$ show securevale/swift-confidential
Swift Confidential is a sophisticated code obfuscation tool designed to protect string literals in Swift applications from static analysis and reverse engineering. The system employs a modular architecture consisting of Core obfuscation algorithms, a public API with Swift macros, utility functions, a YAML-based configuration parser, and a command-line tool. It provides two primary usage methods: compile-time macros (#Obfuscate) that transform plain string literals into obfuscated versions with runtime decryption capabilities, and a YAML-driven approach where a CLI tool processes configuration files to generate obfuscated Swift code. The core innovation lies in how each obfuscation technique (compression, encryption, randomization) not only obscures the data but also hides metadata about the method used—such as obfuscating compression magic bytes, encrypting key placement based on nonce bits, and obscuring shuffle patterns. This dual-layer approach significantly increases resistance to reverse engineering attempts. The project demonstrates strong maintenance with recent activity, up-to-date dependencies, and comprehensive testing.
The LLM identified 3 files worth highlighting for reuse:
Implements decompression while obfuscating the magic bytes that identify the compression algorithm used. By XORing the header/footer magic bytes with the nonce, it prevents attackers from determining which compression algorithm (lzfse, lz4, lzma, zlib) was applied, adding a crucial layer of security beyond standard decompression. The component is self-contained, depends only on Foundations and ConfidentialUtils extensions, and demonstrates non-obvious craftsmanship in combining standard cryptographic techniques with metadata hiding.
Performs decryption while obscuring where the encryption key is stored within the encrypted data. Based on the most significant bit of the nonce, it places the key either at the beginning or end of the data, preventing attackers from locating the key through simple pattern analysis. The implementation cleanly separates encryption logic from key obfuscation, uses standard CryptoKit algorithms (AES-GCM, ChaChaPoly), and shows sophisticated thinking about how to protect not just the data but also the method used to protect it.
Implements byte shuffling/unshuffling while concealing the shuffle pattern itself. It obfuscates both the count of bytes and the shuffle indices using XOR with the nonce, making it impossible to determine the original shuffle pattern without knowing the nonce. The component handles variable-width indices (8, 16, or 64-bit) based on data size, showing attention to edge cases. It exemplifies the project's core philosophy of protecting both data and the method used to protect it.