Swift Confidential is a sophisticated code obfuscation tool designed to protect string literals in Swift applications from static analysis and reverse engineering. The system employs a modular architecture consisting of Core obfuscation algorithms, a public API with Swift macros, utility functions, a YAML-based configuration parser, and a command-line tool. It provides two primary usage methods: compile-time macros (#Obfuscate) that transform plain string literals into obfuscated versions with runtime decryption capabilities, and a YAML-driven approach where a CLI tool processes configuration files to generate obfuscated Swift code. The core innovation lies in how each obfuscation technique (compression, encryption, randomization) not only obscures the data but also hides metadata about the method used—such as obfuscating compression magic bytes, encrypting key placement based on nonce bits, and obscuring shuffle patterns. This dual-layer approach significantly increases resistance to reverse engineering attempts. The project demonstrates strong maintenance with recent activity, up-to-date dependencies, and comprehensive testing.
CoBRA is a C++ library and CLI tool for simplifying mixed Boolean-arithmetic (MBA) expressions, commonly used in software obfuscation. It ingests expressions combining arithmetic (+, -, *) with bitwise (&, |, ^, ~) and shift operators and outputs a simplified equivalent form. The core engine uses a worklist orchestrator that coordinates 36+ passes, including signature-based transforms (CoB butterfly, ANF recovery), semilinear normalization with bit partitioning, decomposition (product, polynomial, template cores), ghost residual solving, and pattern matching. An optional Z3 verifier proves full-width equivalence. The tool can be used as a standalone CLI (`cobra-cli`), as an LLVM pass for automatic deobfuscation during compilation, or as a library (`cobra::Simplify()`). The codebase is well-structured with extensive test coverage (1195+ tests) and benchmark datasets from multiple research projects. While the core is tightly coupled internally, several generic utilities (Result type, profiling stubs, math helpers) are reusable independently.
DexKit is a high-performance C++ library for runtime parsing and querying of Android DEX bytecode, primarily used by Xposed module developers to locate obfuscated classes, methods, and fields. It provides a rich DSL in Kotlin/Java for constructing structural queries based on annotations, opcodes, string usage, field/method references, and more. The core engine parses DEX files from APK archives, builds in-memory indexes, and uses algorithms like Aho-Corasick for substring matching and the Hungarian algorithm for unordered set matching. Communication between the native C++ layer and JVM is handled via FlatBuffers serialization. The library also includes an optional caching layer (`DexKitCacheBridge`) for persisting query results across app restarts. It is distributed as an Android AAR via Maven Central and includes a demo app and unit tests.
Xray-core is a production-grade network proxy framework written in Go. It implements a wide range of proxy protocols (VMess, VLESS, Shadowsocks, Trojan, Hysteria, WireGuard, SOCKS, HTTP) and transport layers (TCP, WebSocket, gRPC, KCP, SplitHTTP, HTTPUpgrade, QUIC) with advanced obfuscation techniques (Noise, Sudoku, XMC, Realm) for censorship circumvention. The architecture is modular, with pluggable inbound/outbound handlers, a rule-based router with domain/IP/port/protocol matching, a DNS subsystem supporting multiple upstreams (DoH, DoQ, TCP, UDP, FakeDNS), and an observatory for health-based load balancing. Configuration is via JSON/protobuf, and runtime management is exposed through gRPC APIs. The codebase is extensive, well-tested (unit and integration scenarios), and leverages Go's concurrency primitives heavily for performance. However, it includes experimental transports and deprecated features (e.g., legacy Shadowsocks, xtls security), indicating ongoing evolution and some technical drift in the ecosystem.
Godot-Secure is a set of Python scripts that automatically modify the Godot Engine source code to integrate enhanced encryption (AES-256 or Camellia-256) with a unique security token system. The scripts generate random magic headers, a 32-byte security token embedded in the engine binary, and optionally apply advanced key derivation formulas or scramble the GDScript tokenizer buffer to prevent decompilation. The tool is designed to be run once before compiling a custom Godot engine build, making each build cryptographically unique and resistant to generic decryption tools. The codebase demonstrates solid engineering with declarative modification definitions, backup creation, and detailed logging, though it is tightly coupled to the Godot source structure.
de4py is a comprehensive Python deobfuscation and reverse engineering tool designed primarily for Windows environments. It combines a native PySide6 GUI with a CLI interface to analyze, unpack, and clean obfuscated Python scripts and PyInstaller executables. The core functionality relies on a modular engine architecture that supports multiple deobfuscation strategies, including legacy regex-based detection and the newer 'Onyx' engine which utilizes AST manipulation and local LLM integration for semantic recovery. It also features native C++ components for process injection and behavior monitoring, allowing users to hook into running Python processes for dynamic analysis. The architecture is split between high-level Python logic for AST transformation and low-level C++ code for system interaction. The Python side manages the deobfuscation pipeline, UI rendering, and plugin management, while the C++ side handles DLL injection, API hooking via Detours, and named pipe communication. This hybrid approach provides powerful capabilities but introduces significant platform coupling and dependency on specific Windows APIs and Python versions. The tool is licensed under CC BY-NC-4.0, restricting commercial use. While the codebase demonstrates sophisticated engineering in areas like VM lifting and AST optimization, it carries risks associated with external API dependencies (telemetry, updates), brittle regex signatures for obfuscation detection, and heavy reliance on Windows-specific system calls. It is best suited for security researchers and malware analysts working in Windows environments who require a unified static and dynamic analysis platform.