[0x27]

What is "puzzCode" ? *pronounced as Puzzle Code.

"puzzCode is a simple compiler based on mingw, written in C# to build windows applications in such a way that they can’t be analyzed by standard analysis tools (e.g. IDA, Ollydbg, x64dbg, Snowman Decompiler, etc...)
puzzCode is based on MinGW to compile C/C++ source code to assembly language while also obfuscating every instruction. puzzCode transforms each original instruction into obfuscated code by breaking each function into countless pieces. The usage is simple, copy and paste the C/C++ code into the program and click the compile button, it will then work its magic, and output a compiled binary that is statically,  control flow different and obfuscated differently with each compile."

View the GitHub repository here:
https://github.com/aaaddress1/puzzCode

[ Images ]

Disclaimer: PuzzCode was not developed by me, but I often use it on engagements (legally of course!) and find it quite useful.

[0x27]

Great share! Thank you buddy : )

thanks mate <3

[FriendlyChemist]

Good job <3

[Kyrie]

Is there any point to this tool though? Obfuscation should never be implemented at compile time, and in this case it makes you unable to use whatever compiler you want while providing way less protection and features than a normal obfuscating engine would.

[0x27]

Is there any point to this tool though? Obfuscation should never be implemented at compile time, and in this case it makes you unable to use whatever compiler you want while providing way less protection and features than a normal obfuscating engine would.

This isn't just a source code obfuscator, this tool obfuscates the instructions of your original code, basically changing the control flow of your program and breaking up its signature. And yes, you can use it for legitimate programs, but its clearly to be used as malware, since I posted it under the Malware Development sub-forum.

For instance, the original graph view seen in IDA:


And the one after instructions have been modified:

[Kyrie]

This isn't just a source code obfuscator, this tool obfuscates the instructions of your original code, basically changing the control flow of your program and breaking up its signature. And yes, you can use it for legitimate programs, but its clearly to be used as malware, since I posted it under the Malware Development sub-forum.

I am aware that it's not source code obfuscation, that'd be downright stupid. What I mean is that obfuscation should never be implemented bundled with the compiler, an obfuscator is not an IDE and it should never try to be one. That's why any protector that has some thought put into it will support loading symbols and information from PDBs, from which it has almost the same degree of knowledge of the executable without forcing the user to change their development workflow.

The control flow graph does not give out much information, so I decided to check out the source code. All it does is add a fixed asm procedure to break IDA's decompiler, which is fucking stupid if you realize that this tool is supposed to avoid signature scanning. Honestly this just looks like some dude's project for first year CS.