Open Source Obfuscators

BlackObfuscator

Target:Dalvik Bytecode
Maintained:Yes

DeClang

Target:Native Code
Maintained:Yes

goron

Target:Native Code
Maintained:No

Hikari

Target:Native Code
Maintained:No

Hikari-LLVM15

Target:Native Code
Maintained:Yes

Java Obfuscator

Target:Java Bytecode
Maintained:No

Obfuscapk

Target:Smali Code
Maintained:Yes

obfuscator-llvm

Target:Native Code
Maintained:Yes

Pluto-Obfuscator

Target:Native Code
Maintained:Yes

pRETzel_logic

Target:Native Code
Maintained:No

SsagePass

Target:Native Code
Maintained:Yes

YANSOllvm

Target:Native Code
Maintained:No

Mobile Reverse Engineering Tools

BinaryNinja

Frida

Ghidra

IDA

featured.webp

Jadx

JEB

Radare2

Commercial Obfuscators

Appdome

Created in 2012, Appdome is a cloud-based solution to protect mobile applications (Android & iOS). It provides different kinds of protections as exposed in this demo.

Segment:Mobile
Interface:Cloud-Based
Website

Appsealing

Appsealing is a cloud-based solution to protect mobile applications (Android & iOS). It also provides RASP and white-boxed cryptography.

Segment:Mobile
Interface:Cloud-Based
Website

Arxan / Digital.ai

Arxan is one of the leaders as a software protection solution. It is known to protect different categories of programs: mobile applications, games, and software.

In 2020, Axran has been acquired by Digital.ai.

Segment:Various
Interface:Compiler
Website

DexGuard / iXGuard

Guardsquare (the company behind Proguard), is one of the leaders in protecting mobile applications. Their solutions, iXGuard for iOS and DexGuard for Android, provide code obfuscation, RASP, and whitebox cryptography.

They also develop AppSweep, a cloud-based solution to check the security of applications, and ThreatCast, a threat monitoring solution.

Segment:Mobile
Interface:Compiler
Website

DexProtector

DexProtector is a solution for protecting code on Android and iOS. For Android, the protection is based on a packer with a thin layer of code obfuscation. For iOS, DexProtector provides string encryption and bitcode obfuscation.

The user documentation of DexProtector is public for both Android and iOS.

Segment:Mobile
Interface:Packer-Compiler
Website

Irdeto

The solutions developed by Irdeto protect a wide range of industries with a focus on video games for their mobile solution.

In 2018, Irdeto acquired Denuvo, the leader in protecting PC video games.

Segment:Various
Interface:Packer-Compiler
Website

Promon

Promon Shield is a multi-layered obfuscator that includes code obfuscation and RASP.

The company is also known for having initiated a law suite in 2018 against security researchers for this paper: Honey, I Shrunk Your App Security: The State of Android App Hardening

Segment:Mobile
Interface:Unknown
Website

QShield

QShield, formerly known as Epona, is one of the best obfuscator for native code protection. I had the chance to work on this project1 and the least I can say is that its obfuscation passes are more than at the state of the art.

QShield is also challenged by internal audits from the Quarkslab’s consulting team.


  1. There is obviously nothing shared with O-MVLL. ↩︎

Segment:Various
Interface:Compiler
Website

Tigress

Tigress is a free and semi-open-source obfuscator developed by Christian Collberg1 which works by transforming source files.

Tigress is used in both academic research projects and commercial (whiteboxed) products.

Segment:Various
Interface:Compiler
Website

Verimatrix

Verimatrix, formerly known as Inside Secure, provides different solutions for protecting media and entertainment as well as mobile applications with App Shield.

Segment:Various
Interface:Cloud-Based
Website

zShield

zShield is part of the zimperium’s Mobile App Protection Suite (MAPS) and enables to protect code for Android and iOS.

According to the promotional video, the Android obfuscator is based on Proguard’s rules.

Segment:Mobile
Interface:Compiler
Website