obfus.h

obfus.h is a macro-only library for compile-time polymorphic obfuscation of C applications, designed specifically for TinyCC 0.9.28rc on Windows x86 and x64. Download the complete compiler package from TinyCC-builder releases. One file. Protection baked into your binary.

Just seeing obfus.h in your binary will make a reverse engineer question the existence of God.

What features does it have?...

• 🔍 Function Call Obfuscation: Confuse function calls to make your code less readable to unauthorized eyes.
• 🛡️ Anti-Debugging Techniques: Built-in mechanisms to prevent code analysis during runtime.
• 🔄 Control Flow Code Mutation: Turns code into spaghetti, making it difficult to parse conditions and loops.
• 🧶 Strings Hiding: Hides specified strings in a file and dynamically collects them when executed.
• 🚫 Anti-Decompilation Techniques: Makes many popular decompilers useless visually breaking their output.
• 😈 Fake Signatures Adding: Can add fake signatures of various packers and protectors to confuse reverse engineers.
• 🧠 Virtualization: Makes math operations very difficult to understand using virtual machine commands.
• 🪟 Windows API Protection: Automatically protects common GUI and system calls with no extra setup.

🕹️ Daily Crackmes

Four levels: Easy, Medium, Hardcore and Extreme. Unique crackmes, automatically generated and built every day. Each challenge has its own generated verification logic, not just a different password. Sharpen your reverse-engineering skills or see how obfus.h works in real binaries — no compiler or test setup needed. Download. Disassemble. Find the password.

🎯 Intended use

obfus.h is a full-featured obfuscation tool, not a proof of concept. It is a powerful tool when you understand where and how to apply it: use it to protect selected native components containing sensitive logic.

Since obfus.h requires TCC, the recommended approach for larger projects is to isolate that logic in C DLLs compiled with TCC and obfuscated with obfus.h. The main application can remain in C#, C++, another language, or C compiled with GCC, LLVM/Clang or Visual C and call those DLLs through their exported interfaces.

The resulting binaries can also be processed by commercial protectors and packers to add another layer of protection. Check compatibility with your chosen protector and settings before distributing the protected components.

[!IMPORTANT] obfus.h significantly raises the barrier to reverse engineering, but it is not a panacea. Protecting trade secrets also requires your own internal protection mechanisms; obfuscation should be one layer of your protection strategy.

👾 Usage

Integrating obfus.h into your project is a simple process. Just include the following line in your code:

#include "obfus.h"

One file. Powerful protection. Include it and build your application: the protection code is baked directly into the output binary, making your native code much harder to analyze.

Protection is polymorphic throughout the application: even small changes to the source code can substantially reshape the protection baked into the output binary, changing its instructions, constants and control-flow paths.

Control-flow protection uses Control Flow Explosion: straightforward conditions and loops expand into a tangled graph of branches, indirect transitions and fake functions. Polymorphic instruction sequences carry state and select continuations, so removing them without preserving their dependencies can break execution. The graph's structure and instruction forms vary with the source code, making the original logic harder to follow in disassemblers and decompilers. CFLOW_V2 adds another layer of control-flow mutation.

Automatic control-flow protection transforms if, else, break, switch, while, for, return, continue, default and do into polymorphic code that makes the original logic harder to follow. For explicit insertion, use BREAK_STACK_CFLOW; or STACK_PROXY_FUNCTIONS;. NO_CFLOW disables automatic control-flow protection; NO_OBF disables obfuscation.

IntelliSense remains available. No extra tools or code generation are required.

Define options before including obfus.h:

// Advanced code protection (see the "Virtualization" part of the documentation!)
#define VIRT           1  // Allows you to use the functions of a math VM

// Additional options
#define CFLOW_V2       1  // Stronger control-flow protection (slower execution)
#define ANTIDEBUG_V2   1  // Add hardware-breakpoint checks to anti-debugging protection
#define FAKE_SIGNS     1  // Fake protector/packer signatures (crackme/CTF only)

// Disabling default features
#define NO_OBF         1  // Don't obfuscate (for debugging)
#define NO_CFLOW       1  // Don't use Control-Flow obfuscation
#define NO_ANTIDEBUG   1  // Don't build in debugging protection
#define NO_PDATA_DECOYS 1 // Disable additional x64 fake functions

[!WARNING] Reserve FAKE_SIGNS for crackme/CTF challenges; avoid it in production software. Fake protector and packer signatures can trigger antivirus detections and cause tools such as Detect It Easy to flag the binary as suspicious or potentially malicious.

or use it with compiler args:

tcc "app.c" -w  -D NO_CFLOW  -D ANTIDEBUG_V2  -D FAKE_SIGNS  -D VIRT

[!TIP] Use -w to suppress warnings generated by the protection during compilation.

🔐 Debugging protection is triggered by calls to many basic MSVCRT functions. In critical places in the code you can use the ANTI_DEBUG; construct. For example:

ANTI_DEBUG;
if (!licenseExpired()) {
	// ...
}

🧶 Strings hiding

Use HIDE_STRING(str) to build a string at runtime instead of storing it as a plain string in the binary. Use it inside functions; it cannot initialize static variables.

The returned pointer remains valid until the enclosing block ends. Copy the string if it needs to outlive that block. Some decompilers can still reconstruct its contents.

