Obfuscar vs Tigress

Obfuscar is a free tool for obfuscating .NET assemblies on Linux, macOS, and Windows. It renames metadata—including methods, properties, events, fields, types, and namespaces—to short names, making decompiled code harder to follow. The shorter names can also reduce executable size. An optional string-hiding feature replaces string loads with calls that retrieve values from a buffer, at a small performance cost; the project notes that this hiding is reversible. Configuration uses an XML file to specify assemblies, dependency paths, and output location. Obfuscar is available as a NuGet package and a .NET Global Tool, with command-line use. Its 3.0 beta requires absolute paths and rejects relative paths and variable placeholders. The project cautions that obfuscation does not stop a determined reverse-engineering effort and that malformed or malicious assemblies can cause unexpected behavior, including crashes or hangs. It recommends processing only trusted inputs.

Tigress is a C obfuscator that changes source code to make static and dynamic reverse engineering harder. Users choose sequences of command-line transformations and options; one input program can produce multiple distinct outputs. Its transformation families cover control flow, data, functions, integrity, and anti-analysis. Tigress supports C99 and targets Linux, Darwin, Android, and Windows, as well as Intel, ARM, and WebAssembly, with 32- and 64-bit output. It supports GCC, Clang, Emscripten, and cl, and cross-compilation can be configured through compiler and environment options. Input must be a single C file, so multi-file programs need to be merged first. The maker offers it free to nonprofit organizations at free. Commercial use in a for-profit organization requires a license from the University of Arizona; pricing is on request, and users may try it for any length of time before deployment. The source is not generally open source. The maker notes that generated code may be slow, particularly for huge programs, and advises assessing security needs before using software-protection techniques.