Project address: Hikari-LLVM19
enable-strcry may have issues in rust, others test on your own
Warning: Compiled successfully only on mac arm64, not fully tested
The obfuscation plugin is extracted from Hikari-LLVM15 By 61bcdefg project.
This is my first time doing something like this, I am very grateful to 0xlane for the code that helped me avoid many pitfalls. Here is his project address ollvm-rust
Compilation#
Environment#
Macos 15.2
LLVM 19.1.7
cmake -G "Ninja" -S . -B ./build \
-DCMAKE_CXX_STANDARD=17 \
-DCMAKE_BUILD_TYPE=Release \
-DBUILD_SHARED_LIBS=ON \
-DLT_LLVM_INSTALL_DIR=/opt/homebrew/opt/llvm@19
Note to change LT_LLVM_INSTALL_DIR to your own, it is hardcoded in CMake, so replace it as well
Rust Dynamic Loading#
To dynamically load llvm pass plugins, switch to the nightly channel
rustup toolchain install nightly
Generate a sample project, load the pass plugin using the -Zllvm-plugins
parameter, and specify the obfuscation switch using the -Cpasses
parameter:
cargo new helloworld --bin
cd helloworld
cargo +nightly rustc --release -- -Zllvm-plugins="path/to/libHikari.dylib" -Cpasses="hikari(enable-fco,enable-strcry)..."
Opt Dynamic Loading#
# Use clang to compile the source code and generate IR
clang -emit-llvm -c input.c -o input.bc
# Use the opt tool to load and run the custom Pass
opt -load-pass-plugin="path/to/libHikari.dylib" --passes="hikari(enable-fco,enable-strcry)..." input.bc -o output.bc
# Compile the IR file into an object file
llc -filetype=obj output.bc -o output.o
# Link the object file to generate an executable
clang output.o -o output
Thanks#
Hikari-LLVM15 By 61bcdefg
ollvm-rust By 0xlane