Allatori vs Tigress

Allatori is a Java obfuscator that works on compiled class files to protect intellectual property and make reverse engineering more difficult. It does not require original Java source code. Its features include name, control-flow and debug-information obfuscation, string encryption, watermarking and incremental obfuscation, along with a utility for stack traces and a module intended to disrupt decompilers. It supports J2EE, J2SE, J2ME and Android targets. Build options include a command-line interface, Apache Ant, Maven, Android Studio and an Eclipse plugin. Written in Java, it can technically run wherever a Java 1.4-or-later virtual machine is supported; the maker says it has been tested on Windows, Mac OS X and UNIX. The maker reports typical application size reductions of about 10–40%, sometimes up to 60% with many third-party libraries. String encryption can add 1–2% to bytecode size, while flow obfuscation can slightly increase size and rarely reduce performance. Native methods and their containing classes are not renamed automatically. A single developer license costs $290 as a one-time purchase; the free plan is also listed.

Tigress is a C obfuscator that changes source code to make static and dynamic reverse engineering harder. Users choose sequences of command-line transformations and options; one input program can produce multiple distinct outputs. Its transformation families cover control flow, data, functions, integrity, and anti-analysis. Tigress supports C99 and targets Linux, Darwin, Android, and Windows, as well as Intel, ARM, and WebAssembly, with 32- and 64-bit output. It supports GCC, Clang, Emscripten, and cl, and cross-compilation can be configured through compiler and environment options. Input must be a single C file, so multi-file programs need to be merged first. The maker offers it free to nonprofit organizations at free. Commercial use in a for-profit organization requires a license from the University of Arizona; pricing is on request, and users may try it for any length of time before deployment. The source is not generally open source. The maker notes that generated code may be slow, particularly for huge programs, and advises assessing security needs before using software-protection techniques.