Tigress

Tigress is a command-line obfuscator for C programs, best suited to researchers, students and software teams that can work directly with C source. Its range of transformations and target options give users meaningful control, but integrating it into a multi-file project and accepting possible runtime costs require care.

Overview

Tigress turns C source into new C source by applying sequences of transformations and options. A single input can yield multiple different outputs, making it useful when a protection strategy calls for varied builds rather than one fixed result. That flexibility is not a substitute for a security plan: the maker advises assessing the assets to protect, the available performance budget and the capabilities of likely adversaries before choosing techniques.

The principal workflow constraint is input structure. Tigress accepts one C file, so a multi-file program must be merged before transformation. Generated code can also be slow; the impact depends on the transformations and options selected, and huge programs are a particular concern. Those trade-offs make Tigress a better fit for deliberate protection work than for teams seeking an effortless addition to an existing build.

Key features

Transformation choices: Documented families cover control flow, data, functions, integrity and anti-analysis. The tool also supports anti-tamper controls, control-flow obfuscation and string encryption, giving protection-oriented users several ways to shape transformed code.

Diversified output: The same source can produce multiple output programs, a useful property for researchers comparing transformations or teams that want variation between builds.

Cross-compilation: Compiler and Environment options set the target, supporting cross-compilation across the listed operating systems and architectures.

Command-line workflow: Tigress is self-hosted and uses CLI build integration. That suits users who want to work with source and command-line options, but it places the integration work on the project team.

Pricing

Research use: free for non-profit organizations. It is the clear choice for qualifying nonprofit research, education and other non-profit use.

Commercial license: Custom pricing; contact the University of Arizona licensing department. A license is required for use in a for-profit organization. Users may try Tigress for any length of time before deployment, but that does not remove the licensing requirement for commercial use.

The source is not generally open source; it may be shared with researchers at universities or research labs on request. Commercial users who need help with unsupported features or target platforms can contact the maker about consulting and support.

Platforms

Tigress transforms C99 source and targets Linux, Darwin, Android and Windows, with Intel, ARM and WebAssembly architectures and 32- and 64-bit output. Supported compilers include GCC, Clang, Emscripten and cl. This breadth will interest teams targeting several environments, though the single-file input requirement still shapes how a project must be prepared.

Who it's for

Tigress is aimed at software-protection practitioners, reverse-engineering researchers and students. The maker invites researchers to attack Tigress-generated code and compare protection techniques, and presents the tool as a way for students to learn obfuscation and build reverse-engineering challenges. Nonprofit organizations can use it free; for-profit teams must obtain a license before deployment.

It is less suitable for teams with large, multi-file programs that cannot conveniently be merged, or for products where the possible slowdown from chosen transformations is unacceptable. The maker, Christian Collberg, is the primary developer and a professor in the University of Arizona Department of Computer Science.

Pros and cons

Pro: Multiple transformation families and diversified outputs provide useful flexibility for research and software-protection work.

Pro: Targets spanning desktop and mobile systems, WebAssembly, and Intel and ARM architectures support a broad range of deployment targets.

Pro: Nonprofit use is free, and prospective commercial users can try the tool without a time limit before deployment.

Con: Multi-file programs must be merged into one C file before transformation, adding a significant preparation step for many projects.

Con: Generated code can be slow, especially on huge programs, so protection choices may conflict with performance requirements.

Con: For-profit deployment requires a separately arranged license, and the source is not generally open source.

Alternatives

For teams considering other code-protection tools, Code Obfuscation Software is the broader category. ByteHide Shield is a freemium option with a free plan and platforms including iOS and self-hosted deployments; its paid plans have custom pricing. Choose it when those platforms or its individual-developer and small-project free tier better fit the need.

JS-Confuser is free and open source, so it is the alternative to consider when that licensing model matters. ProGuard is a free, open-source shrinker for Java and Kotlin; it is the more relevant option when working with those languages rather than C.

Allatori, DashO, Redgate SQL Provision, Enigma Protector and VMProtect are additional alternatives.

Verdict

Choose Tigress if you work with C and need configurable transformations, diverse outputs or broad target support for research, teaching or software protection. Its strongest case is the combination of transformation breadth and target flexibility, with free use for nonprofits. Look elsewhere if single-file preparation is impractical, runtime performance is critical, or you need a generally open-source tool; commercial deployment also requires arranging a license.