Encode Literals

Obfuscate integer and/or string literals (such as 42 or "42"). Literal integers can be replaced with opaque expressions, which requires that the InitOpaque transformation has been previously issued. Literal strings can be replaced with code that rebuilds them at runtime, so the readable text no longer appears in the generated source or the compiled binary. Use --EncodeLiteralsStringKinds to choose how; see Encoding strings below.

OptionArgumentsDescription
--Transform EncodeLiterals Replace literal integers and strings with less obvious expressions.
--EncodeLiteralsKinds integer, string, * Specify the types of literals to encode Default=integer,string.
  • integer = Replace literal integers with opaque expressions
  • string = Replace literal strings with calls to a function that generates them
  • * = Same as integer,string
--EncodeLiteralsEncoderName string The name of the generated encoder function (only for encoded strings). Default=None.
--EncodeLiteralsMaxLevel INTSPEC How deep to recurse into split integer expressions. Default=100.
--EncodeLiteralsMaxTransforms INTSPEC How many transformations to perform on each split integer expression. Default=100.
--EncodeLiteralsIntegerKinds opaque, split Specify how to encode integer literals. Default=opaque.
  • opaque = Replace literal integers with opaque expressions
  • split = Replace literal integers by splitting into subparts, and then doing EncodeArithmetic on them.

Regions

You can apply this transformation to a part of a function. First, include tigress.h as usual, then enclose the regions you want to transform using the ENCODE_INTEGER_BEGIN and ENCODE_INTEGER_END macros: 


void foo () {  
   ...

   ENCODE_INTEGER_BEGIN(obfuscateThis);

   int x = 1234567;

   ENCODE_INTEGER_END(obfuscateThis);

   ...

   ENCODE_INTEGER_BEGIN(obfuscateThat);

   int y = 7654321;

   ENCODE_INTEGER_END(obfuscateThat);

   ...
}

The arguments to the macros (obfuscateThis and obfuscateThat) are tags that you specify in the -Regions=... option in your tigress command: 

tigress ... \
   --Transform=EncodeLiterals \
      --Functions=foo \
      --Regions=obfuscateThis,obfuscateThat \
      --EncodeLiteralsIntegerKinds=split \
   ...

 

Encoding strings

OptionArgumentsDescription
--EncodeLiteralsStringKinds fsm, chunk, * How to encode string literals. When you list several, one is chosen at random each run. Default=fsm.
  • fsm = Rebuild each string at runtime with a generated decoder function.
  • chunk = Encode each string in small pieces, so no readable text remains in the generated source or the compiled binary.
  • * = Same as fsm,chunk

For example, to encode strings so no readable text remains in the output: 

tigress ... \
   --Transform=EncodeLiterals \
      --Functions=main \
      --EncodeLiteralsKinds=string \
      --EncodeLiteralsStringKinds=chunk \
   ...

 

Issues

The generated string decoder is deliberately simple. To make it less conspicuous, transform it further — for example with Virtualize (to hide the string contents) and RndArgs (to hide the interface). This matters especially with chunk: without a following transform, a compiler's optimizer may fold the decoding back to the original string.