BTG-packer v1.0.2

BTG-packer v1.0.2

This release introduces comprehensive anti-recovery hardening, retires original executable code and exception unwind records, and expands VM exposure metrics and section camouflage.

Changes

• Completely retired original .text executable bytes and .pdata unwind records from protected PE outputs.
• Added at-rest encryption and dynamic boot-stub decryption for string literals referenced by virtualized entrypoints.
• Added configurable section name camouflage (--camouflage) supporting standard PE, benign compiler, and randomized naming schemes.
• Hardened commercial VM native island transitions, ABI bridges, and Win64 SEH / C++ exception unwind handling.
• Hardened distributed integrity metadata by removing fixed BTGI magic, adding build-local nonce headers, masking descriptor fields, and permuting record order.
• Added automated VM exposure and reverse-engineering risk metrics (src/analysis/vm_exposure.rs) to quantify dispatcher leakage and recoverable entrypoints.
• Synchronized CLI version reporting and runtime startup banners with CARGO_PKG_VERSION.
• Updated English and Korean documentation to align with current implementation and configuration options.

Validation

• Windows x86-64 release build completed successfully.
• Full library test suite completed with 789/789 tests passing (0 failed, 0 ignored).
• Verified protected PE execution with ChaCha20-Poly1305 encryption, IAT hiding, payload relocation, and W^X memory hardening.
• Confirmed output binaries contain no original plaintext .text bytes and preserve valid loader structures across all data directories.

Known limitation

The commercial whole-program VM mode (--vm-commercial) with complex re-entrant C++ exception catch continuation unwinding remains under active optimization. Standard and intermediate VM protection profiles (--vm, --vm-oep) are fully supported for production usage.

BTG-packer is intended for software you own or are authorized to transform and analyze.

BTG-packer v1.0.1

BTG-packer v1.0.1

This maintenance release stabilizes commercial multi-family Program-VM execution and substantially reduces the on-disk size of protected images.

Changes

• Fixed cross-family guest-state, stack, return, exception, and native-bridge synchronization.
• Added family-specific route layout propagation for commercial multi-family transitions.
• Moved large VM state and host-stack reservations to loader-backed zero-fill .vstate storage.
• Split file-backed bootstrap metadata into .vmeta, preserving ChaCha20/Poly1305 tags and integrity state.
• Reduced the full commercial test image from approximately 211.5 MiB to 7.37 MiB.
• Removed plaintext canonical route records from final images. .vmroute now contains only a per-build keyed 32-byte commitment.
• Added final-image validation that rejects plaintext route records, modified commitments, and inconsistent route inventories.

Validation

• Windows x86-64 release build completed successfully.
• Full commercial test profile packed successfully with ChaCha20, integrity, payload relocation, IAT hiding, M8, and multi-family Program-VM enabled.
• Protected test executable completed 10/10 repeated runs with exit code 0 and checksum 0x68a0a62af7498e1.
• Confirmed the final image contains no VMROUTE magic or serialized route records.

Known limitation

The commercial pre-entry TLS lifecycle gateway is currently attach-neutral and does not yet virtualize arbitrary original TLS callback bodies. Targets that depend on custom TLS callback side effects require additional compatibility work.

BTG-packer is intended for software you own or are authorized to transform and analyze.

BTG-packer v1.0.0

BTG-packer v1.0.0

First public release of BTG-packer, a Rust-based Windows x86-64 PE transformation and program-virtualization framework.

This release brings together the native CFG transformation pipeline, the RISC-based Program-VM backend, runtime protection features, PE reconstruction, and post-build verification into a single toolchain.

Note

BTG-packer is still a research project. Compatibility may vary depending on the compiler, PE layout, exception/unwind usage, TLS layout, indirect control flow, and instruction patterns present in the target binary.

Highlights

Program-VM Backend

The Program-VM pipeline can lift supported x86-64 code into an internal RISC representation and compile it into generated VM bytecode.

The current pipeline includes:

• x86-64 → RISC lifting

• Function-level VM ownership analysis

• Per-build virtual opcode generation

• Virtual register permutation

• Operand and branch-condition encoding

• Rolling-key bytecode

• Native threaded VM handlers

• Cross-family VM transitions

• Native/VM bridging

• Super-operator support

Four VM family profiles are currently defined:

• Stack

• Register

• MixedRisc

• FusedCisc

Functions can be assigned to different VM families during a build while using a canonical state representation for cross-family transitions.

Native PE Transformation

The native transformation path includes:

• PE32+ parsing and reconstruction

• CFG and basic-block discovery

• Block slicing and layout shuffling

• RIP-relative reference rewriting

• Branch fixups

• Relocation reconstruction

• Resource handling

• Import handling

• Exception / .pdata handling

• Transformed section generation

Runtime Protection

v1.0.0 includes the following optional runtime protection layers:

• Integrity verification

• Runtime IAT reconstruction

• Memory permission hardening

• Payload relocation

• RT_RCDATA payload registration

• M7 runtime data-lifetime protection

• M8 VM handler-table concealment

• Anti-debug policies

• Native dispatcher re-encryption

Cryptographic components currently include:

• BTG-C1

• ChaCha20

• Poly1305

• SHA-256

• Keyed integrity tags

RC4 is no longer available as a production crypto mode.

