Skip to content

Home

Jump to bottom
Fatih Burak Karagöz edited this page Jun 7, 2026 · 2 revisions

Nightmare Obfuscator

Nightmare Obfuscator is a defensive IP-protection tool for controlled collaboration. It helps a project owner share a working obfuscated copy of a Rust project while keeping the original source private and retaining provenance metadata for the shared artifact.

The project is not a malware-evasion tool, not a DRM system, and not a source recovery system. V1 is intentionally narrow: it focuses on build-preserving Rust obfuscation and artifact integrity.

What It Does

Nightmare creates a copied project directory and transforms selected Rust source files inside that copy. Build files, tests, assets, docs, and unselected files are preserved so the recipient can run the project without needing a runtime key.

Each obfuscated output includes a metadata vault:

.nightmare/manifest.json
.nightmare/signature

The manifest records:

  • tool version and session ID
  • creation timestamp
  • owner and project metadata
  • selected paths and ignored patterns
  • checksums before and after obfuscation
  • which files were obfuscated
  • an obfuscation configuration hash

The signature and checksums are used by nightmare verify to detect tampering. They are for provenance and integrity, not for unlocking or restoring the original source.

V1 Scope

Supported in v1:

  • Rust source files
  • full-project copy behavior
  • selected-path obfuscation with --select
  • default sibling output named <project>-obfs
  • ignored directories such as .git, target, dependency folders, and .nightmare
  • build-preserving local identifier obfuscation
  • build-safe dead-code insertion
  • metadata vault creation
  • artifact verification

Not supported in v1:

  • general support for every language
  • deobfuscation
  • encrypted original-source recovery
  • runtime key enforcement
  • build-preserving string encryption
  • strong asymmetric signing

Other languages are roadmap work. They should not be advertised as supported until each language has syntax-aware transforms, fixture projects, and original-versus-obfuscated build tests.

Typical Workflow

Build the CLI:

cargo build --release

Obfuscate an entire Rust project:

nightmare obfuscate ./my-rust-project

This creates:

./my-rust-project-obfs

Obfuscate only selected paths while copying the rest of the project unchanged:

nightmare obfuscate ./my-rust-project --select src/core --select src/engine.rs

Write to an explicit output directory:

nightmare obfuscate ./my-rust-project --output ./partner-drop

Verify a delivered artifact:

nightmare verify ./partner-drop

Inspect the metadata vault:

nightmare vault ./partner-drop

Why Full-Project Copying Matters

Obfuscating only source files is not enough for practical collaboration. A recipient usually needs build configuration, tests, feature flags, assets, schemas, examples, and documentation. Nightmare copies the whole project first, then obfuscates only the supported Rust files that are in scope.

When --select is omitted, all supported Rust source files under the input are obfuscated. When --select is present, selected Rust files or directories are obfuscated and unselected files are copied byte-for-byte.

Security Model

The owner keeps the original repository. The shared output is a working, obfuscated copy.

The .nightmare metadata vault helps answer:

  • Was this artifact produced by Nightmare?
  • Which files were obfuscated?
  • Were files changed after the artifact was created?
  • What configuration hash and tool version produced it?
  • Which owner/project metadata was embedded?

The vault does not answer:

  • How do I recover the original source?
  • How do I decrypt hidden source code?
  • How do I restrict runtime execution?

Those are outside v1.

Validation Performed

The current v1 implementation has been validated with:

cargo fmt --check
cargo clippy --workspace --all-targets -- -D warnings
cargo test --workspace

It was also smoke-tested against a real open-source Rust crate:

  • crate: hex v0.4.3
  • original cargo test: passed
  • obfuscated cargo test: passed
  • nightmare verify: passed

Known Limitations

The current Rust obfuscator is conservative by design. It avoids renaming public APIs, imports, macros, derives, attributes, field accesses, and strings in ways that would commonly break builds. This means the output is not maximally obfuscated yet, but it is more suitable for a v1 collaboration tool.

String encryption is disabled because the previous approach was not build-preserving. It should return only after it can be proven across fixtures and real projects without hidden runtime dependencies.

The current manifest signature detects tampering, but it is not yet a real asymmetric owner signature. Replacing it with Ed25519 or another appropriate asymmetric scheme is tracked as follow-up work.

Roadmap

Follow-up work is tracked in GitHub Issues:

  • real asymmetric metadata signatures
  • post-v1 language support
  • build-preserving string encryption
  • stable config file schema
  • automated real-project smoke-test matrix
  • branch protection and release workflow

Project Governance

Nightmare Obfuscator is open source under the repository license. main is the stable/release branch and dev is active integration. Contributions should keep the product aligned with defensive IP sharing and build-preserving behavior.

Clone this wiki locally