{"id":13574193,"url":"https://github.com/0xlane/ollvm-rust","last_synced_at":"2025-09-05T05:31:51.508Z","repository":{"id":246329628,"uuid":"820507012","full_name":"0xlane/ollvm-rust","owner":"0xlane","description":"out-of-tree llvm obfuscation pass plugin (dynamically loadable by rustc). || rust toolchain with obfuscation llvm pass.","archived":false,"fork":false,"pushed_at":"2024-06-28T18:17:33.000Z","size":206,"stargazers_count":121,"open_issues_count":6,"forks_count":26,"subscribers_count":1,"default_branch":"ollvm-pass","last_synced_at":"2025-04-05T23:24:13.003Z","etag":null,"topics":["llvm","llvm-pass","obfuscation","ollvm","ollvm-obfuscation","rust"],"latest_commit_sha":null,"homepage":"","language":"C++","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/0xlane.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-06-26T15:50:53.000Z","updated_at":"2025-04-05T15:04:36.000Z","dependencies_parsed_at":"2024-06-28T19:29:50.557Z","dependency_job_id":"36032bc0-5cf2-4b46-bbc7-97353614c511","html_url":"https://github.com/0xlane/ollvm-rust","commit_stats":null,"previous_names":["0xlane/ollvm-rust"],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/0xlane/ollvm-rust","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xlane%2Follvm-rust","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xlane%2Follvm-rust/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xlane%2Follvm-rust/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xlane%2Follvm-rust/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/0xlane","download_url":"https://codeload.github.com/0xlane/ollvm-rust/tar.gz/refs/heads/ollvm-pass","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xlane%2Follvm-rust/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":273716303,"owners_count":25155217,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-09-05T02:00:09.113Z","response_time":402,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["llvm","llvm-pass","obfuscation","ollvm","ollvm-obfuscation","rust"],"created_at":"2024-08-01T15:00:47.965Z","updated_at":"2025-09-05T05:31:46.489Z","avatar_url":"https://github.com/0xlane.png","language":"C++","funding_links":[],"categories":["C++"],"sub_categories":[],"readme":"# ollvm-pass\n\nOut-of-tree llvm obfuscation pass，可在编译时对二进制进行混淆，通过 rustc/opt 动态加载使用，无需重新编译 llvm 和 rustc，支持以下混淆方式：\n\n- 间接跳转,并加密跳转目标(-irobf-indbr)\n- 间接函数调用,并加密目标函数地址(-irobf-icall)\n- 间接全局变量引用,并加密变量地址(-irobf-indgv)\n- 字符串(c string)加密功能(-irobf-cse) （rust 中不生效，已知问题）\n- 过程相关控制流平坦混淆(-irobf-cff)\n- 全部 (-irobf-indbr -irobf-icall -irobf-indgv -irobf-cse -irobf-cff)\n\n混淆插件提取自 [Arkari](https://github.com/KomiMoe/Arkari) 项目。\n\n\u003e 注意：该项目当前仅在 windows x86 下测试，其他平台未测试\n\n![effect.png](assets/effect.png)\n\n## rust 动态加载\n\n动态加载 llvm pass 插件需切换到 nightly 通道（[Allow loading of LLVM plugins [when dynamically built rust]](https://github.com/rust-lang/rust/pull/82734)）：\n\n```bash\nrustup toolchain install nightly\n```\n\n生成一个示例项目，通过 `-Zllvm-plugins` 参数加载 pass 插件，并通过 `-Cpasses` 参数指定混淆开关：\n\n```bash\ncargo new helloworld --bin\ncd helloworld\ncargo +nightly rustc --target x86_64-pc-windows-msvc --release -- -Zllvm-plugins=\"/path/to/LLVMObfuscationx.dll\" -Cpasses=\"irobf(irobf-indbr,irobf-icall,irobf-indgv,irobf-cff,irobf-cse)\"\n```\n\n## opt 动态加载\n\n```bash\n# 使用 clang 编译源代码并生成 IR\nclang -emit-llvm -c input.c -o input.bc\n\n# 使用 opt 工具加载和运行自定义 Pass\nopt -load-pass-plugin=\"/path/to/LLVMObfuscationx.dll\" --passes=\"irobf(irobf-indbr,irobf-icall,irobf-indgv,irobf-cff,irobf-cse)\" input.bc -o output.bc\n\n# 将 IR 文件编译为目标文件\nllc -filetype=obj output.bc -o output.o\n\n# 链接目标文件生成可执行文件\nclang output.o -o output.exe\n```\n\n## x86 msvc pass 编译方法\n\n### 环境\n\n- Windows 11 (10.0.22631.3737)\n- Visual Studio 2022 (17.10.3)\n  - 使用 C++ 的桌面开发\n- LLVM 18.1.5\n\n### 编译\n\n需在 `x64 Native Tools Command Prompt for VS 2022` 环境中执行，从开始菜单或者执行 `cmd.exe /k \"C:\\Program Files\\Microsoft Visual Studio\\2022\\Community\\Common7\\Tools\\VsDevCmd.bat\" -startdir=none -arch=x64 -host_arch=x64` 进入：\n\n```bash\ngit clone --branch ollvm-pass https://github.com/0xlane/ollvm-rust.git\ncd ollvm-rust\ncmake -G \"Ninja\" -S .\\ollvm-pass -B .\\build -DCMAKE_CXX_STANDARD=17 -DCMAKE_BUILD_TYPE=Release -DBUILD_SHARED_LIBS=ON -DLT_LLVM_INSTALL_DIR=D:\\dev\\rust_ollvm\\llvm-build\\llvm_x64\ncmake --build .\\build\\ -j12 # change 12 to yourself nproc\n```\n\n\u003e `LT_LLVM_INSTALL_DIR` 需指定为自己的 LLVM 安装路径\n\n## 参考\n\n- [Allow loading of LLVM plugins [when dynamically built rust]](https://github.com/rust-lang/rust/pull/82734)\n- [Installing from Source](https://github.com/rust-lang/rust/blob/master/INSTALL.md)\n- [rustc dev guide](https://rustc-dev-guide.rust-lang.org/building/how-to-build-and-run.html)\n- [Windows rust使用LLVM pass](https://bbs.kanxue.com/thread-274453.htm)\n- [Orust Mimikatz Bypass Kaspersky](https://b1n.io/posts/orust-mimikatz-bypass-kaspersky/)\n- [Building LLVM with CMake](https://llvm.org/docs/CMake.html#developing-llvm-passes-out-of-source)\n- [llvm-tutor](https://github.com/banach-space/llvm-tutor)\n- [String encryption failed](https://github.com/joaovarelas/Obfuscator-LLVM-16.0/issues/8)\n\n## 感谢\n\n- [Arkari](https://github.com/KomiMoe/Arkari)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2F0xlane%2Follvm-rust","html_url":"https://awesome.ecosyste.ms/projects/github.com%2F0xlane%2Follvm-rust","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2F0xlane%2Follvm-rust/lists"}