---

Validation

A major focus of this release is detecting broken transformations before treating an output as valid.

BTG-packer performs post-build validation of the generated PE and can verify that requested protection features were actually materialized.

Use:

--verify-output

to execute both the original and protected program and compare:

• Exit code

• stdout

• stderr

Any difference causes verification to fail.

Multi-seed verification is also available:

--verify-seeds N

This repeats the build and execution verification process across multiple deterministic seeds.

Commercial Program-VM builds additionally track measured VM coverage across:

• Functions

• Basic blocks

• Instructions

---

Diagnostic Output

Depending on the selected options, BTG-packer can generate:

<output>.btgmanifest
<output>.ownership.csv
<output>.map
<output>.sym
<output>.riscmap.csv

These files are intended for development, debugging, and transformation analysis.

Warning

Diagnostic artifacts may expose internal VM mappings, ownership information, and transformation details. They should generally not be distributed with protected binaries.

---

Example

A Program-VM build can be created with:

btg-packer.exe `
  --input app.exe `
  --output app.protected.exe `
  --vm `
  --vm-oep `
  --vm-commercial `
  --m7 `
  --m8 `
  --mem-harden `
  --iat-hide `
  --integrity `
  --payload-relocate `
  --rsrc-register `
  --crypto-mode c1 `
  --crypto-coverage 100 `
  --anti-debug `
  --verify-output `
  --seed 31010

For development, it is usually better to start with a smaller protection profile and enable additional layers after the target passes execution verification.

---

Build from Source

Requires a Rust toolchain and a Windows x86-64 build environment.

cargo build --release
cargo test --all-targets

The release binary is generated at:

target\release\btg-packer.exe

---

Release Assets

File | Description -- | -- BTG-packer-v1.0.0-windows-x86_64.zip | Packaged Windows x86-64 release btg-packer.exe | Standalone packer executable Source code (zip) | Source archive generated by GitHub Source code (tar.gz) | Source archive generated by GitHub

---

Known Limitations

This is the first public release and there are still compatibility limits.

Current limitations include:

• Windows x86-64 PE32+ is the primary target.

• Some functions may remain native when safe VM ownership cannot be established.

• Exception/unwind handling remains sensitive to compiler-generated layouts.

• TLS layouts may require special handling when runtime data resides in zero-filled virtual ranges.

• Indirect calls, indirect jumps, switch tables, and unresolved internal edges can affect whole-program VM coverage.

• Unusual PE layouts may still expose reconstruction edge cases.

• Whole-program Program-VM builds require complete measured coverage unless partial coverage is explicitly enabled for development.

• BTG-C1 is a project-specific research primitive and has not undergone independent cryptographic review.

• Passing structural validation does not guarantee compatibility with every Windows binary.

• A successful protection build does not imply resistance against all forms of reverse engineering.

• BTG-packer does not claim equivalence to mature commercial software protectors.

---

Reporting Issues

When reporting a reproducible transformation failure or crash, please include:

• BTG-packer version

• Full command line

• Build seed

• Target compiler and optimization profile

• Relevant error output

• .btgmanifest

• .ownership.csv when Program-VM is involved

• Mapping files when available

Providing a deterministic --seed makes failures significantly easier to reproduce.

---

Notes

BTG-packer is intended for:

• Binary-transformation research

• Program-virtualization experiments

• Compiler and VM research

• PE transformation research

• Authorized reverse engineering

• Software you own or are authorized to modify

Important

Do not use BTG-packer to modify or protect software you do not own or do not have permission to analyze or transform.

See README.md for the complete architecture, CLI reference, implementation details, and usage documentation.

# BTG-packer v1.0.0

First public release of BTG-packer, a Rust-based Windows x86-64 PE transformation and program-virtualization framework.

This release brings together the native CFG transformation pipeline, the RISC-based Program-VM backend, runtime protection features, PE reconstruction, and post-build verification into a single toolchain.

Note

BTG-packer is still a research project. Compatibility may vary depending on the compiler, PE layout, exception/unwind usage, TLS layout, indirect control flow, and instruction patterns present in the target binary.

Highlights

Program-VM Backend

The Program-VM pipeline can lift supported x86-64 code into an internal RISC representation and compile it into generated VM bytecode.

The current pipeline includes:

• x86-64 → RISC lifting
• Function-level VM ownership analysis
• Per-build virtual opcode generation
• Virtual register permutation
• Operand and branch-condition encoding
• Rolling-key bytecode
• Native threaded VM handlers
• Cross-family VM transitions
• Native/VM bridging
• Super-operator support

Four VM family profiles are currently defined:

• Stack
• Register
• MixedRisc
• FusedCisc

Functions can be assigned to different VM families during a build while using a canonical state representation for cross-family transitions.

Native PE Transformation

The native transformation path includes:

• PE32+ parsing and reconstruction
• CFG and basic-block discovery
  ...