Obfuscator-LLVM vs Tigress

Obfuscator-LLVM is a free, open-source LLVM fork for Linux that applies obfuscation while software is compiled. It is intended to make programs harder to reverse engineer or modify. Listed passes include instruction substitution, bogus control flow, and control-flow flattening, with function annotations also available. Its intermediate-representation approach covers languages supported by LLVM, including C, C++, Objective-C, Ada, and Fortran. Listed targets include x86, x86-64, PowerPC, ARM, Thumb, SPARC, Alpha, CellSPU, MIPS, MSP430, SystemZ, and XCore. Installation involves cloning the source repository, then building with CMake and make; binaries are placed in build/bin. The guide describes compiler use through Clang, autotools, and a custom Xcode plugin. The latest official non-development branch is llvm-4.0, based on LLVM 4.0.1. The project says obfuscated code can be slower and larger, and describes itself as an advanced prototype needing more testing before production use.

Tigress is a C obfuscator that changes source code to make static and dynamic reverse engineering harder. Users choose sequences of command-line transformations and options; one input program can produce multiple distinct outputs. Its transformation families cover control flow, data, functions, integrity, and anti-analysis. Tigress supports C99 and targets Linux, Darwin, Android, and Windows, as well as Intel, ARM, and WebAssembly, with 32- and 64-bit output. It supports GCC, Clang, Emscripten, and cl, and cross-compilation can be configured through compiler and environment options. Input must be a single C file, so multi-file programs need to be merged first. The maker offers it free to nonprofit organizations at free. Commercial use in a for-profit organization requires a license from the University of Arizona; pricing is on request, and users may try it for any length of time before deployment. The source is not generally open source. The maker notes that generated code may be slow, particularly for huge programs, and advises assessing security needs before using software-protection techniques.