Example:

char *hidden_message = HIDE_STRING("Hello, world!");
// ...
printf(hidden_message);

👺 Virtualization

Enable VIRT and use the VM macro-operators to run selected calculations through an embedded virtual machine. No extra initialization is required. With VIRT disabled, these macro-operators use ordinary calculations.

[!WARNING] Virtualization in critical locations can impact optimization. Use with caution only in areas where it is really needed

The virtual machine does not support some basic double comparison operations.

You can use logical operators that use virtual machine calls to further complicate the understanding of your code:

This is not a complete replacement for if/else, but is just a complication of standard operators.

A simple example of using virtualization:

// ...
#define VIRT 1
// ...

// if ((2 + 2) == 4) { ... }
VM_IF (VM_EQU(VM_ADD(2, 2), 4)) {
	printf("2 + 2 == 4!");
}

// if (condition1) { ... }
// else if (condition2) { ... }
// else { ... }
VM_IF (condition1) {
	// if
} VM_ELSE_IF (condition2) {
	// else if
} VM_ELSE {
	// else
}

You can find examples of using all the functions of a virtual machine in the file tests/vm.c

❓ Example

If you need advanced protection against skilled reversers, use CFLOW_V2 and ANTIDEBUG_V2 options.

// Let's obfuscate your code!

#include <stdio.h>

#define VIRT         1 // [+] Use math virtual machine

#define CFLOW_V2     1 // [+] ControlFlow v2
#define FAKE_SIGNS   1 // [+] Fake signatures
#define ANTIDEBUG_V2 1 // [+] AntiDebug v2

#define NO_OBF       0 // [-] Don't obfuscate (disable all)
#define NO_CFLOW     0 // [-] Disable ControlFlow
#define NO_ANTIDEBUG 0 // [-] Disable AntiDebug

#include "obfus.h"

void _start(void) {
	ANTI_DEBUG;

	char *out = malloc(256);

	STACK_PROXY_FUNCTIONS;

	if (out) {
		strcpy(out, HIDE_STRING("Hello, world!\n"));
		printf("%s", out);
	} else {
		printf("Error!\n");
	}

	free(out);

	int result = VM_ADD(5, 7); // 5 + 7

	BREAK_STACK_CFLOW;
	VM_IF (VM_EQU(result, 12)) { // (5 + 7) == 12
		printf("5 + 7 == 12");
	}

	exit(0);
}

🤖 How it works

🛠 Compiler (important)

Use TinyCC 0.9.28rc from TinyCC-builder, which includes the Windows headers, libraries and obfh-update.cmd. TinyCC 0.9.27, Visual C, GCC and Clang are not supported.

[!NOTE] To build the latest compiler yourself, download TinyCC-builder and double-click build.cmd; sources and dependencies are downloaded automatically.

🌐 obfus.h updater

obfh-update.cmd is already included in the standard TinyCC-builder package, next to tcc.exe. No separate download is needed.

Run it manually from your project directory or add it to your build pipeline. It downloads the latest obfus.h into the current directory:

call "C:\TinyCC\obfh-update.cmd"
if errorlevel 1 exit /b 1
"C:\TinyCC\tcc.exe" app.c -w

Without the compiler package, you can also download the script separately.

🦎 Security Audits and the Community

• Defeating a Heavily Obfuscated Binary - Black-box analysis of internal obfus.h security mechanisms and it deobfuscation. All vulnerabilities have now been patched.
• V1t CTF 2026 Writeup: 8 Challenges Solved - Reverse engineering of the obfus.h-protected Sealed Input Verifier challenge.
• [CTF] 2024 CISCN x 长城杯 初赛逆向0解题-VT 解题全流程 - Reversing CTF with previous generation of obfus.h using the original protection code.
• ObfusHunter - A utility for scanning files protected by obfus.h

📖 Protection in practice

Extremely aggressive polymorphic obfuscation is the core of obfus.h. Its protection deliberately uses aggressive transformations to disrupt the semantic structure recovered by analysis tools while preserving the program's behavior. Instructions and control-flow paths vary throughout the binary, making the original logic harder to reconstruct and modify. Use it alongside your application's own checks and protections.

What the diagrammatic code will look like after obfuscation:

The reverser will see something like this if he tries to use a decompiler:

This is what all hidden strings via HIDE_STRING feature look like in the disassembler (x86-64 arch):

  ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ;
  ; PROTECTED STRING:                  ; ORIGINAL STRING:         ;
  mov eax, 48h                         lea rax, aHelloWorld       ;
  mov [rbp-0Fh], al                    mov r11, rax               ;
  mov eax, 65h                         ; . . .                    ;
  mov [rbp-0Eh], al                                               ;
  mov eax, 6Ch                                                    ;
  mov [rbp-0Dh], al                                               ;
  mov eax, 6Ch                                                    ;
  mov [rbp-0Ch], al                                               ;
  mov eax, 6Fh                                                    ;
  mov [rbp-0Bh], al                                               ;
  mov eax, 2Ch                                                    ;
  ; etc . . .                                                     ;
  ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ;

🌈 Special thanks

Thanks to everyone who helped in the development of this project. I appreciate it! ❤️

• 👨🏼‍💻 @horsicq (for help with the code and advices)
• 🐺 @ac3ss0r (for cool ideas and their solutions)

And thanks to you 🤝 for paying attention to this project!