

# Build binary crate with Ensia Rust plugin (auto-discovers ./ensia.toml):
ENSIA_CONFIG=ensia.toml RUSTC_BOOTSTRAP=1 \
RUSTFLAGS="-Z llvm-plugins=/path/to/libEnsia_rust.so -C passes=ensia" \
cargo build --release

Search order: -mllvm -ensia-config=<path> > ENSIA_CONFIG=<path> > ./ensia.toml.

[global]
preset = "mid"            # "low" | "mid" (recommended) | "high" | "max" | "csm_vec"
verbose = false           # Print transformation logs to stderr
trace = false             # Emit step-by-step scheduler checkpoints
demangle_names = true     # Demangle C++ / Rust function symbols in logs

# ── 15 Configurable Passes (supports canonical names & short aliases) ──────────
[passes.bcf]
enabled = true
probability = 60          # Block selection probability (0–100)
iterations = 1           # BCF loop iterations (1–5)
complexity = 4           # Opaque predicate depth (1–10)
entropy_chain = true     # Chain hardware predicates (CPUID, RDTSC/CNTPCT)
junk_asm = true          # Inject polymorphic hardware inline-ASM barriers
junk_asm_min = 2
junk_asm_max = 6

[passes.constant_encryption]  # alias: [passes.const_enc]
enabled = true
iterations = 1
share_count = 3          # Bivariate MBA additive split shares (2–8)
feistel = true           # 4-round non-linear Feistel cipher network
substitute_xor = true    # MBA expansion of recombination XORs
force_value = ["^0x9E3779B9$", "^0xDEADBEEF$"]
skip_value = ["^0x0$", "^0x1$"]

[passes.string_encryption]    # alias: [passes.str_enc]
enabled = true
probability = 100
anti_dump = true          # Volatile memory zeroization at function exits
force_content = [".*key.*", ".*secret.*", ".*token.*"]
skip_content = ["^%[0-9]*[a-zA-Z]$", "^PASS$", "^FAIL$"]

[passes.substitution]         # alias: [passes.sub]
enabled = true
probability = 60
iterations = 1

[passes.mba]
enabled = true
probability = 50
layers = 2
heuristic = true         # Zero-noise identity verification

[passes.split_blocks]         # alias: [passes.split]
enabled = true
splits = 3               # Slice points per basic block
stack_confusion = true   # Push/pop or str/ldr stack desynchronization

[passes.chaos_state_machine]  # alias: [passes.csm]
enabled = true
warmup = 128             # Q32 logistic map transient warmup iterations
nested_dispatch = false  # Hierarchical 2-level cluster dispatch
max_blocks = 5000

[passes.flattening]           # alias: [passes.cff]
enabled = false          # Fallback CFF with branchless algebraic masking

[passes.vector_obfuscation]   # alias: [passes.vec]
enabled = true
probability = 40
width = 128              # 128 (SSE/NEON), 256 (AVX2), 512 (AVX-512)
shuffle = true           # Random bijective shufflevector permutations
lift_comparisons = true

[passes.indirect_branch]      # alias: [passes.indir]
enabled = true
use_stack = true
enc_jump_target = true   # Knuth multiplicative modular inverse hashing

[passes.function_wrapper]     # alias: [passes.fw]
enabled = false
probability = 50
times = 1

[passes.function_call_obfuscate] # alias: [passes.fco]
enabled = false
flag = 0
symbol_config_path = ""  # Path to external symbol import JSON config

[passes.anti_hooking]         # alias: [passes.anti_hook]
enabled = true
inline_x86 = true        # E9 / 48 B8 prologue integrity scans
inline_aarch64 = true    # 0x14000001 (B .+4) inline hook scans
inline_win = true        # Windows API inline hook detection
direct_syscall = true    # Direct kernel syscall bypass (svc #0 / syscall)
antirebind = true        # Counter dynamic linker symbol rebinding
check_integrity = true   # Embedded code segment cryptographic self-checks
precompiled_ir_path = "" # Path to external precompiled LLVM IR defense stubs

[passes.anti_debugging]       # alias: [passes.anti_dbg]
enabled = true
probability = 80         # Hardware debug registers DR0-7, EFLAGS.TF single-step probes
precompiled_ir_path = "" # Path to external precompiled LLVM IR defense stubs

[passes.anti_class_dump]      # alias: [passes.anti_acd]
enabled = false          # Objective-C / Swift metadata scrambling (macOS / iOS)
use_initialize = true
rename_methodimp = true
scramble_methods = true
dummy_selectors = false
dummy_count = 8
encrypt_strings = true   # Dynamic stack string decryption
anti_hook = true         # Objective-C runtime hook detection
opaque_barriers = true   # Memory barriers on runtime pointers

# ── Granular per-module / per-function regex policy overrides ──────────────────
[[policy]]
module_regex = ".*crypto.*"
function_regex = ".*(encrypt|decrypt|sign|verify).*"
preset = "high"
passes.chaos_state_machine.nested_dispatch = true
passes.constant_encryption.feistel = true
passes.constant_encryption.share_count = 4
passes.mba.layers = 3
passes.anti_debugging.probability = 100
passes.anti_hooking.direct_syscall = true

[[policy]]
module_regex = ".*"
function_regex = "^(main|fast_path_.*)$"
passes.bcf.enabled = false
passes.chaos_state_machine.enabled = false
passes.flattening.enabled = false

• CMake 3.20+
• Ninja or Make
• LLVM & Clang (version 21, 22, or 23)
• Rust toolchain (optional, for libEnsia_rust.so and web)

git clone https://github.com/Apich-Organization/ensia.git
cd ensia
cmake -B build -G Ninja -DCMAKE_BUILD_TYPE=Release
cmake --build build -j$(nproc)

Outputs:

• build/obfuscation/libEnsia.so (Clang plugin)
• build/obfuscation/libEnsia_rust.so (Rustc plugin)

mkdir build && cd build
cmake .. -G Ninja -DCMAKE_BUILD_TYPE=Release -DLLVM_DIR="C:/path/to/llvm/lib/cmake/llvm"
ninja Ensia

To run the automated verification suite:

bash test/run_obf_tests.sh

This project is licensed under the AGPL-3.0. It includes code and concepts continuing the lineage of Hikari and LLVM. See LEGAL.md for full details on project history and original authors.

We welcome sponsorships supporting open-source compiler security research. Please review our Sponsorship Policy for details on fund allocation, contribution options via Open Collective, and corporate tiers.

• Open Collective: https://opencollective.com/apich-organization

Please consult CODE_OF_CONDUCT.md and SECURITY.md for vulnerability reporting guidelines and ethical standards.